Kenya’s Virtual Asset Service Providers Act, 2025

A turning point for Crypto Regulation in Kenya 

Author: Hilda Rita Mugasia

Kenya has officially  entered the regulated crypto era. After years of operating in a legal grey zone, the passage of the Virtual Asset Service Providers Act, 2025 creates the country’s first comprehensive licensing and regulatory framework for businesses providing services around cryptocurrencies and tokenised products. 

After sustained engagement between government and industry, Parliament’s adoption of the Bill signals a maturing approach to digital finance ,one that seeks to balance innovation, consumer protection, and financial integrity. The law now hands day-to-day implementation to regulators and the Treasury, marking a pivotal moment for Kenya’s crypto ecosystem.

The new architecture on who regulates what

The Act establishes an activity-based regulatory perimeter and names the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) as joint lead regulators. In practice, CBK will take the lead on payment-type activities and stablecoins, while the CMA will oversee token offerings, tokenised securities and investment-facing services; the Cabinet Secretary for the National Treasury can designate further competent authorities and  crucially  make subsidiary regulations to operationalise the law. 

What this means in plain terms: the Act draws a fence around commercial intermediaries that touch other people’s crypto (exchanges, custodians, brokers, advisors and the like). It does not, on its face, criminalise owning crypto in self-custody or private peer-to-peer transfers, but it does make doing those regulated activities as a business conditional on licensing. 

How the Bill defines and groups VASPs

The statute uses functional definitions rather than technology names. In short, a virtual asset service provider is an entity that provides one or more regulated services involving the trading, custody, issuance or management of virtual assets for others. The Bill’s schedule lists the regulated activity types; the most salient categories are:

  • Exchanges and trading platforms (centralised and certain decentralised platforms that custody assets or market-make).
  • Custody and wallet providers (services that control customer keys or hold assets on behalf of clients).
  • Brokers and dealers (fiat–crypto and crypto–crypto intermediaries).
  • Investment advisers and asset managers dealing in virtual assets.
  • Token issuance and tokenisation services (ICOs, STOs, real-world asset tokenisation).
  • Escrow, settlement and certain platform operators.
     Each category triggers bespoke licensing, governance and compliance obligations.

Key obligations the law imposes

Licensed VASPs must meet a long list of controls and standards, including (but not limited to): licensing and fit-and-proper assessments for owners and directors; capital solvency and insurance requirements; segregation of client assets and auditability; AML/CFT (and counter-proliferation) controls and transaction monitoring; cybersecurity and incident-reporting standards; advertising and consumer-protection rules; periodic reporting and external audits. The Cabinet Secretary’s subsidiary regulations will set many of the technical thresholds (capital ratios, insurance minima, stablecoin rules, tokenisation standards, etc.).

Tax and marketplace consequences

The policy package accompanying the Bill re-calibrates taxation of virtual asset activity. The controversial 3% Digital Asset Tax on transaction value has been repealed; the Finance Act, 2025 replaces it with an excise duty applied to fees charged by VASPs (reported as a 10% excise in the implementing instruments). 

This represents a meaningful shift taxing intermediary service fees rather than total trade value. The result: traders and platforms are taxed on actual income, not on the notional value of every transaction. Expect KRA guidance and Treasury notices to further clarify how excise, VAT, and corporate tax will interact in practice.

What this will change in practice

  • Market structure: institutional-grade custodians and exchanges that can afford higher compliance costs will expand; smaller, open-source teams and hobbyist projects will face higher barriers to offering custody or exchange services.
  • Consumer protection: users gain clearer recourse routes, asset segregation requirements and auditability for licensed platforms, a net gain for retail investors.
  • Privacy and surveillance: the Act’s AML/KYC regime and mandatory reporting will increase state visibility of flows through licensed rails. That’s protective for financial integrity but raises data-privacy and constitutional questions.
  • Innovation trade-offs: the law is technology neutral and broad, which makes it future-proof but leaves many edge cases ambiguous (e.g., certain DeFi primitives, Lightning routing, non-custodial smart contracts). The subsidiary regulations will decide those margins.
  • Practical Checklist for Stakeholders

For ordinary users:

  • Learn the basics of self-custody , secure your seed backups, verify wallet sources, and avoid sharing private keys.
  • Use licensed on-ramps and off-ramps for fiat conversions.
  • Keep clear records of transactions (dates, KES amounts, counterparties) for tax and compliance.

For SMEs and corporates:

  • Adopt a board-approved crypto treasury policy before handling digital assets.
  • Avoid holding client crypto assets unless you intend to become a licensed VASP.
  • Maintain IFRS-consistent accounting records and reconcile all digital asset positions.
  • Engage auditors early on classification and valuation of tokens.

For founders and builders:

  • Decide early whether your model is non-custodial (lower regulatory burden) or licensed (institutional credibility, higher compliance cost).
  • If pursuing licensing, start early engagement with CBK and CMA.
  • Design for auditable custody and implement robust cybersecurity systems.
  • Budget for compliance that is, AML/KYC, insurance, legal review, and system audits.
  • Consider partnerships with regulated custodians or payment processors to share compliance obligations.

What the Bill does not (yet) do; important limits

It does not ban or require licensing for private self-custody (individuals keeping their own keys) or occasional wallet-to-wallet transfers, provided those activities are not being carried out as a business. The line between private dealing and an unlicensed VASP, however, will be litigated and shaped by regulations and enforcement practice.

Risks and red flags

  • Regulatory capture/gatekeeping: heavy capital and compliance rules risk concentrating market power in incumbents.

  • Subsidiary-regulation power: the Treasury’s discretion to set technical rules means the hard policy choices (stablecoin design, token classification, DeFi interfaces) will be made in the regulations, not the Act itself. 

  • Constitutional and privacy concerns: any future rule that compels disclosure of private keys or bulk data collection must still pass tests under Kenya’s Constitution (necessity, proportionality). Legal challenges are possible if regulators overreach.

Practical next steps 

For ordinary users: learn basic self-custody (secure seed backups), use licensed on-ramps for fiat conversions when needed, and keep records (dates, KES amounts, etc.) for tax.

For SMEs and corporates: adopt a board-approved crypto treasury policy, avoid holding client assets unless you intend to become a licensed VASP, and keep IFRS-consistent records and reconciliations.

For founders and builders: decide early whether you want to remain non-custodial (lower regulatory burden) or pursue a licensed VASP model (institutional access but higher cost). If you pursue licensing, start early conversations with CBK/CMA, design for auditable custody, and budget for compliance.

Bottom line: A defining moment for crypto in Kenya

The VASP Act, 2025 marks a regulatory milestone. It finally gives Kenya a formal rulebook for exchanges and custodians and aligns tax and oversight frameworks to encourage compliant growth. This creates pathways for institutional capital, improved consumer protection, and stronger market integrity.

But it also introduces higher costs, heavier surveillance, and potential gatekeeping pressures that could reshape who thrives in Kenya’s crypto economy. The true impact will depend on how the Treasury, CBK, and CMA design and enforce the forthcoming subsidiary regulations.

For founders, builders, and investors, the task now is clear: engage early, design compliantly, and stay vigilant. Kenya’s crypto future will be written in the fine print of the next round of regulations and by the innovators bold enough to adapt to them.

Back to blog