CBK or CMA? Which Regulator Licenses Your Crypto Business in Kenya, and What to Do When Both Claim You

Choosing the right CBK or CMA virtual asset license is the first — and most consequential — decision facing any crypto business entering Kenya’s new regulatory regime.

In brief

• Kenya licenses virtual asset businesses through two regulators. The Central Bank of Kenya takes the activities closest to money and custody: wallets, payment processing, stablecoin issuance and fiat conversion. The Capital Markets Authority takes the activities closest to investment: exchanges, brokerage, advice, asset management, token offerings and tokenisation.
• The classification turns on what your business does in substance, not what it calls itself. Regulation 4 of the 2026 Regulations reaches anyone targeting Kenyan consumers or earning income from Kenya, and a mislabelled product does not change its regulator.
• Many real businesses span both sides. The Regulations allow the two regulators to license and supervise jointly, but a dual-perimeter business must plan two application files, aggregated capital, and a sequencing strategy, and it should settle all of that before incorporation, not after launch.

The first practical question for any virtual asset business facing Kenya’s new licensing regime is not what the requirements are. It is which door to knock on. The Virtual Asset Service Providers Act, 2025 and the Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 22 July 2026) divide the perimeter between the Central Bank of Kenya and the Capital Markets Authority, and getting the classification wrong at the start costs an applicant months.

The file a wallet provider needs and the file an exchange needs are built to different specifications, priced against different capital, and assessed by different supervisors. This article maps the split, works through the hard cases where a single product straddles it, and sets out what to do when, as increasingly happens, both regulators have a legitimate claim on your business. For the full transition timeline and what existing operators must do before the deadline, see our main guide to Kenya’s virtual asset regime.

The map: CBK or CMA virtual asset license — money to the Central Bank, investment to the CMA

The dividing principle is functional. Activities that look like banking, payments and safekeeping sit with the CBK; activities that look like securities markets sit with the CMA.

The Central Bank of Kenya licenses virtual asset wallet providers, meaning businesses that hold or manage customers’ private keys; virtual asset payment processors, meaning businesses arranging transactions between virtual assets and fiat currency; and stablecoin issuers, the most heavily regulated category in the regime, carrying KES 300 million in paid-up capital, full reserve backing, redemption at par and a prohibition on paying interest to holders.

Separately, and easily missed, the conversion of virtual assets to and from foreign currency requires its own CBK authorisation under regulation 14, distinct from and additional to the payment processor licence.

The Capital Markets Authority licenses virtual asset exchanges and trading platforms, brokers, investment advisors, virtual asset managers, initial coin offering providers, tokenisation providers and token issuance platforms. Where the activity involves an offering to the market, a token sale, a tokenised real estate project, a platform listing, the CMA’s role extends beyond licensing the operator to approving the offer itself, supported by a compliant white paper and, for token offerings, the regulator’s prior written no objection.

Why the split matters more than it looks

It would be a mistake to treat the allocation as administrative trivia. The two regulators bring different supervisory instincts to the same industry. The CBK supervises institutions whose failure spreads: its categories carry the heaviest capital and liquidity requirements in the regime, wallet providers at KES 150 million paid up with liquid capital of KES 30 million or one hundred percent of thirty days’ current liabilities, and stablecoin issuers at double that capital again, because a custodian or an issuer that fails takes its customers’ assets down with it.

The CMA polices conduct in markets: its side of the regime imports the classical securities offences, insider dealing, market manipulation, false trading, front running, churning and cold calling, into the virtual asset space for the first time, with advertising rules running down to the prominence of risk warnings. Which regulator issues your CBK or CMA virtual asset license therefore shapes not only your application but the compliance culture your business will live inside for years.

The fee and capital consequences of classification are equally concrete. An exchange pays a KES 100,000 application fee, a KES 1 million licence fee and holds KES 100 million paid up; a broker pays KES 100,000 to apply, KES 100,000 for the licence and holds KES 10 million; an investment advisor pays KES 10,000 to apply with no paid-up capital requirement but mandatory professional indemnity cover. A business that files as a broker and is reclassified by the regulator as an exchange has not made a paperwork error; it has a ten-fold capital gap.

The hard cases

The custodial exchange: virtual asset exchange license Kenya

The commonest real-world model, an exchange that also holds customers’ keys, spans the perimeter by design. The trading platform is the CMA’s; the custody is the CBK’s. The Regulations anticipate exactly this and allow the regulators to license and supervise jointly, but joint supervision is something the applicant plans for, not something that happens to it.

Expect two assessments of one business, and build the file so that the custody architecture, segregation of client assets and proof of full reserves satisfy a central banking reviewer while the market conduct, surveillance and listing standards satisfy a securities reviewer.

The payments app with a swap feature

A mobile money or remittance product that lets users hold and convert virtual assets is a CBK payment processor, and the moment it converts virtual assets to or from foreign currency, the separate regulation 14 authorisation is engaged as well. If the swap function works by routing orders to a matching engine and charging a margin, the product has quietly added a brokerage function, and a CMA question now sits inside a CBK application. The engineering decision about how a swap executes is, under this regime, a regulatory decision.

The wallet that added trading: virtual asset wallet provider Kenya rules

The mirror image: a custody-first product that bolts on a buy-and-sell feature. Custody keeps it with the CBK; the trading feature, if the operator matches or executes trades for a fee, brings in the CMA. Genuine self-custody software, where the customer alone holds the keys and the provider supplies only software, sits outside the wallet category altogether, but the exclusion is narrow and honest: retained key-recovery control, or a fee earned on matched trades, pulls the product back inside.

The tokenised real estate platform

Tokenisation of land or buildings is a CMA activity three times over: the tokenisation provider licence, CMA approval of the offer itself with its white paper, and, where the platform hosts issuance and secondary trading for third parties, the token issuance platform licence. If the platform also holds investors’ tokens in custody or moves their money, the CBK categories join the analysis. A tokenisation project should be mapped against the full Schedule before the first investor deck is written, because the perimeter conclusions drive the corporate structure.

The stablecoin issuer with an ecosystem: stablecoin issuer license Kenya

A stablecoin issuer is the CBK’s, comprehensively. But issuers rarely stop at issuance: the same group typically wants an exchange listing venue, a payments rail and a treasury product. Each of those is a separate category with its own regulator, and a group structure that isolates the issuer entity, with its KES 300 million capital and reserve obligations, from the trading and payments entities is usually the cleanest answer.

Ten business models, mapped to a CBK or CMA virtual asset license

What the business actually does	Licence category engaged	Regulator
Digital platform matching buyers and sellers of virtual assets for a fee	Virtual asset exchange / trading platform	CMA
OTC desk or peer-to-peer dealer earning a spread or commission on client trades	Broker (or exchange, by substance)	CMA
Business holding or managing customers’ private keys	Virtual asset wallet provider	CBK
Arranging transactions between virtual assets and fiat currency, including stablecoin remittances	Virtual asset payment processor; conversion to or from foreign currency needs the separate CBK authorisation under regulation 14	CBK
Issuing a token designed to hold a stable value against reserve assets	Stablecoin issuer	CBK
Charging fees for investment advice on virtual assets	Virtual assets investment advisor	CMA
Managing portfolios containing virtual assets on a discretionary mandate	Virtual asset manager	CMA
Running or promoting a token sale for its own project	Initial coin offering provider (corporate applicants only; the offering itself needs prior written no objection)	CMA
Converting land, buildings or other real-world assets into tradable tokens	Tokenisation provider, with CMA approval of the offer and its white paper	CMA
Hosting third-party token issuance and secondary trading	Token issuance platform	CMA

Two systemic points sit behind the table. First, where one entity holds authorisations for more than one activity, the Regulations require it to hold the paid-up capital of its highest-capital category plus fifty percent of the paid-up capital for each additional activity, so consolidating permissions in a single company is a capital decision as much as a structural one.

Second, licences across both regulators are annual and expire on 31 December of the year of issue regardless of grant date, with renewals due at least two months before expiry and renewal fees for the larger categories linked to turnover.

When both claim you: sequencing a dual licensing CBK CMA Kenya application

For a business genuinely inside both perimeters, the practical questions are sequencing and consistency. On sequencing, begin with the regulator whose category represents the core of the business, the one without which the product does not exist, and open communication with the second regulator early rather than presenting it with a fait accompli; the Regulations’ provision for joint licensing works best when both supervisors are looking at the same facts at the same time.

On consistency, remember that the two files will be compared. The business plan, ownership disclosures, source-of-funds evidence and financial projections filed at the CBK must match what the CMA receives, and the coordination machinery exists to notice when they do not: the Regulations establish a Coordination Forum chaired by the National Treasury bringing together the CBK, the CMA, the Financial Reporting Centre, the Office of the Data Protection Commissioner, the Kenya Revenue Authority and the enforcement and intelligence agencies, meeting at least quarterly to keep the two halves of the regime aligned. An applicant should assume that anything told to one regulator is available to the other.

Where the classification is genuinely contestable, and some are, the wrong response is to pick the cheaper regulator and hope. The right response is a perimeter opinion done before filing, put to the regulator candidly at the pre-application stage. Under this regime the regulators decide complete applications within thirty days, but nothing obliges them to be quick about an application filed into the wrong building, and with the 4 November 2026 transition deadline bearing down on existing operators, a misdirected file is the most expensive mistake available.

Substance over labels, always

Every hard case above resolves the same way the easy ones do: by asking what the business actually does. Regulation 4 sets the tone for the whole regime, applying it to anyone offering virtual asset services who targets Kenyan consumers or derives economic benefit or income from Kenya, physical presence or not, and the Act’s Schedule describes activities, not brand categories.

A “software provider” that matches trades is an exchange. A “utility token” that people buy to invest is a virtual asset. A “non-custodial” wallet with key recovery is a custodian. The regulators will read the product, not the press release, and the businesses that fare best under dual-regulator regimes are the ones whose own classification analysis was done first, in writing, and would survive being read aloud by either supervisor.

Frequently asked questions

How do I know whether I need a CBK or CMA virtual asset license? Ask what the business does, not what it is called. If it holds money, keys or issues a stablecoin, it sits with the Central Bank of Kenya. If it involves trading, advice, asset management or an offer to investors, it sits with the Capital Markets Authority. Many products need both.

Who licenses a crypto exchange in Kenya? The Capital Markets Authority. If the exchange also holds customers’ private keys, the custody element engages the Central Bank of Kenya as well, and the two can license jointly.

Who licenses a crypto wallet or custody business? The Central Bank of Kenya, as a virtual asset wallet provider. True self-custody software where the customer alone holds the keys is outside the category.

My payments product converts crypto to dollars. Is one licence enough? No. Payment processing is a CBK licence, and conversion of virtual assets to or from foreign currency needs the separate CBK authorisation under regulation 14 in addition.

Can one company hold licences from both regulators? Yes, the Regulations allow joint licensing and supervision, but the company must hold the paid-up capital of its highest-capital category plus fifty percent of the capital for each additional activity, and both files must be consistent.

What if my business model does not fit any category neatly? Take a perimeter opinion before filing and raise the classification with the regulator at the pre-application stage. Substance decides the category, and a misdirected application wastes time the 4 November 2026 transition deadline does not give back.

Peter Maina is an advocate of the High Court of Kenya and the founder of Peter Maina & Co Advocates, where he advises on capital markets, corporate and financial services law, including virtual asset licensing before the Central Bank of Kenya and the Capital Markets Authority. This article states the law as at 27 August 2026. It is general information, not legal advice. For advice on your specific circumstances, contact the firm on info@pmlaw.co.ke or +254 714 644 080.