KENYA Law and Practice Contributed by: Keega Gakuua, Faith Njeri Njaggah and Alphonse Odido, Keega & Company Advocates
ment. These rules apply to all licensed entities operat- ing in or from Kenya and are designed to mirror the standards found in traditional financial markets. Differences Between VASP and Traditional Frameworks The most significant distinction is that virtual asset issuers are not subject to a continuous disclosure obligation. Under the Capital Markets Act, a publicly listed company must immediately disclose any inside information to the market. The VASP framework cur- rently lacks this duty, meaning the flow of information is less regulated, and the definition of what constitutes material, non-public information is entirely untested for virtual assets. Until case law develops, this dif- ference will create uncertainty for those trading on information related to tokenised projects, as there is no statutory trigger for when such information must be publicly released. Kenya’s regulatory stance on virtual assets has evolved through a series of key enforcement actions. The CBK issued its first warning in December 2015 via Banking Circular No 14 of 2015, cautioning financial institutions against engaging in or facilitating virtual currency transactions and warning the public that “Bitcoin and similar products are not legal tender”. This was followed in 2019 by the Wiseman Talent Ventures ( KeniCoin ) case, where the CMA issued a public caution against the ICO. The High Court upheld the CMA’s jurisdiction, applying the US Howey test to determine that the tokens constituted securities, ruling that “the absence of a specific regulatory frame- work for cryptocurrencies did not oust the jurisdiction of the general regime of law” and that the CMA could proceed with investigations to protect the public. In the Worldcoin case, the company’s collection of biometric data in Kenya was found to be unlawful. The court found that Worldcoin failed to conduct a manda- tory DPIA, collected consent that was not “free and informed” because it was induced by cryptocurrency payments, and transferred sensitive data outside Ken- ya without adequate safeguards. The court ordered the permanent deletion of all the biometric data col- 2.6 Non-Compliance Key Enforcement Actions
lected from Kenyans, with the Office of the Data Pro- tection Commissioner confirming in November 2025 that it had supervised the deletion in Germany. Most recently, in May 2026, Kenyan authorities arrested a Binance P2P trader linked to fraud. The court approved a seven-day detention for investi- gation, while Binance complied with the National Police Service’s request to restrict access to several P2P accounts in Kenya. These co-ordinated actions demonstrate that regulators and law enforcement are aggressively pursuing crypto-related fraud using existing legal frameworks even before the new VASP licensing regime is fully operational. Cross-border breaches Kenyan regulators have taken an aggressive approach to cross-border breaches by asserting extraterritorial jurisdiction under the VASP Act, 2025, which deems any person deriving “economic benefit or income from Kenya” to be operating “in or from Kenya” regardless of physical presence. In practice, Kenya has demonstrated its willingness to enforce these provisions. Authorities arrested a Binance P2P trader linked to a KES58 million invest- ment scam, and Binance complied with a National Police Service request to restrict several P2P accounts in Kenya. The High Court ordered Worldcoin to delete all biometric data collected from Kenyans, applying local data protection law to a global project. Addi- tionally, the “agent arrangements” clause in the draft regulations forces foreign interfaces to either obtain their own licence or operate under a licensed local VASP that assumes full consumer liability. Future Enforcement The attitude of Kenyan regulators will likely harden further over the next 12 months. The Regulations are expected to be finalised in the coming weeks. A key driver is Kenya’s urgent target to exit the FATF grey list, which demands demonstrable enforcement against unlicensed crypto-activities and full alignment with Recommendation 15 on VASP supervision. This enforcement trajectory is reinforced by domestic pressures: consumer protection (following high-profile scams), tax revenue capture (the Finance Bill 2026
385 CHAMBERS.COM
Powered by FlippingBook