Kenya now licenses and supervises VASPs. Businesses that plan to serve Kenyan customers must choose the right licence category, regulator and capital plan before they apply. This guide shows how, step by step.
It covers the regulators, the eight licensing steps, capital and fees, timelines, and the duties that apply after you get a licence. The framework is new. Confirm current requirements with the regulator before you submit an application.
| Event | Date |
| Virtual Asset Service Providers Act, 2025 commenced | 4 November 2025 |
| Virtual Asset Service Providers Regulations, 2026 made | 3 July 2026 |
| Regulations gazetted (Legal Notice No. 134 of 2026) | 22 July 2026 |
| Deadline for existing operators | 4 November 2026 (section 47 of the Act) |
Kenya has moved from policy development to a formal statutory framework. The Act sets the legal basis to license, regulate and supervise VASPs that operate in or from Kenya. The Regulations add detail on licensing, financial resources, technology, cybersecurity, client-asset safeguarding and reporting. Together, they address money laundering, terrorism financing, proliferation financing, consumer harm, cyber risk and weak governance.
Kenya has two licensing regulators. The CBK supervises custodial wallet providers, payment processors and stablecoin issuers. The CMA supervises exchanges, brokers, investment advisers, managers, ICO providers, and tokenisation and token-issuance platforms. The regulator follows the service, not the company label.
| Regulator | VASP category | Minimum paid-up capital |
| CBK | Wallet provider | KSh 150 million |
| CBK | Payment processor | KSh 10 million |
| CBK | Stablecoin issuer | KSh 300 million |
| CMA | Exchange | KSh 100 million |
| CMA | Broker | KSh 10 million |
| CMA | Virtual asset manager | KSh 20 million |
| CMA | Investment adviser | Nil |
ICO providers, tokenisation providers and token-issuance platforms have their own minimums in the Fifth Schedule to the Regulations.
Define exactly what the business will provide. It may operate an exchange, offer custodial wallets, process virtual asset payments, broker transactions, manage virtual assets, give investment advice, issue tokens, or run another activity listed in the First Schedule to the Act. Then confirm whether the CBK or the CMA regulates that activity.
A company limited by shares and registered under the Companies Act can apply for a VASP licence. A foreign company limited by shares can also apply if it is registered under the Companies Act. Every VASP must keep a physical office in Kenya where it carries out its business.
Prepare information on directors, senior officers, significant shareholders and beneficial owners. The Regulations also require disclosure of cross-border operations, affiliates and regulatory status in other jurisdictions.
Incorporation alone is not enough. Applicants must show that their governance, finances, controls and systems are ready for a regulated business.
The application must include:
The Regulations also require written policies on risk management, AML/CFT/CPF, data protection and privacy, cybersecurity and IT, complaints, market conduct, consumer protection, conflicts of interest, and business continuity and disaster recovery. The board needs at least three directors, with one-third independent. The chief executive officer must be approved by the regulator and live in Kenya, and the chairperson cannot also be the chief executive. A licensee must also open and operate a bank account in Kenya.
Required capital depends on the activity. Under the Fifth Schedule, minimum paid-up capital runs from nil for an investment adviser to KSh 300 million for a stablecoin issuer. A wallet provider needs KSh 150 million. An exchange needs KSh 100 million.
Applicants must also meet liquid-capital rules and keep them after licensing. An exchange must hold liquid capital of KSh 20 million or 8% of total liabilities, whichever is higher. A wallet provider must hold KSh 30 million or 100% of current liabilities for at least 30 days, whichever is higher.
A business that holds more than one licence must maintain the capital for its highest-capital category plus 50% of the paid-up capital for each additional activity.
VASPs fall within Kenya’s financial-crime framework and must operate as reporting institutions. Applicants need:
The framework also covers countering proliferation financing.
The Regulations address the Travel Rule or set a threshold. Kenya’s anti-money-laundering law covers VASPs as reporting institutions, and section 44 of the Act requires seven years of transaction records. Prepare Travel Rule capability anyway: collect originator and beneficiary information for transfers, send it to the receiving VASP, and screen wallet addresses and transactions.
Technology is central to the licensing assessment. Applicants must show appropriate systems, information-security arrangements and cybersecurity controls. The Regulations require an independent information-systems audit, including vulnerability assessment and penetration testing, as part of the application.
Custodial businesses must also show their wallet architecture, private-key management, access controls, transaction approvals, asset segregation, monitoring and recovery procedures.
Submit the prescribed form with the supporting documents and the applicable fee. The regulator can ask for more information. It can also require an interview about the application or supporting records. It can grant a licence with conditions, or reject an application that does not meet the requirements.
The regulator must publish notice of a licence grant in the Kenya Gazette within 30 days of the grant.
A licence starts ongoing supervision. After approval, the business must:
The Act also requires VASPs to act prudently and with integrity. It bans mixer, tumbler and anonymity-enhancing services.
| Requirement | What the regulator checks | Step |
| Corporate form | Company limited by shares, with a physical office in Kenya | 2 |
| Ownership | Significant shareholders and beneficial owners | 2 |
| Management | Fit-and-proper status of directors and senior officers | 3 |
| Financial resources | Paid-up and liquid capital for the activity | 4 |
| AML/CFT/CPF | Documented due diligence, monitoring and reporting systems | 5 |
| Technology | Cybersecurity controls and independent systems audit | 6 |
| Consumer protection | Policies on complaints, disclosures and fair conduct | 3 |
| Governance | Internal controls, risk management, business continuity | 3 |
The regulator also weighs the size, scope and complexity of the service, the applicant’s expertise, its source of funds, its financial stability, its technology, its internal safeguards, and the likely effect on customers and Kenya’s financial system.
Application and licence fees are small next to the capital requirement. Application fees run from KSh 10,000 for an investment adviser to KSh 100,000 for most other categories. Licence fees run from KSh 50,000 for an investment adviser to KSh 2 million for a stablecoin issuer. For example, an exchange pays KSh 100,000 to apply and KSh 1 million for the licence. A wallet provider pays KSh 100,000 to apply and KSh 500,000 for the licence. Annual renewal fees also apply, and some depend on turnover or assets under management.
The larger cost is the capital and the infrastructure behind it. The final Regulations set these minimum paid-up amounts: KSh 100 million for an exchange, KSh 150 million for a wallet provider, KSh 10 million for a payment processor, KSh 10 million for a broker, KSh 20 million for a virtual asset manager, and KSh 300 million for a stablecoin issuer. Investment advisers face no minimum capital requirement. The final rules lowered most of the draft thresholds, so older articles may show higher figures.
Plan also for compliance staff, cybersecurity, the independent systems audit, and wallet and custody infrastructure. These costs depend on the business model.
The Regulations were gazetted on 22 July 2026. Read the full fee and capital schedules in Legal Notice No. 134 of 2026 on Kenya Law before you set a budget.
Paid-up capital is share capital the licensee has received, normally in cash. Non-cash consideration needs regulator approval and objective valuation.. Core capital must stay at or above the paid-up minimum at all times. Shareholder loans, borrowed funds and unpaid commitments do not count as paid-up capital. Liquid capital is the amount by which liquid assets exceed liabilities.
Meeting the paid-up minimum is only the first financial test. A licensee must also keep enough liquid capital to cover its liabilities.
| Category | Paid-up capital | Liquid capital |
| Exchange | KSh 100 million | KSh 20 million or 8% of total liabilities, whichever is higher |
| Wallet provider | KSh 150 million | KSh 30 million or 100% of current liabilities for at least 30 days, whichever is higher |
Stablecoin issuers face the strictest reserve rules. Reserve assets must at least equal the nominal value of the stablecoin units in circulation. Permitted reserve assets include cash, short-term government securities and qualifying repurchase agreements. A custodian approved by the CBK must hold the reserve assets. At least 30% of funds received must sit in segregated accounts with commercial banks in Kenya (regulations 75 to 77). Holders can redeem at par, and the issuer must pay within two working days. Issuers cannot pay interest
Model your liquidity and reserve needs against expected transaction volumes and liabilities before you apply. These requirements apply for the life of the licence.
The Act sets no fixed approval period, but the Regulations give the regulator 30 days to decide a complete application after due diligence. Timing depends on how complete the application is and how fast the applicant answers the regulator. The process has four stages:
Preparation is usually the longest stage. Start the systems audit and policy work early.
A licence expires on 31 December of the year it is issued. Apply to renew at least two months before expiry. A new licensee must start business within 12 months of the grant.
Businesses already operating in or from Kenya must comply with the Act by 4 November 2026, one year after it commenced (section 47). The Act does not extend that date for pending applications. Operating without a licence after that date is an offence. New entrants cannot rely on this window, because the licensing ban in section 8 already applies to them.. If you already serve Kenyan customers, check your regulatory status now.
A VASP licence creates a continuing relationship with the regulator.
A licence is one part of launching a regulated virtual asset business. Operators also need secure wallet infrastructure, custody controls and transaction governance for daily operations.
Kenya’s technology rules expect applicants to show private-key management, access controls, transaction approvals and asset segregation. Liminal’s MPC-based wallet infrastructure and Liminal Firewall support these controls. Liminal Firewall is a policy engine that approves, blocks or escalates transactions. Liminal holds ISO 27001:2022 and SOC 2 Type II certifications. They do not replace the independent information-systems audit the Regulations require.
Liminal supports 20+ blockchains and offers APIs for enterprise integration. It integrates with Notabene for Travel Rule workflows and TRM Labs for AML and KYT screening.
Infrastructure like this can reduce the need to build core wallet, custody and transaction-control systems in-house. It does not replace licensing. The VASP stays responsible for meeting the requirements of the Kenyan regulator.
Yes, under licence. The Virtual Asset Service Providers Act, 2025 requires a licence to carry on a virtual asset service business in or from Kenya. The Virtual Asset Service Providers Regulations, 2026 set the detailed rules.
Any business that carries on a virtual asset service business in or from Kenya. This includes exchanges, custodial wallet providers, payment processors, brokers, managers, investment advisers, ICO providers, tokenisation providers and stablecoin issuers.
Fees vary by activity. An exchange pays a KSh 100,000 application fee and a KSh 1 million licence fee. A wallet provider pays KSh 100,000 to apply and KSh 500,000 for the licence. These fees are separate from minimum capital and operating costs.
VASPs must run AML/CFT/CPF controls. These cover customer due diligence, KYC, transaction monitoring, suspicious-transaction reporting and record-keeping. The details differ by business model. The duty continues after licensing.
The Act sets no fixed approval period. The Regulations give the regulator 30 days to decide a complete application. Approval time depends on how complete the application is. The regulator can ask for more information or an interview, and each request adds time. Allow time to prepare policies, complete the systems audit and fund your capital.
Both, depending on the activity. The CBK covers wallet providers, payment processors and stablecoin issuers. The CMA covers exchanges, brokers, investment advisers, managers, ICO providers, tokenisation providers and token-issuance platforms. Classify your service first.
Capital varies by activity. Minimum paid-up capital is KSh 150 million for a wallet provider, KSh 100 million for an exchange, KSh 10 million for a payment processor or broker, KSh 20 million for a manager, and KSh 300 million for a stablecoin issuer. Investment advisers have no minimum. Liquid-capital rules apply separately.
Yes, with conditions. A foreign company limited by shares can apply if it is registered under Kenya’s Companies Act, and it must keep a physical office in Kenya. Separately, the Regulations can reach businesses outside Kenya that target Kenyan consumers or earn income from Kenya. Serving Kenyan customers without a licence can breach the Act.
Yes. The company must keep the capital for its highest-capital category plus 50% of the paid-up capital for each additional activity.
Not by name. The Regulations set no Travel Rule threshold, but VASPs are reporting institutions under Kenya’s anti-money-laundering law and must keep transaction records for seven years. VASPs should prepare systems to collect and send originator and beneficiary information and to screen transactions.
