MasiboLaw LLP

By Team

Custodying other people’s crypto is a business built on trust. Under Kenya’s Virtual Asset Service Providers Regulations, 2026, that trust now comes with a formal licensing regime, substantial capital requirements and detailed custody obligations.

Here’s what it takes to become a licensed Virtual Asset Wallet Provider.

What a Wallet Provider Licence Covers

A Virtual Asset Wallet Provider licence authorises a business to hold, safeguard and manage virtual assets on behalf of consumers. It is one of the more heavily regulated licence categories under the Regulations, reflecting the fact that wallet providers have direct custody over client assets.

Capital Requirements

Wallet providers are subject to the highest capital requirements of any non-stablecoin VASP licence category.

Applicants must maintain:

• Minimum paid-up capital: KSh 150,000,000
• Minimum liquid capital: KSh 30,000,000 or 100% of current liabilities for at least 30 days, whichever is higher

Fees

• Application fee: KSh 100,000
• Licence fee: KSh 500,000
• Annual renewal fee: KSh 500,000 or 0.15% of gross turnover, whichever is higher

Preparing the Application

As with every VASP licence, applicants must submit the standard licensing package to the Central Bank of Kenya, including:

• Details of directors, senior officers, significant shareholders and beneficial owners
• A comprehensive business plan
• Fit-and-proper assessments
• Evidence of the source of funds
• A description of governance, systems and internal controls
• Operational policies covering:
  • Risk management
  • AML/CFT/CPF compliance
  • Data protection
  • Cybersecurity
  • Complaints handling
  • Market conduct
  • Consumer protection
  • Conflict of interest management
  • Business continuity
• Evidence that the prescribed capital requirements have been met
• Audited financial statements for the previous three years
• Evidence of adequate human and technological resources
• An independent information systems audit, including a vulnerability assessment and penetration test
• Standard corporate documentation and payment of the prescribed application fee

Wallet providers must also prepare and submit business rules in accordance with the regulator’s requirements. The Regulations expressly require this for virtual asset exchanges, token issuance platforms, virtual asset offerings and wallet providers.

Custody Obligations

The defining feature of this licence is its extensive custody framework. These are operational requirements that should be incorporated into a provider’s business model from the outset rather than addressed after licensing.

Segregation of Assets

Consumer assets must always be kept separate from the wallet provider’s own assets and from other non-consumer assets.

This segregation applies both:

• On-chain, where consumer assets must be held in separate blockchain addresses from the provider’s own assets; and
• Internally, where separate ledger accounts must distinguish consumer holdings from non-consumer holdings.

No Use of Consumer Assets

Assets held in custody may not be lent, used, hypothecated, pledged or otherwise encumbered.

Custody means exactly that—it is not a source of working capital or trading inventory.

Monthly Reconciliation

Wallet providers must reconcile:

• On-chain holdings;
• Internal accounting records; and
• Consumer entitlements.

The reconciliation must be performed every month, with the results submitted to the Central Bank of Kenya by the 10th day of the following month.

Omnibus Accounts

Where a provider wishes to hold multiple consumers’ assets in an omnibus account—or under any arrangement that is not individually designated for each consumer—it must first obtain the consumer’s explicit consent.

The provider must also maintain records sufficiently detailed to identify, at all times, precisely which assets belong to each consumer.

Sufficiency of Holdings

Wallet providers must always maintain sufficient quantities of each virtual asset to meet their obligations to consumers.

They must also maintain procedures enabling consumers to recover their assets, or access to those assets, whenever required.

Resilience Planning

Providers must establish documented and tested policies addressing operational disruptions, including:

• Procedures where custody arrangements are affected;
• The ability to freeze or seize assets where legally required;
• The transfer of custody to another appropriate provider;
• The correction of mistaken or fraudulent transactions; and
• Maintaining continued access to consumer assets during unexpected disruptions.

Consumer Disclosure and Reporting

A wallet provider must make a clear, plain-language consumer agreement readily available on its website.

The agreement must explain:

• The custody arrangements;
• How consumer assets are segregated;
• The consumer’s beneficial and equitable interest in those assets; and
• Any limitations on how custodied assets may be used.

Providers must also:

• Maintain an up-to-date register recording each consumer’s entitlement; and
• Issue consumers with a statement of holdings at least once every three months, and whenever requested.

Timeline and Next Steps

Once a complete application has been submitted, the regulator has 30 days to determine the application.

If approved, the licence is issued upon payment of the licence fee, and the business must commence operations within 12 months.

Thereafter, the licence must be renewed annually, with the renewal application and prescribed fee submitted at least two months before expiry.

The Bottom Line

In order to secure this licence, Applicants must build and maintain robust custody infrastructure, including segregated on-chain addresses, reconciliation processes, incident response procedures and consumer reporting systems as well as terms and conditions.

Need help obtaining a Virtual Asset Wallet Provider Licence?

Applying for a Virtual Asset Wallet Provider Licence requires far more than completing an application form. Applicants must establish appropriate governance structures, prepare detailed compliance documentation, satisfy capital requirements, and demonstrate that their systems and controls meet regulatory expectations.

MasiboLaw LLP advises cryptocurrency businesses, fintech companies, digital asset firms, and investors on Virtual Asset Service Provider (VASP) licensing and regulatory compliance in Kenya. If you require assistance with obtaining a Virtual Asset Wallet Provider Licence or any other VASP licence, contact us at info@masibolaw.co.ke.