Kenya has taken a concrete step toward regulating virtual assets. The National Treasury confirmed the conclusion of public participation on the 2026 VASP (Virtual Asset Service Provider) draft regulations. Authorities will now review submissions before finalizing the rules, aiming to provide a legal backbone for crypto operations and enhance user protection.
Licensing Thresholds and Compliance Framework
The draft establishes a comprehensive legal structure for virtual asset firms operating in Kenya, covering cryptocurrencies, tokenized assets, and stablecoins. Companies must meet minimum capital thresholds and pass ownership suitability checks. Internal governance systems and risk management controls are mandatory. Anti-money laundering (AML) and counter-terrorism financing (CFT) measures form a core compliance requirement, including customer due diligence, transaction monitoring, and suspicious reporting.
This framework ties directly to the broader regulatory goal. Authorities aim to enforce consistent supervision across all licensed entities operating within or from Kenya.
Consumer Protection and Asset Segregation
On consumer protection, the draft mandates clear risk disclosure, transparent pricing models, and complaint handling systems for service providers. But the spotlight is on customer fund segregation: firms must separate client assets from operational accounts to reduce misuse risk and improve accountability.
Market conduct rules are also strict. Regulators require due diligence before listing assets and continuous monitoring of trading activity. Insider trading, market manipulation, and false trading are explicitly banned, with severe penalties for violators.
Multi-Agency Oversight and Next Steps
For enforcement, Kenya adopts a multi-agency approach. The Central Bank of Kenya (CBK), the Capital Markets Authority (CMA), and the Treasury will jointly implement supervision. This coordination aims to strengthen regulatory consistency and enforcement power.
Additionally, the draft introduces ongoing reporting and cybersecurity requirements. Licensed firms must conduct regular audits and maintain adequate insurance coverage. These measures address operational risks and system resilience.
Following the consultation phase, authorities will consolidate stakeholder feedback. The review process will determine final provisions before the regulations take effect. Observers expect Kenya to become one of Africa's early movers in crypto regulation, though implementation details remain to be seen.