On 17th March 2026, the National Treasury released for public comment the draft Virtual Asset Service Providers Regulations, 2026 (the Draft VASP Regulations) which, when enacted, will be used to operationalize the Virtual Asset Service Providers Act, Act No. 20 of 2025 (the VASP Act).
The Draft VASP Regulations prescribe, among other things, the form of licence applications, the information and documentation required in support of such applications, the applicable fees and the operational and compliance standards to be maintained by licensees.
Following the conclusion of the public participation process, the Draft VASP Regulations are currently being reviewed by the National Treasury in consultation with the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) to take into account any comments received from the public before the Regulations are finalised by Parliament. This article should be read together with our previous insight of 19 November 2025 in which we summarised the key provisions of the VASP Act.
In this article, we provide an overview of the key requirements introduced by the Draft VASP regulations. It is expected that licensing of the virtual asset service providers (VASPS) in Kenya will commence as soon as the Draft VASP Regulations enter into force.
Who is Covered?
Section 8 of the Act prohibits any person from carrying on, purporting to carry on, or holding himself/herself out as carrying on the business of virtual asset services in or from Kenya unless:
- that person is incorporated in Kenya as a company limited by shares or is a foreign company limited by shares and registered in Kenya (a branch); and
- and is licensed by the CBK, the CMA or any other public body designated by the Cabinet Secretary responsible for matters related to the National Treasury.
To contextualize the licensing requirement, the Draft VASP Regulations propose that a person is deemed to be operating in or from Kenya where they derive economic benefit or income from Kenya regardless of whether such a person has a physical presence in Kenya.
Accordingly, a person may be considered to be offering virtual asset services in or from Kenya solely by virtue of deriving revenue or other economic benefit from the Kenyan market. This clarification significantly broadens the regulatory perimeter to capture foreign-based and digitally-operated entities whose virtual asset services target, or generate revenue from, users in Kenya.
Licensing and Registration
All VASPs are required to obtain a licence from the relevant regulatory authority prior to commencing operations.
The licensing requirements set out under the Draft VASP Regulations are extensive and include:
- detailed corporate, ownership and beneficial ownership disclosures;
- “fit and proper” assessments of directors, chief executive officers, senior officers and shareholders supported by a credit reference bureau report for each individual subject to assessment;
- submission of a comprehensive business plan in the prescribed form;
- compliance with minimum paid‑up and liquid capital thresholds, which vary depending on the the type of VASP. By way of illustration:
- a virtual asset payment processor will require a minimum paid up capital of KES 50 million or around US$390,000 and a minimum liquid capital of KES 10 million (about US$77,000) or 20% of its paid-up capital, whichever is higher.
- a stablecoin issuer will require a minimum paid up capital of KES 500 million or around US$3.9M and a minimum liquid capital of KES 100 million (about US$770,000) or 100% of current liabilities for at least 30 days, whichever is higher;
- audited financial statements;
- robust risk management, AML/CFT/CPF, cybersecurity and information technology as well as complaints managements policies; and
- demonstration of adequate human and technological resources.
In addition to the general licensing requirements, the Draft VASP Regulations impose specific obligations on certain categories of VASPs. Notably, VASPs dealing with exchanges, stablecoin issuers and wallet providers are subject to ownership concentration limits such that no single person may directly or indirectly hold more than a third of the share capital or voting rights in the VASP or have the power to appoint more than a third of the board of directors of the VASP.
Licences issued by the relevant regulatory authority will be subject to prescribed conditions, renewable annually and may be suspended or revoked in cases of non-compliance.
Continuing Operational and Compliance Obligations
Under the Draft VASP Regulations, licensed entities will be subject to continuing operational and compliance obligations, including requirements to:
- operate in a fair, transparent and efficient manner such as by ensuring activities such as marketing and advertisements comply with the prescribed requirements;
- maintain enforceable business rules and default procedures;
- establish and test business continuity and disaster recovery plans;
- maintain a register of interests which should be reviewed annually disclosing any holdings, directorships, or beneficial interests of directors, senior officers or associated parties;
- keep detailed activity and transaction records for at least seven years;
- submit periodic financial, operational, and risk based reports to the relevant regulatory authority;
- conduct customer due diligence and ongoing monitoring; and
- make extensive disclosures to consumers on risks, fees, complaints handling and safeguards.
The Draft VASP Regulations further impose stringent corporate governance standards on VASPs. In particular, a VASP shall ensure that its board of directors comprises at least one‑third independent directors and that a compliance officer is appointed, with direct access to the board of directors and charged with monitoring and reporting on compliance specified by the relevant regulatory authority.
Consumer Protection
A central focus of the Draft VASP Regulations is consumer protection, with requirements including:
- Segregation whereby consumer assets must be separated from the licensee’s own assets and deposited into a Kenyan bank account by the end of each business day.
- No security interests or liens may be placed over consumer assets.
- A consumer must be made aware of all material risks before a transaction is effected and which must be confirmed in writing. Promising returns on any investment is prohibited. Pre-transaction disclosures must cover licence status, fees, risks and security protocols.
- A mandatory consumer service agreement addressing account procedures, privacy, dispute resolution and dormant accounts must be submitted to the regulator for each consumer.
- A consumer care system must be established within six months of commencing virtual asset services, and monthly reports covering complaints received, resolved and outstanding must be submitted to the relevant regulatory authority within ten days of the end of each calendar month.
--
Read the original publication at Dentons Hamilton Harrison & Mathews
