The 4 November 2026 Deadline: A Transition Compliance Plan for Crypto Businesses Already Operating in Kenya

In brief

• Every business that was providing virtual asset services when the Virtual Asset Service Providers Act, 2025 (VASP Act Kenya) commenced on 4 November 2025 has until 4 November 2026 to comply with the Act. That is the effect of section 47, and the window is now measured in weeks, not months.
• Compliance in practice means holding a licence, and the regulator’s thirty-day determination clock only starts once your application is complete and due diligence is done. Working backwards, a business that has not filed by the end of September is gambling.
• Operating past the deadline without a licence is a criminal offence. The fallback options– pausing Kenyan operations, genuine geoblocking, or restructuring outside the regulated perimeter- each work only if executed properly, and each takes time you are running out of.

Most of what has been written about Kenya’s new virtual asset regime explains the law — including our own earlier breakdown of how crypto licensing works under the VASP Act. This article does something different. It is a working plan for the businesses that VASP Act Kenya is about to catch: the exchanges, wallet providers, OTC desks, payment processors and token platforms that were already serving this market when the Virtual Asset Service Providers Act, 2025 commenced, and that must now be inside the regulatory perimeter, or out of the market, by 4 November 2026. If that describes your business, the questions that matter are narrow. Do you qualify for the transition window at all? What does compliance actually require by the deadline? What happens if your application is still pending on the day, and what are your options if you cannot make it? I take each in turn, and then give you the timeline I would put in front of a board this week.

Where the VASP Act Kenya deadline comes from, and who it covers

The Act received presidential assent on 15 October 2025 and commenced on 4 November 2025. From that day, its central prohibition took effect: no person may carry on the business of virtual asset services in or from Kenya without a licence issued by the relevant regulatory authority. Applied literally on day one, this would have criminalised an entire existing industry overnight, so Parliament included a transitional provision. Section 47 provides that upon commencement, any person providing virtual asset services shall, within one year of the commencement, comply with the provisions of the Act. One year from 4 November 2025 is 4 November 2026.

Two points about the scope of that grace period deserve more attention than they have received. First, it belongs only to persons who were providing virtual asset services at commencement. A business launched in, say, February 2026 was never inside section 47; it required a licence before commencing and, if it is operating today without one, it is not in a transition period, it is in breach. If your business is in this position, the analysis in this article still applies to you, but with even less room, because you cannot rely on the grace period at all.

Second, the transition window attaches to the provision of virtual asset services as the Act and its Schedule define them: exchange services, wallet and custody services, brokerage, payment processing, token issuance and the other scheduled activities. Whether what you do falls within a scheduled activity is a question of substance, not branding. A software company that in substance matches buyers and sellers for a fee is an exchange; a Telegram OTC desk earning a spread is a broker. The classification exercise is the first task on the timeline below, because everything else depends on it.

The perimeter also reaches further than many offshore operators assume. Under regulation 4 of the Virtual Asset Service Providers Regulations, 2026, gazetted as Legal Notice No. 134 on 22 July 2026 and in force from that date, the regime applies to a person offering virtual asset services who targets Kenyan consumers or derives an economic benefit or income from Kenya, whether or not that person has any physical presence in the country. A platform incorporated abroad with a Kenyan user base and shilling on-ramps is inside the perimeter, and under VASP Act Kenya its transition clock is the same as everyone else’s.

What compliance with VASP Act Kenya means by 4 November

Section 47 says comply with the provisions of the Act, and the provision that bites is the licensing prohibition. The safe reading, and the one I advise clients to plan on, is that by 4 November 2026 an existing operator must either hold a licence or have ceased carrying on the regulated activity. Anything softer is a bet on regulatory forbearance that the statute does not promise.

Getting licensed is not a form-filling exercise. Only a company limited by shares, incorporated in Kenya or registered here as a foreign company, is eligible. The company needs a physical office in Kenya, a Kenyan bank account, and a board of at least three natural-person directors, at least one-third of them independent, with the chairperson and chief executive roles separated and the chief executive domiciled in Kenya. Every director, senior officer, significant shareholder and beneficial owner must clear a fit and proper assessment.

The application file itself must include a business plan in the prescribed form, proof of source of funds, evidence of the paid-up and liquid capital for your licence category, audited financial statements or an auditor-verified opening balance sheet, the full operational policy suite covering anti-money laundering, cybersecurity, data protection, complaints, market conduct and business continuity, and an independent information systems audit including a penetration test, with critical findings remediated and the remediation evidenced.

The capital is real money, ranging from KES 10 million for a broker or payment processor through KES 100 million for an exchange and KES 150 million for a wallet provider, to KES 300 million for a stablecoin issuer, with liquid capital requirements layered on top and a loading where one entity holds multiple permissions. If a capital raise or a shareholder injection is needed, that workstream has the longest lead time of anything in the file, and it starts now or not at all.

Then there is the clock. The regulator must determine a complete application within thirty days, but the thirty days run from receipt of all documents and completion of the regulator’s due diligence, and the regulator may call for interviews and further information along the way. In practical terms, the determination period is a floor, not a promise, and every requisition you answer slowly extends it. This is the single fact that should drive your filing date.

The reverse timeline

Counting back from 4 November, and allowing the regulator its thirty days plus a margin for due diligence and requisitions, the last responsible filing date is the end of September. That leaves the following programme for a business starting in earnest this week.

Week beginning	What must be done
1 September	Perimeter and regulator classification settled; licence category and any dual-licence need confirmed; gap analysis of capital, governance and policies against the Regulations completed; auditors and penetration testers engaged.
8 September	Board reconstituted to at least three natural-person directors with one-third independent; chief executive identified and domiciled in Kenya; fit and proper packs (directors, senior officers, significant shareholders, beneficial owners) assembled; source-of-funds evidence compiled.
15 September	Paid-up capital injected and liquid capital arrangements in place; Kenyan bank account and physical office evidenced; the policy suite (AML/CFT/CPF, cybersecurity, data protection, complaints, market conduct, business continuity) finalised, not drafted.
22 September	Independent information systems audit and penetration test completed and critical findings remediated with evidence; business plan in the prescribed form completed; audited financial statements or an auditor-verified opening balance sheet signed off.
29 September	Application filed with the CBK or the CMA (or both), complete on its face, with fees paid. This leaves the regulator the thirty-day determination period plus a buffer for due diligence, interviews and requisitions before 4 November.
October	Respond to requisitions within days, not weeks; notify any change in the application particulars within two days as the Regulations require; hold a board-approved contingency decision ready in case the licence has not issued by close of October.

If your business already has most of this in place, the timeline is a checklist. If it has little of it, the timeline is telling you something the board needs to hear now rather than in October: the honest choices may be narrowing to the fallback options discussed below.

Pending on deadline day

The scenario every operator should plan for is the uncomfortable middle one: the application was filed in good time, the regulator has not yet determined it, and 4 November arrives. Does a pending application protect you?

The honest answer is that the Act does not say so. Section 47 requires compliance within the year; it does not deem an applicant compliant. Neither regulator has published guidance stating that a timely, complete application suspends the prohibition, and until one of them does, a business operating past the deadline on the strength of a pending application is exposed as a matter of strict law, however sympathetic its position. There are respectable arguments the other way, that a person who has done everything within their power to comply, and whose application awaits only the regulator’s own process, should not be treated as an offender, and enforcement discretion will very likely be exercised with that in mind for good-faith applicants. But enforcement discretion is not a defence; it is a hope.

The prudent structure is a board minute, adopted before the deadline, resolving that if no licence has been issued by a set date, the company will suspend the regulated activity until grant, and an operational plan capable of executing that suspension cleanly: user notice, orderly withdrawal windows, and segregated customer assets ready to be returned or held static. A business that can show it stopped, rather than gambled, will be in a different conversation with its regulator, and with a prosecutor, than one that carried on.

What operating past the deadline costs, personally

Carrying on an unlicensed virtual asset business is an offence under section 8 of the Act, carrying on conviction a fine of up to KES 10 million or imprisonment for up to five years or both for an individual, and a fine of up to KES 25 million for a company. A number of early commentaries circulated lower figures drawn from the Bill; the enacted Act says twenty-five million for a company, and it is the enacted text that will be applied.

The corporate veil does not do the work directors sometimes assume it does. The Act provides that where an offence is committed, a director, partner or senior officer who knowingly authorised, permitted or aided in its commission also commits the offence and is liable to the same criminal, civil or administrative penalties. And where the operator is unlicensed, the individuals actually carrying on the business are themselves within the section 8 prohibition, which speaks of any person. A chief executive who lets the platform run through November on the theory that the company will absorb any consequence has misread the statute. This is the paragraph to put in front of any board still treating the deadline as soft.

Three fallback options under VASP Act Kenya, and what each actually requires

Pausing Kenyan operations

The cleanest option, and the one the contingency board minute above should default to. Suspension means ceasing the regulated activity, not merely pausing marketing: no new customers, no new transactions in the regulated service, customer assets safeguarded and returnable, and a public notice that is candid about the reason. A suspension executed this way preserves the licence application, the customer relationships and the brand. It costs revenue for the weeks until grant, and that cost is the price of the market having left compliance late.

Geoblocking, done honestly

For an offshore platform, exiting the Kenyan perimeter is possible but demanding, because regulation 4 turns on targeting Kenyan consumers and deriving economic benefit or income from Kenya. An IP block alone does not end either. Genuine exit means closing shilling deposit and withdrawal rails, ending mobile money integrations, offboarding Kenyan-resident customers identified through KYC rather than IP address, ceasing Kenya-directed marketing, affiliates and agents, and stopping revenue attributable to Kenyan users. Half-measures leave the platform inside the perimeter with the aggravating feature of having pretended to leave. Foreign platforms should also weigh the other side of the ledger: Kenya is one of Africa’s largest virtual asset markets, and the licence that is a burden this quarter is a moat next year.

Restructuring outside the perimeter

Some businesses can genuinely re-engineer the service so that no scheduled activity is being carried on: moving from custodial to true self-custody software where the customer alone holds the keys, withdrawing from fiat conversion, or confining the offering to activities the Act excludes, such as closed-loop tokens that cannot be traded or cashed out. This is the most technically interesting option and the most dangerous to do casually, because the regulators will look at substance. A “non-custodial” wallet that retains key-recovery control, or a “software provider” whose fee is a spread on matched trades, has not left the perimeter. Restructuring is a design exercise done with counsel against the Schedule and the Regulations, documented at each step, and it should be validated before the deadline, not defended after it.

What happens next

Between now and November, expect the regulators to publish application forms, guidance and, in due course, their registers of licensees, and expect the first public enforcement signals shortly after the window closes, because a deadline announced a year in advance and then unenforced would undermine the regime from its first quarter. Licences under the regime are annual and expire on 31 December of the year of issue regardless of the grant date, with renewal applications due at least two months before expiry, so even a business licensed in October should diarise renewal immediately. I will analyse the first grants, the first refusals and any transitional guidance as they land.

Frequently asked questions about the VASP Act Kenya deadline

Does filing my application before 4 November 2026 make me compliant? No, not on the face of the Act. Section 47 requires compliance within the year, and the operative requirement is a licence. A timely application is powerful mitigation and may attract enforcement forbearance, but it is not a statutory defence. Plan on being licensed or suspended by the deadline.

My business launched after 4 November 2025. Do I get the transition window? No. The window covers persons who were providing virtual asset services at commencement. A post-commencement business needed a licence before starting, and if it is operating without one it should seek advice immediately.

We are incorporated abroad with Kenyan users. Does the deadline apply to us? Almost certainly. The Regulations apply to anyone targeting Kenyan consumers or deriving economic benefit or income from Kenya, with or without local presence. Your options are to license through a Kenyan company or a registered foreign company, or to exit the perimeter genuinely in the manner described above.

How long does the regulator take to decide? Thirty days from receiving a complete application and completing its due diligence. The preparation of the file, capital, audits, policies, and fit and proper packs is the long pole, and requisitions extend the effective timeline. File by the end of September.

What do directors personally risk if the business operates unlicensed after the deadline? An offence punishable by a fine of up to KES 10 million or up to five years’ imprisonment or both, alongside the company’s exposure of up to KES 25 million, where they knowingly authorised or permitted the contravention.

Peter Maina is an advocate of the High Court of Kenya and the founder of Peter Maina & Co Advocates, where he advises on capital markets, corporate and financial services law, including virtual asset licensing under VASP Act Kenya before the Central Bank of Kenya and the Capital Markets Authority. This article states the law as at August 2026. It is general information, not legal advice. For advice on your specific circumstances, contact the firm on info@pmlaw.co.ke or +254 714 644 080.