Do You Need a Crypto Licence in Kenya? A Guide to the New Virtual Asset Rules

In brief

• Crypto is now a licensed, regulated business in Kenya. The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025, and the detailed Regulations were gazetted on 22 July 2026 as Legal Notice No. 134.
• Anyone running an exchange, wallet service, crypto payment business, brokerage, token sale, tokenisation platform or stablecoin project in or from Kenya needs a VASP licence. This includes offshore platforms targeting Kenyan customers.
• Businesses already operating when the Act commenced have until 4 November 2026 to comply. Operating without a licence after the deadline is a criminal offence carrying fines of up to KES 10 million for individuals, KES 25 million for companies, and up to five years in prison.

A crypto licence Kenya businesses once operated without now sits at the centre of the law. For years, the official position on cryptocurrency in Kenya was a warning. The Central Bank cautioned the public, banks closed accounts linked to crypto trading, and the businesses serving one of Africa’s most active crypto markets operated in a legal grey zone. That era is over, and it arrived quickly. Parliament passed the Virtual Asset Service Providers Act (No. 20 of 2025) in October 2025; it commenced on 4 November 2025, and the Cabinet Secretary for the National Treasury published the operating rules, the Virtual Asset Service Providers Regulations, 2026, in July 2026.

This guide explains who needs a crypto licence Kenya regulators now require, which of the two regulators to approach, what it costs, and what the law expects of anyone dealing in virtual assets in Kenya. It is written for founders, operators and investors, not for other lawyers, so I have kept the language plain and put the section numbers in where they matter.

On this page

• What counts as a virtual asset
• Two regulators share the field
• Crypto Licence Kenya: Who Actually Needs One
• What a licence costs
• What the application involves
• Life as a licensee
• The deadline every existing operator should circle
• What happens next
• Frequently asked questions

What counts as a virtual asset

The Act defines a virtual asset as a digital representation of value which is capable of being digitally traded or transferred and used for payment or investment purposes. Bitcoin, Ether, stablecoins and most tradable tokens fall squarely within this definition.

Some things are expressly outside the net under section 4 of the Act. Loyalty points and tokens locked inside a closed ecosystem are excluded, provided they cannot be transferred, traded or cashed out. Central bank digital currencies are excluded. So are non-fungible tokens which are genuinely collectibles rather than instruments of payment or investment. The Act looks at what a token does in substance, not what its issuer calls it, so labelling a payment token an “NFT” or a “utility token” will not take it outside the regime if people use it to invest or pay.

Two regulators share the field: CBK vs CMA crypto licence

Kenya chose a dual regulator model, and knowing which door to knock on is the first practical question for any applicant.

The Central Bank of Kenya licenses the activities closest to money and custody. These are virtual asset wallet providers, meaning businesses holding customers’ private keys, virtual asset payment processors, and stablecoin issuers. This is the core of what falls under CBK virtual assets supervision. The CBK also separately authorises the conversion of virtual assets to and from foreign currency under regulation 14.

The Capital Markets Authority licenses the activities closest to investment. A CMA crypto licence covers virtual asset exchanges and trading platforms, brokers, investment advisors, virtual asset managers, initial coin offering providers, tokenisation of real-world assets, and token issuance platforms.

The two regulators sit together with the Treasury, the Financial Reporting Centre, the ODPC, the KRA and other agencies on a Virtual Assets Services Coordination Forum created by the Regulations, which meets at least quarterly to keep the two halves of the regime aligned. A business whose model spans both sides, for example, an exchange which also holds customer keys, should expect to deal with both regulators, and the Regulations allow them to license and supervise jointly.

Crypto Licence Kenya: Who Actually Needs One

The honest way to answer whether you need a crypto licence Kenya law now requires is to apply the First Schedule of the Act to real business models, because this is where most of the confusion sits.

A crypto exchange or trading platform

Licensed by the CMA. This covers any digital platform facilitating the exchange of virtual assets for shillings, foreign currency or other virtual assets on behalf of third parties for a fee.

An OTC desk or peer-to-peer dealer

If you facilitate exchanges for clients and earn a margin or commission, you are operating a brokerage or exchange in substance and need a CMA licence. The days of informal Telegram and WhatsApp desks serving Kenyan clients without a licence are numbered.

A wallet or custody service

If your business holds or manages the private keys to customers’ assets, you are a virtual asset wallet provider and need a CBK licence. Genuine self-custody software, where the customer alone holds the keys, involves no third-party custodian and sits outside this category.

A crypto remittance or payments business

Arranging transactions between virtual assets and fiat currency makes you a virtual asset payment processor, licensed by the CBK. A business using stablecoins to move remittances into Kenya falls here, and if it also converts crypto to foreign currency, it needs the separate CBK conversion authorisation as well.

A stablecoin issuer

This is the most heavily regulated category of all. Kenya’s stablecoin regulation requires a CBK licence, KES 300 million in paid-up capital, a published white paper, fully maintained reserve assets held with proper custody, and a standing obligation to redeem at par. The Regulations prohibit paying interest to stablecoin holders.

A tokenised real estate or asset platform

Converting land, buildings or other real-world assets into tradable digital tokens is virtual asset tokenisation (tokenization), licensed by the CMA, and the offer itself needs CMA approval supported by a compliant white paper. Platforms hosting the issuance and secondary trading of such tokens need the separate token issuance platform licence.

A token sale or ICO

Only a licensed company is eligible to issue a virtual asset offering. Section 34 of the Act bars natural persons from promoting or issuing token offerings in or from Kenya entirely, and every offering needs the regulator’s prior written no objection.

Advisors and fund managers

Charging fees for investment advice on virtual assets makes you a virtual assets investment advisor. Managing portfolios containing virtual assets on a discretionary mandate makes you a virtual asset manager. Both are CMA licences.

One more point deserves emphasis. Under regulation 4, a person operates “in or from Kenya” where they actively solicit or target Kenyan consumers, or derive economic benefit or income from Kenya, regardless of physical presence. An offshore exchange marketing to Kenyans is inside the perimeter. Foreign platforms serving this market need Kenyan advice now, not after the first enforcement letter.

What a licence costs

The fees sit in the First Schedule to the Regulations and the minimum capital in the Fifth Schedule. The figures below are the headline numbers every business plan needs when pricing out a crypto licence Kenya application from scratch.

Licence category	Regulator	Application fee (KES)	Licence fee (KES)	Minimum paid up capital (KES)
Wallet provider	CBK	100,000	500,000	150 million
Exchange	CMA	100,000	1,000,000	100 million
Payment processor	CBK	100,000	200,000	10 million
Broker	CMA	100,000	100,000	10 million
Investment advisor	CMA	10,000	50,000	Nil
Virtual asset manager	CMA	50,000	200,000	20 million
ICO provider	CMA	100,000	500,000	20 million
Tokenisation provider	CMA	100,000	500,000	10 million
Token issuance platform	CMA	100,000	500,000	20 million
Stablecoin issuer	CBK	100,000	2,000,000	300 million

Each category also carries a liquid capital requirement. An exchange, for instance, must hold liquid capital of KES 20 million or 8 percent of total liabilities, whichever is higher, and a wallet provider must hold KES 30 million or 100 percent of thirty days’ current liabilities.

Licences are annual, and every licence expires on 31 December of the year it is issued, whatever the issue date. Renewal applications must be lodged at least two months before expiry, and renewal fees for the larger categories are turnover-based. An exchange pays the higher of KES 500,000 or 0.5 percent of the previous year’s gross revenue. Token offerings attract a further approval fee of 0.25 percent of the value of the successful offer, with a floor of KES 200,000 and a ceiling of KES 30 million.

What the application involves

Applications go to the Central Bank of Kenya or the Capital Markets Authority depending on activity. Only a company limited by shares, incorporated in Kenya or registered here as a foreign company, is eligible to apply. Sole proprietorships and partnerships are not. The company needs a physical office in Kenya, a Kenyan bank account, and a board of at least three directors, all natural persons, with no director sitting on more than two VASP boards. The chief executive requires the regulator’s approval, and every director, senior officer, and significant shareholder must pass a fit and proper assessment covering probity, competence, financial soundness and track record.

The application file itself, set out in regulation 6, is substantial. It includes a business plan following the Third Schedule, three years of audited financial statements or an auditor verified opening balance sheet for a new company, proof of source of funds, evidence of the required capital, a full suite of operational policies covering AML, data protection, cybersecurity, complaints, market conduct and business continuity, an independent information systems audit including a penetration test, and disclosure of any cross border operations and foreign regulatory status. The regulator interviews applicants where it needs more, and it must determine a complete application within thirty days of receiving all documents and completing due diligence.

Two timing rules catch people out. A licensed business must commence operations within twelve months of grant, and any change to the facts in a pending application must be notified within two days.

Life as a licensee

A licence is the start of the compliance relationship, not the end. Licensees must segregate client assets from their own, hold sufficient assets of each type to meet customer obligations, and keep client assets beyond the reach of the licensee’s own creditors. Mixers, tumblers and anonymity-enhancing services are banned outright under section 21. Every licensee becomes a reporting institution under the Proceeds of Crime and Anti-Money Laundering Act, with the full weight of customer due diligence, transaction monitoring and suspicious transaction reporting this status carries. Transaction records, including wallet addresses and chain identifiers, must be kept for at least seven years.

The Regulations also import serious market conduct rules into the crypto space for the first time. Insider dealing, market manipulation, false trading, front running, churning and cold calling are now offences, punishable by fines of up to KES 5 million or five years’ imprisonment for individuals. Advertising is regulated in detail, down to the prominence of risk warnings on websites, and every advertisement needs records kept for seven years.

The cost of ignoring all this is real. Carrying on a virtual asset business without a licence is an offence under section 8, with fines of up to KES 10 million or five years’ imprisonment for an individual and up to KES 25 million for a company. Directors and senior officers who knowingly permit an offence are personally liable alongside the company under section 41.

The deadline every existing operator should circle

Section 47 of the Act gives anyone already providing virtual asset services at commencement one year to comply. The Act commenced on 4 November 2025. The window closes on 4 November 2026.

That is less than three months away. Securing a crypto licence Kenya operators can rely on takes a fully assembled file, with a penetration test, audited financials, board recruitment, capital injection and a full policy suite, and that is not put together in a fortnight. Operators who intend to keep serving this market lawfully should be preparing their files now, and can reach our financial services practice for support.

What happens next

The regulators are expected to publish application forms, guidance and their public registers of licensees, and the CMA’s consultation practice suggests further guidance notes will follow. The first licences under the new regime, and the first enforcement actions against those who ignore it, will define how strictly the perimeter is policed. I will analyse each significant development as it lands.

Frequently asked questions

Is cryptocurrency legal in Kenya?

Yes. Buying, holding and trading virtual assets is lawful, and the businesses providing those services are now licensed and supervised under the Virtual Asset Service Providers Act, 2025 and the 2026 Regulations.

Does an individual trading crypto for themselves need a licence?

No. The licensing regime targets businesses providing virtual asset services to others. Personal trading on your own account is not a licensable activity, though profits attract tax.

My platform is registered abroad but has Kenyan users. Am I caught?

Almost certainly. The Regulations apply to anyone soliciting or targeting Kenyan consumers or deriving income from Kenya, with or without a local presence. Foreign platforms serving Kenya need to register a local company and obtain a crypto licence Kenya-style, the same as a domestic operator.

Which regulator do I apply to for a VASP licence in Kenya?

The Central Bank of Kenya for wallets and custody, payment processing, stablecoin issuance and fiat conversion. The Capital Markets Authority for exchanges, brokerage, advisory, asset management, token offerings and tokenisation (tokenization).

How long does licensing take?

The regulator must decide within thirty days of receiving a complete application and finishing its due diligence. In practice, the preparation of the application file is the long pole, and applicants should budget several months end-to-end.

What happens if I keep operating without a licence after November 2026?

You commit an offence carrying a fine of up to KES 10 million or five years’ imprisonment for individuals, and a fine of up to KES 25 million for a company. Directors who knowingly allow it are personally on the hook.

Peter Maina is an advocate of the High Court of Kenya and the founder of Peter Maina & Co Advocates, where he advises on capital markets, corporate and financial services law. This article states the law as at 31 July 2026. It is general information, not legal advice. For advice on your specific circumstances, contact the firm.