On 15th October 2025, President William Ruto officially assented to the Virtual Asset Service Providers Act, 2025, marking a turning point in Kenya’s financial and digital innovation landscape. For the first time, virtual assets such as cryptocurrencies, tokens, and blockchain-based services now have a formal legal framework that governs how they can be issued, traded, and managed in the country.
This Act places Kenya among the few African nations with a clear, comprehensive regime for regulating virtual asset activities. It moves the sector from a previously grey area into a well-defined legal structure that prioritizes transparency, investor protection, and market integrity.
A Framework for Legitimacy and Accountability
At its core, the new law establishes a legal foundation for entities operating in Kenya’s virtual asset ecosystem. It defines who qualifies as a Virtual Asset Service Provider (VASP) and sets out licensing and compliance obligations for those offering services such as exchanges, custodial wallets, tokenization platforms, and virtual asset investment advisory.
The Capital Markets Authority (CMA) and the Central Bank of Kenya (CBK) emerge as the primary regulators, jointly responsible for licensing, supervision, and enforcement. This dual oversight framework ensures that the fast-moving digital asset industry aligns with both financial stability and innovation imperatives.
The law also explicitly excludes closed-loop digital systems, non-fungible tokens (NFTs) not used for investment purposes, and central bank digital currencies (CBDCs). This distinction protects innovation within private ecosystems while maintaining the regulatory perimeter over activities with financial implications.
Licensing: From Informal Operations to Structured Oversight
One of the most consequential aspects of the Act is its mandatory licensing requirement. No entity may carry on virtual asset business in or from Kenya without authorization from the relevant regulator. Importantly, natural persons are prohibited from operating such businesses. Only incorporated local or foreign companies with a compliance certificate under the Companies Act may apply.
To secure a licence, applicants must satisfy rigorous standards of governance, financial integrity, and technological resilience. The regulators will assess the fitness and propriety of directors and shareholders, review the applicant’s cybersecurity systems, and ensure compliance with consumer protection, data protection, and capital adequacy requirements.
Each licence must be displayed at the business’s principal office, indicating approved activities and conditions. Licences expire annually on 31st December, compelling virtual asset providers to maintain continuous compliance to renew. Operating without a licence attracts penalties of up to KSh 10 million or ten years’ imprisonment, underscoring the seriousness of regulatory adherence.
Compliance at the Core of the New Regime
Beyond licensing, the Act embeds a strong compliance culture into Kenya’s digital finance ecosystem. Virtual asset service providers must maintain a registered office in Kenya and operate under a board of at least two natural-person directors. They are required to conduct their business “in a prudent and honest manner,” supported by adequate insurance cover, strong internal controls, and sound accounting records.
The law imposes specific obligations on risk management, cybersecurity, and data handling. Providers must maintain accurate records of all client and institutional transactions for at least seven years and grant regulators real-time, read-only access to those records upon request.
Marketing and promotional materials must be fair, clear, and not misleading. Each provider must establish systems for whistleblowing, customer complaints, and business continuity. In short, compliance is not a box-ticking exercise but a continuous governance expectation.
Zero Tolerance for Financial Crime
Part V of the Act is particularly significant from a compliance perspective. It integrates directly with the Proceeds of Crime and Anti-Money Laundering Act and the Prevention of Terrorism Act, empowering regulators to vet beneficial owners, conduct inspections, and enforce anti-money laundering (AML), countering the financing of terrorism (CFT), and countering proliferation financing (CPF) measures.
Directors, officers, and agents of VASPs are personally liable for violations. The law makes it clear that accountability extends to individuals who knowingly allow or ignore breaches. Administrative and criminal penalties can include heavy fines, imprisonment, or revocation of a company’s licence.
Supervision and Enforcement
Regulators now have sweeping investigative powers, including the ability to demand information, access records, and inspect premises. Under Section 40, they can issue written warnings, impose remedial directives, suspend or revoke licences, or order the removal of senior management.
Administrative penalties range from KSh 150,000 to KSh 3 million per day for ongoing contraventions, depending on the severity. In deciding enforcement action, regulators will consider the gravity of the offence, its market impact, and the conduct of the licensee during investigations. This approach aligns Kenya with global best practices under the Financial Action Task Force (FATF) standards.
The Six-Month Transition Window
Existing players in the crypto and blockchain sector have been granted a six-month grace period to apply for licensing. During this period, they may continue to operate, but failure to secure approval within the window will render their operations illegal. This transitional clause signals the government’s willingness to accommodate innovation while enforcing formal compliance boundaries.
Kenya’s Digital Finance Future
The Virtual Asset Service Providers Act, 2025 marks a new chapter for Kenya’s financial system. It provides long-awaited clarity for innovators, investors, and consumers. By embedding compliance, prudence, and accountability into the DNA of digital finance, the Act seeks to transform Kenya into a regional hub for regulated digital asset activity.
For virtual asset firms, compliance is now the cost of legitimacy, and the foundation of long-term sustainability. Kenya has drawn a firm line: the country is open to innovation, but not at the expense of legal order or public trust.
How We Can Help You
At Valarie N. Waswa & Company Advocates, we advise clients navigating Kenya’s rapidly evolving fintech and digital asset landscape. Our team provides end-to-end legal support on virtual asset licensing, compliance audits, policy structuring, and regulatory engagement with the Capital Markets Authority and the Central Bank of Kenya. Whether you are launching a crypto exchange, managing tokenized assets, or integrating blockchain into your financial products, we help you remain fully compliant while achieving your business objectives.
About the Author
Valarie Waswa is a tech law expert, an Advocate of the High Court of Kenya and East Africa by extension, and the Founding Partner of Valarie Waswa & Co. Advocates
Contact Us
For more information, contact us on WhatsApp Business at +254 707 059 485 or email us at info@valariewaswa.com