KENYA Law and Practice Contributed by: Keega Gakuua, Faith Njeri Njaggah and Alphonse Odido, Keega & Company Advocates
compels VASPs to disclose user data to the KRA), and financial stability concerns.
Enforcement: After this date, operating without a licence constitutes a criminal offence. Penalties include fines of up to KES10 million or imprisonment for up to five years for individuals, and fines of up to KES25 million for companies. Territorial Limits There are no territorial limits on the requirement to obtain a licence. The Act explicitly applies to any per- son offering virtual asset services “in or from Kenya”, and the test for whether a person is operating in or from Kenya is functional and economic, not physical. A person is deemed to be operating “in or from Ken- ya” where that person derives an economic benefit or income from Kenya, regardless of physical presence and regardless of the jurisdiction of incorporation. Transitional Period The licensing requirements under the VASP Act, 2025 are indeed new, having come into force on 4 Novem- ber 2025. However, the Act includes a one-year tran- sitional period for existing virtual asset service provid- ers. The transition period runs for one year from the Act’s commencement date. It began on 4 November 2025 and will expire on 4 November 2026. 3.2 Set-Up Requirements The Licensing Process Step 1: Determine your regulator (dual-regulator model) The CBK regulates stablecoin issuers, virtual asset payment processors, and virtual asset wallet provid- ers (custodial/payments-focused). The CMA regulates virtual asset exchanges, brokers, investment advisers, managers, ICO/token offering providers, and tokenisation platforms. Step 2: Pre-application preparation (estimated three–12 months) Gap analysis: The business must be assessed against the specific capital and governance requirements for its category. Documentation: Over 19 mandatory documents must be compiled, including business plans, AML/CFT poli- cies, cybersecurity audits, and white papers (for token issuers).
3. Licensing and Set-Up Requirements 3.1 Licensing Requirements The primary trigger is the condition that one must obtain a licence to be able to provide virtual asset services in or from Kenya unless licensed. This prohi- bition applies regardless of where a business is incor- porated. A foreign entity offering crypto-asset services to Kenyan users (even from a server in another coun- try) is deemed to be operating “in or from Kenya” and must therefore hold a licence. Specific Activities That Trigger Licensing The law defines the specific “virtual asset services” that require a licence. These are listed in the First Schedule of the Act. A licence is triggered if a com- pany limited by shares (incorporated locally) engages in, or facilitates, any of the following on behalf of third parties – virtual asset exchanges; custodial wallet services; virtual payment processing; stablecoin issu- ance; virtual asset brokers, advisers and managers; as well as various tokenisation platforms. Impact on Legal and Corporate Structures Natural persons (individuals) are prohibited An individual cannot obtain a VASP licence. The law explicitly prohibits natural persons from offering vir- tual asset services. Only a company limited by shares (incorporated locally) may apply. Substance requirements: Merely incorporating is insufficient. To maintain a licence, an entity must demonstrate substantial local presence, including a physical office in Kenya and a board of at least three directors who are natural persons. Compliance timelines Transitional period: Existing VASPs were granted a one-year transitional period beginning 4 November 2025. Deadline: This period expires on 4 November 2026.
386 CHAMBERS.COM
Powered by FlippingBook