Kenya’s President Signs VASP Bill into Law, Establishing Formal Crypto Regulatory Framework

44

In a landmark move for Kenya’s digital finance landscape, President William Samoei Ruto yesterday assented to the Virtual Asset Service Providers (VASP) Bill, 2025, bringing it into force as an Act of Parliament. The law is part of a broader package of eight bills recently signed at State House, Nairobi,  among them amendments to land, wildlife, police service, cybercrime, and privatization laws.

With the President’s assent, the VASP Bill now joins Kenya’s statutes, setting the stage for a regulated and transparent environment for cryptocurrency, digital assets, and the virtual asset service industry.

What the VASP Act Does: Key Provisions & Structure

Definition & Scope

The Act defines a “virtual asset” as a digital representation of value that can be traded or transferred and used for payment or investment, excluding fiat currencies, securities, or other regulated financial instruments.

It applies to entities (not individuals) providing virtual asset services within Kenya or to Kenyan users, whether domestic or foreign.

Licensing & Permissible Activities

Under the Act, no entity may carry out VASP business without a valid licence. 

The Bill enumerates seven categories of VASP licences, aligned with distinct service models in the virtual asset ecosystem:

1. Wallet Provider – Custodial or non-custodial wallet services, transfers, conversions
   
2. Exchange – Platforms for trading, listing, and secondary trading
   
3. Payment Processor – Handling conversions between virtual assets and fiat or among assets
   
4. Broker – Executing trades on behalf of clients via exchanges and wallets
   
5. Investment Advisor – Offering advice on virtual assets, ICOs, or NFTs
   
6. Asset Manager – Discretionary portfolio management of virtual assets
   
7. Offering Provider – Issuance and sale of digital assets, tokenization services, and associated financial services
   

Regulatory Authorities & Oversight

Rather than creating a standalone Virtual Assets Regulatory Authority (VARA) as initially proposed, the Act preserves oversight within existing institutions, notably:

• Central Bank of Kenya (CBK) – Licensing and supervision of stablecoin issuance and virtual asset infrastructure
  
• Capital Markets Authority (CMA) – Regulating exchanges, ICOs, tokenization, and market intermediaries
  
• The Cabinet Secretary for the National Treasury retains power to designate additional regulators via Gazette notice to adapt as the sector evolves
  

Licensing Requirements & Obligations

To secure a licence, applicants must:

• Be a company registered under the Companies Act (or a foreign company with certificate of compliance)
  
• Demonstrate adequate capital, solvency, and insurance provisions
  
• Show competence via qualified personnel (skills, experience) 
• Comply with AML / CFT / CPF obligations, data protection rules, cybersecurity measures, and consumer protection frameworks
  
• Maintain local operations, appoint independent directors, and establish robust corporate governance

After licensing, VASPs will be subject to strict operational duties, including:

• Safeguarding client assets (segregation and protection)
  
• Incident reporting and transparency
  
• Ongoing audits, financial reporting, and regulatory inspections
  
• Managing conflicts of interest, change notifications, and risk controls
  

Enforcement & Penalties

Violations of the Act may lead to severe penalties, including fines, licence suspension or revocation, and even criminal liability.

For example:

• Unlicensed VASP operations can attract fines up to KES 25 million or more, or imprisonment
  
• False or misleading disclosures or non-compliance may carry fines running into millions of Kenyan shillings and potential jail terms 

Why the VASP Act Matters: Impacts & Implications

1. Clarity and Legitimacy for Kenya’s Crypto Sector

Before now, Kenya’s crypto industry largely operated in a regulatory grey zone. With the VASP Act, service providers can operate under legal certainty, urging investment, formalization, and innovation.

The law signals that virtual assets and blockchain services will no longer remain on the fringes but are to be integrated into Kenya’s formal financial system.

2. Consumer Protection & Risk Mitigation

By enforcing strict governance, auditing, incident reporting, and asset protection, the Act strengthens consumer confidence in the crypto sector. It aims to mitigate risks such as fraud, mismanagement, insolvency, and cyber breaches.

3. Attracting Investment & Industry Growth

Regulation tends to reduce uncertainty for institutional investors, stablecoin issuers, exchanges, and fintech firms. Kenya is positioning itself to compete with crypto-friendly jurisdictions across Africa by creating a modern regulatory framework. 

4. Challenges for Smaller Players & Startups

Strict licensing requirements (capital, personnel, compliance overhead) may raise the barrier to entry for nascent fintechs. Some critics warn that large, well-resourced players could dominate, disadvantaging smaller innovators

Concerns have also been raised over regulatory capture, particularly around the influence of Binance-linked entities in regulatory drafting discussions. 

5. Regulatory and Compliance Risk

Operating under this new law means VASPs must stay vigilant. Compliance failures carry steep penalties, and regulators will be empowered to conduct inspections, audits, and enforcement actions. 

What Comes Next: Implementation & Market Outlook

• Transitional Period: The Act provides for a transition window, existing operators are expected to apply for licences within 18 months of commencement.
  
• Regulatory Rulemaking: The Cabinet Secretary will issue subsidiary regulations, licensing guidelines, and notices to operationalize the Act’s provisions.
  
• Market Consolidation: As compliance costs rise, expect mergers, partnerships, and exits among crypto firms that can’t meet regulatory burdens.
  
• Innovation Under Watch: New products such as tokenization, stablecoins, DeFi primitives, and custody services may be regulated more tightly.
  
• Regional Influence: Kenya’s move is likely to inspire similar regulation in East Africa and beyond, with potential harmonization of digital asset laws across African blocs.

Conclusion

President Ruto’s assent of the VASP Act marks a turning point for Kenya’s crypto sector,  from ambiguity to structure and accountability. With licensing, oversight, and enforcement provisions now in place, Kenya has set a regulatory foundation for integrating virtual assets into its financial system. While challenges remain, especially around compliance burdens and fair competition, the law offers clarity and opportunity for service providers, fintechs, investors, and everyday users in the fast-evolving digital economy.

As the Act takes effect and regulators begin implementation, all eyes will be on how Kenya balances innovation and consumer protection in its new era of regulated crypto.