Kenya Gazettes VASP Regulations, Opening the Licensing Window for Crypto Firms
Kenya's Virtual Asset Service Providers Regulations, 2026 were gazetted on 22 July 2026, operationalising the 2025 Act. Existing providers have until 4 November 2026 to obtain a licence.
What Changed
On 22 July 2026, the Cabinet Secretary for the National Treasury gazetted the Virtual Asset Service Providers Regulations, 2026, completing implementation of the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025), which commenced on 4 November 2025. The Regulations took effect on gazettement and establish the licensing and supervision framework jointly administered by the Central Bank of Kenya (CBK), which oversees wallet, custody and payment activities, and the Capital Markets Authority (CMA), which oversees exchange, broking and investment activities. Until now no VASP had been licensed, as licensing awaited these implementing rules. Existing providers have a transition period ending 4 November 2026; operating without a licence after that date is a criminal offence.
Who It Affects
Crypto exchanges, wallet and custody providers, token issuers, and brokers serving Kenyan users, each of which must now determine whether they fall under the CBK or CMA remit, or both. Foreign platforms marketing to Kenyan customers are equally in scope. The 4 November 2026 cut-off converts a long-anticipated framework into a hard compliance deadline, and firms that miss it move from unregulated to criminal exposure overnight.
What to Do
Map your activities against the CBK and CMA permissible-activity lists and identify which regulator, or both, must license you. Begin the application before the 4 November 2026 transition deadline rather than at it, since fit-and-proper, governance, and AML documentation take time to assemble. Stand up KYC onboarding, transaction monitoring, and Travel Rule capability aligned to FATF standards now. Verification tooling that produces a consistent, audit-ready record across onboarding and ongoing monitoring will ease both licence assessment and later supervision.
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds.
Learn More