Kenya stands on the cusp of a regulatory milestone that could reshape East Africa’s cryptocurrency landscape. On Tuesday, October 7, 2025, the Kenya Virtual Asset Service Providers (VASP) Bill passed its third and final reading in parliament, marking the last legislative hurdle before becoming law.
Attorney General Dorcas Oduor is now preparing the final text for presidential assent, a step that would make Kenya the latest African nation to establish comprehensive cryptocurrency regulation, joining South Africa, Ghana, Mauritius, and Nigeria in creating a structured legal framework for digital assets.
The Twin-Pillar Regulatory Model
The Kenya VASP Bill introduces a unique “twin-pillar” regulatory architecture that appoints both the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) as joint lead regulators for all virtual asset activities within the country.
Under this dual-regulator structure, the Treasury Cabinet Secretary holds the mandate to issue subsidiary rules that will operationalize the framework. These sub-regulations will be crucial in determining how Kenya’s crypto market actually functions in practice.
The scope of these forthcoming regulations is comprehensive, covering:
- Stablecoin issuance and tokenization of real-world assets
- Token offerings (ICOs and STOs), exchanges, and trading platforms
- Investment advisory and asset management services
- Capital adequacy, solvency, and insurance requirements
- Consumer protection and market conduct standards
- Advertising guidelines and cybersecurity protocols
- Anti-Money Laundering (AML), Counter-Financing of Terrorism (CFT), and Counter-Proliferation Financing (CPF) compliance
According to Kenya’s government, the legislation addresses the country’s position as one of Africa’s leading digital asset adopters. The Virtual Asset Service Providers Act 2025 aims to mitigate risks associated with cryptocurrency misuse while fostering a regulated ecosystem that supports legitimate growth.
Defining Virtual Assets: What’s In and What’s Out
The Kenya VASP Bill provides specific definitions that establish clear boundaries for regulatory oversight. A virtual asset is classified as a digital representation of value that can be traded, transferred, and used for payments or investments.
However, the legislation explicitly excludes several categories from its scope:
Excluded from regulation:
- Fiat currencies and traditional e-money
- Securities and conventional financial assets
- Closed-ecosystem tokens that are non-transferable and non-exchangeable
- Digital representations already regulated under other frameworks
- Central Bank Digital Currencies (CBDCs)
- Non-Fungible Tokens (NFTs) not used for payment, investment, or financial purposes
This careful delineation prevents regulatory overlap and ensures the bill targets specifically crypto assets and services rather than attempting to regulate the entire digital economy.
Strict Licensing Requirements and Annual Renewals
At the heart of the Kenya VASP Bill lies a rigorous licensing regime that will fundamentally change how cryptocurrency businesses operate within the country.
Only registered companies can apply for VASP licenses through a formal application process that includes prescribed requirements and fees as outlined in Clause 11 of the bill. Notably, any approved license runs only until December 31 of the year it was issued, as specified in Clause 14, requiring annual renewals.
Regulatory authorities maintain significant discretion, with powers to impose additional conditions or vary, suspend, or revoke licenses for non-compliance under Clauses 13 and 16.
This annual renewal requirement creates an ongoing compliance relationship between virtual asset service providers and regulators, ensuring continuous oversight rather than one-time approval.
Six-Month Grace Period for Existing Platforms
Recognizing the reality that cryptocurrency platforms already operate within Kenya, the bill includes transitional provisions designed to avoid market disruption.
Under Clause 47, existing providers, including platforms like Busha, Yellow Card, and Swypt, receive a six-month window to submit their licensing applications. Critically, these entities may continue operating until regulatory authorities make final decisions on their applications.
This grace period reflects a pragmatic approach that acknowledges the time required for compliance preparation while maintaining market continuity for Kenyan cryptocurrency users who depend on these platforms for trading, remittances, and investment activities.
Comprehensive Operational Requirements
The Kenya VASP Bill establishes detailed operational standards that licensed providers must maintain:
Corporate Governance:
- Board composition of at least two natural persons (Clause 21)
- Appointment of a fit-and-proper Chief Executive Officer (Clause 31)
Conduct Standards:
- Operate with integrity, due care, and fairness toward clients
- Prohibition against misleading clients (Clause 22)
Consumer Asset Protection:
- Hold sufficient quantities of each asset type
- Segregate customer funds from company assets
- Meet specified financial requirements
- Protect client assets from creditor claims (Clause 32)
Anti-Money Laundering Compliance:
- Full AML/CFT/CPF compliance
- Implementation of targeted financial sanctions (Clauses 25(e) and 33)
Cybersecurity Measures:
- Implement appropriate and effective security protocols (Clause 29)
Conflicts of Interest:
- Maintain policies to prevent and manage potential conflicts (Clause 24)
Record-Keeping:
- Maintain adequate records and controls
- Provide regulators with online, real-time, read-only access to client and firm transaction records
- Retain records for minimum seven years (Clause 44)
Reporting Obligations:
- Submit annual audited financial statements within six months of financial year-end (Clause 30)
- CEOs must notify authorities within seven working days of insolvency, major non-compliance, criminal proceedings, or cybersecurity incidents (Clause 26)
These requirements establish a compliance baseline comparable to traditional financial institutions, signaling Kenya’s intent to treat cryptocurrency services as serious financial infrastructure.
Severe Penalties for Non-Compliance
The Kenya VASP Bill imposes substantial penalties designed to deter unlicensed operations and fraudulent activities.
For Individuals:
- Fines up to $77,400 (KES 10 million)
- Imprisonment up to 10 years
- Both penalties may be imposed concurrently
For Virtual Asset Service Providers:
- Fines up to $154,000 (KES 20 million)
- Daily penalties for continuing to operate without proper authorization
- Additional sanctions for specific violations
For Forgery and Fraud:
- Separate penalties targeting falsification of documents or misrepresentation
The CBK and CMA maintain broad enforcement powers, including issuing written warnings, remedial directions, business restrictions (including prohibitions on new business or director appointments), license suspension or revocation, administrative fines, and formal investigations.
These penalty structures represent some of the strictest in African cryptocurrency regulation, signaling Kenya’s determination to establish a compliant market from the outset.
Strategic Timing: Kenya’s Grey List Challenge
The accelerated movement of the Kenya VASP Bill through parliament aligns with broader strategic pressures facing the country.
Kenya remains on the Financial Action Task Force (FATF) grey list, a designation indicating strategic deficiencies in anti-money laundering and counter-terrorism financing frameworks. This designation creates pressure from international financial institutions and trading partners to demonstrate improved regulatory oversight.
Additionally, Kenya’s relationship with the International Monetary Fund has been complicated. The IMF’s Extended Fund Facility arrangement with Kenya was canceled in March 2025, creating fiscal pressure to demonstrate economic governance improvements and unlock alternative revenue sources.
The cryptocurrency market represents a multi-billion dollar opportunity that Kenya cannot afford to ignore. However, capturing this opportunity requires regulatory legitimacy, precisely what the VASP Bill aims to provide.
Historic But Incomplete
The Kenya VASP Bill’s passage through its third reading represents a historic moment for East African cryptocurrency regulation. Kenya is positioning itself as a serious player in Africa’s digital asset economy, with a regulatory framework that signals commitment to international compliance standards.
However, the bill’s ultimate success or failure won’t be determined by legislative passage but by implementation quality. The subsidiary regulations, licensing processes, enforcement approaches, and regulatory culture that develop around this framework will determine whether Kenya becomes a regional cryptocurrency hub or inadvertently drives business to competitors.
