Virtual Asset Service Provider Licensing in Kenya

The first question is always the perimeter, whether what you do is a regulated virtual asset service at all, and if so which regulator licenses it, because the answer decides your capital, your file and your supervisor, and because the regulators read the substance of a product rather than its branding. We give that answer in a written perimeter opinion before anything is filed. We then build the application, the corporate structure and board the regulations require, the fit and proper packs for directors, officers and beneficial owners, the policy suite from anti-money laundering to cybersecurity and business continuity, and the evidence of capital, systems audit and penetration testing the file must carry, and we manage the application before the CBK, the CMA or both, including the joint licensing the regulations allow for businesses that span the perimeter. For businesses that cannot be licensed in time, we advise on the lawful alternatives, orderly suspension, genuine exit from the Kenyan perimeter, or restructuring the service outside it.

A business that was providing virtual asset services when the Act commenced has until 4 November 2026 to comply, and a business that started after commencement never had a grace period at all. The regulator’s determination clock only runs on a complete application after due diligence, so the true deadline is the filing date, not the statutory one. Our week-by-week transition plan is linked below, and if you are reading this close to the deadline the first conversation should happen this week.

A candid account of how the product works in practice, the customer journey, the movement of money and assets, who holds keys and where revenue arises, together with your corporate and ownership particulars. Perimeter analysis done on the real product is what keeps an application out of trouble.