Kenya has taken a decisive leap in shaping its digital finance landscape through the Virtual Asset Service Providers Act of 2025. This landmark legislation establishes a comprehensive legal framework for licensing, regulating, and supervising virtual asset service providers (VASPs) across the country.

This new law finally delivers the regulatory clarity long awaited by crypto exchanges, digital wallet providers, NFT platforms, and decentralized finance (DeFi) innovators—paving the way for compliant, scalable growth.

Definition of a Virtual Asset Under Kenyan Law

A virtual asset is defined as a digital representation of value that can be traded or transferred electronically and used for payment or investment. The definition excludes digital fiat, securities, and other financial assets.

To operate legally as a Virtual Asset Service Provider in Kenya, an entity must be:

• A domestic company incorporated under the Companies Act, or
• A foreign company holding a certificate of compliance under the same Act.

Natural persons are strictly prohibited from conducting VASP business on their own.

Types of VASP Licenses and What They Cover

The Act introduces several license categories tailored to specific business models:

1. Virtual Asset Wallet Provider – Stores virtual assets for clients and facilitates transfers and conversions.
2. Virtual Asset Exchange – Operates platforms for trading, exchanging, and issuing virtual assets, including custody functions.
3. Virtual Asset Payment Processor – Handles transactions between virtual assets and fiat, or between different virtual assets.
4. Virtual Asset Broker – Executes trades on behalf of clients across exchanges and wallets.
5. Virtual Assets Investment Advisor – Provides advisory services on virtual assets, ICOs, and NFTs.
6. Virtual Asset Manager – Manages virtual asset portfolios on a discretionary basis.
7. Virtual Asset Offering Provider – Issues and sells virtual assets to the public and offers related services for initial offerings.

Who Regulates VASPs in Kenya?

Regulatory oversight will be shared by:

• The Capital Markets Authority (CMA)
• The Central Bank of Kenya (CBK)

Additionally, the Cabinet Secretary for the National Treasury may appoint new regulators through gazetted notices—allowing the framework to evolve alongside the industry.

Licensing Requirements for VASPs in Kenya

To obtain a license, companies must demonstrate:

• Proper registration under the Companies Act
• Competent personnel with relevant skills and expertise
• Strong consumer and data protection frameworks
• Adequate financial capacity, including insurance and capital strength
• Appointment of reputable key officers
• Compliance with cybersecurity obligations under the Computer Misuse and Cybercrimes Act
• Suitable premises or digital infrastructure for recordkeeping
• A business model that serves the public interest

Regulators may approve, conditionally approve, or reject applications—with reasons required for any rejection. Licensees must also report any material changes to the authority within 14 days.

Duties and Obligations of Licensed VASPs

Once licensed, VASPs must uphold strict operational and ethical standards, including:

• Fit-and-proper senior management
• Physical office presence in Kenya and two independent directors
• Fair, honest, and client-centric conduct
• Strong capital, solvency, and insurance levels
• Robust conflict-of-interest controls
• Compliance with AML, CFT, CPF, data protection, cybersecurity, and dispute-resolution laws
• Timely reporting of operational incidents
• Notifications for ownership or structural changes
• Continuous cybersecurity enhancements
• Submission of audited accounts within three months of year-end
• Employment of a regulator-approved CEO
• Protection of client assets from misuse or loss

Regulators may impose additional conditions as needed.

AML, CFT, and CPF Compliance

The Act places AML, CFT, and CPF obligations at the center of VASP regulation. Authorities will:

• Vet staff and board members
• Conduct ongoing inspections and surveillance
• Demand documents and information
• Enforce penalties and compliance measures

Non-adherence is classified as a criminal offence with serious consequences.

Penalties for Non-Compliance

The Act introduces significant penalties for violations:

Unauthorized Share Transfers

• Individuals: Up to KES 3 million, 3 years imprisonment, or both
• Companies: Up to KES 5 million

False or Misleading Information

• Individuals: Up to KES 7 million, 3 years imprisonment, or both
• Companies: Up to KES 20 million

Severe Offences (e.g., unlicensed operations, money laundering)

• Individuals: Up to KES 10 million, 5 years imprisonment, or both
• Companies: Up to KES 25 million

These penalties underscore the importance of securing legal guidance from a professional who understands Kenya’s virtual asset regulatory framework.

🚀 Ready to Launch or Scale Your Virtual Asset Business in Kenya?

Whether you’re building a crypto exchange, NFT marketplace, digital wallet, or tokenized finance platform, navigating the VASP Act is essential to operating legally and gaining investor confidence.

A fintech-focused lawyer can help you secure your license, meet regulatory requirements, and protect your business from compliance risks.

👩🏽‍⚖️ Work with a fintech lawyer in Kenya who understands virtual asset law, digital finance, and blockchain compliance—so you can innovate boldly and stay fully compliant.

📩 Contact Us

If your virtual asset company or fintech startup needs legal guidance, we’re here to support your growth.

👉 Email us at info@masibolaw.co.ke to schedule a consultation with a fintech lawyer who understands your industry.

Client Testimonial

“Working with MasiboLaw was a game-changer for our fintech startup. Their deep understanding of Kenya’s virtual asset regulations ensured our compliance and gave us the confidence to scale our operations.”
— Satisfied Client in the Virtual Asset Sector