KENYA Law and Practice Contributed by: Keega Gakuua, Faith Njeri Njaggah and Alphonse Odido, Keega & Company Advocates
tain exemptions. However, the CMA has historically been reluctant to onboard virtual asset providers, citing jurisdictional uncertainty and the absence of a bespoke crypto-framework. The CMA’s cautious stance is informed by the Wiseman Talent Ventures case, where the High Court applied the US Howey test to determine that the “KeniCoin” initial coin offering (ICO) constituted a security, establishing that tokenised investment schemes fall within the CMA’s securities mandate. The breakthrough came in early 2026 when the CMA admitted AlphaBloq Technolo- gies Limited into the sandbox to test its blockchain- based real estate tokenisation platform, followed by OwnMali (Infiniti n Beyond Limited) in February 2026. Real estate tokenisation satisfies the Howey test involving investment in a common enterprise with profits expected from the efforts of others, and thus clearly falls within the CMA’s securities jurisdiction. To date, AlphaBloq and OwnMali are the only virtual asset-related projects admitted into the CMA’s sand- box, and both involve fractionalised real estate invest- ing rather than general-purpose crypto-exchanges or decentralised finance protocols. The CMA has refused to onboard pure crypto-exchanges, and must await the full implementation of the VASP licensing regime, expected by mid-2026. 1.1.3 Regulation of Blockchain Technology Attitude of Government and Regulators The attitude of the Kenyan government and regulators towards blockchain-based industries has shifted deci- sively from caution to active regulation. The enact- ment of the Virtual Asset Service Providers (VASP) Act, 2025, and the subsequent draft VASP Regula- tions, 2026, form the cornerstone of this strategy. The primary catalyst for this regulatory shift is the urgent need to address the risks that prompted the Financial Action Task Force (FATF) to place Kenya on its grey list in February 2024, as well as Kenya’s inclusion in the EU’s list of high-risk third countries. The government’s principal focus has been to close the “crypto gap” in its national anti-money launder- ing and counter-terrorism financing controls. While the government is curbing unlicensed activity, it is simultaneously encouraging specific, regulated use cases, particularly those falling under the oversight of
the CMA and the CBK. For the time being, however, lending and decentralised finance do not appear to be contemplated by this regime. Regulation of Blockchain (Without Crypto-Assets) The use of blockchain technology without crypto- assets is not specifically prohibited in Kenya, but is governed by existing laws depending on the use case and sector. The Data Protection Act, 2019 applies whenever personal data is processed on a blockchain, as reinforced by the Worldcoin case (May 2025), where the High Court ordered the deletion of unlawfully col- lected biometric data for failing to conduct a manda- tory Data Protection Impact Assessment (DPIA) and to obtain consent through inducement. The Computer Misuse and Cybercrimes Act criminalises unauthor- ised access, identity theft, and cyber-harassment, all of which could be relevant to certain blockchain appli- cations. For regulated firms using blockchain for inter- nal processes or outsourcing, this does not change their ultimate regulatory responsibilities; they remain liable for compliance with licensing, consumer protec- tion, and data security requirements, and must ensure their technology partners meet these same standards. Data Privacy in Relation to Blockchain-Based Products At a high level, Kenya’s Data Protection Act, 2019 (DPA) applies directly to blockchain-based products, creating a fundamental conflict between the statuto- ry right to rectification and erasure and blockchain’s inherent immutability. The landmark Worldcoin case decisively addressed this tension: the High Court held that Worldcoin’s collection of biometric data in exchange for cryptocurrency violated the DPA because the company failed to conduct a mandatory Data Protection Impact Assessment and consent was induced by the crypto-reward, rendering it not freely given. The court ordered the permanent deletion of all unlawfully collected data, supervised by the Office of the Data Protection Commissioner. This ruling establishes three critical compliance points: consent is invalid if induced by crypto-rewards; any high-risk processing (including biometric data or pub- lic ledgers) requires a DPIA; and cross-border data transfers require strict safeguards.
379 CHAMBERS.COM
Powered by FlippingBook