Kenya has formally gazetted the Virtual Asset Service Providers (VASP) Regulations, 2026 under Legal Notice No. 134 (Kenya Gazette Supplement No. 185). The 116-page regulatory framework operationalizes the Virtual Asset Service Providers Act of 2025, moving Kenya from a grey-market stance to one of the most structured digital asset regulatory regimes on the African continent.
The rules apply to crypto exchanges, peer-to-peer (P2P) platforms, custodian wallet providers, stablecoin issuers, and real-world asset (RWA) tokenization platforms. Existing digital asset businesses operate under a strict compliance deadline of November 4, 2026 to secure formal licensing.
Dual-Regulator Governance Model: CBK vs. CMA
The framework establishes a split-supervisory mandate between Kenya’s two primary financial regulators, dividing authority based on systemic risk and capital market function:
┌───────────────────────────────────────────────────────────────────────────┐
│ KENYA VASP SUPERVISORY MANDATE │
├───────────────────────────────┬───────────────────────────────────────────┤
│ Central Bank of Kenya (CBK) │ • Virtual asset-to-fiat conversion desk │
│ │ • Fiat-backed stablecoin issuers │
│ │ • Payment processor virtual integrations │
├───────────────────────────────┼───────────────────────────────────────────┤
│ Capital Markets Authority │ • Digital asset exchanges & trading desks │
│ (CMA) │ • Initial Coin Offerings (ICOs) │
│ │ • Real-World Asset (RWA) tokenization │
│ │ • Wallet custody & administration │
└───────────────────────────────┴───────────────────────────────────────────┘
Key Regulatory Pillars & Compliance Mandates
1. Extraterritorial Jurisdiction & Foreign Platform Reach
The regulations explicitly target offshore platforms. Any entity that actively markets to, generates economic benefit from, or derives revenue from users residing in Kenya falls within the regulatory perimeter—regardless of whether the company maintains a physical office in the country.
To operate legally, foreign-owned platforms must establish a locally incorporated company limited by shares, appoint local management, and obtain a formal compliance certificate.
2. Dedicated Stablecoin Framework
For the first time, Kenya introduces specific statutory controls for stablecoins:
-
Reserve Obligations: Issuers must maintain 1:1 reserve assets held in liquid accounts, subject to ongoing independent audits.
-
Redeemability & Interest Ban: Issuers are legally obligated to guarantee 1:1 fiat redemption and are strictly prohibited from paying yield or interest on stablecoin balances.
-
White Paper Mandate: Prior to issuance, detailed white papers covering asset backings, smart contract architecture, and redemption mechanisms must be approved by the CBK.
3. RWA Tokenization & Token Listing Diligence
The framework formally recognizes Real-World Asset (RWA) tokenization, establishing legal pathways for issuing on-chain representations of traditional assets like real estate, equities, and debt instruments.
Simultaneously, virtual asset exchanges must perform rigorous due diligence before listing any new token, assessing:
-
Smart contract security audit reports.
-
Liquidity profiles, token distribution, and insider concentration.
-
Anti-Money Laundering (AML) risk scores and underlying protocol governance.
Capital Thresholds, Governance & Cybersecurity Standards
To safeguard market integrity and protect retail participants, the regulations institute strict balance-sheet, security, and operational standards:
┌───────────────────────────────────────────────────────────────────────────┐
│ OPERATIONAL & CAPITAL THRESHOLDS │
├───────────────────────────────┬───────────────────────────────────────────┤
│ Minimum Paid-up Capital │ KES 50M (Payment Processors) up to │
│ │ KES 500M (~$3.9M) for Stablecoin Issuers │
├───────────────────────────────┼───────────────────────────────────────────┤
│ Board Governance │ At least 1/3 independent directors │
├───────────────────────────────┼───────────────────────────────────────────┤
│ Ownership Concentration Limit │ Max 33.3% individual voting/share control │
├───────────────────────────────┼───────────────────────────────────────────┤
│ Customer Fund Isolation │ Segregated daily into Kenyan bank accounts │
├───────────────────────────────┼───────────────────────────────────────────┤
│ Record Retention & Audits │ 7-year transaction logs; mandatory annual │
│ │ third-party penetration testing │
└───────────────────────────────┴───────────────────────────────────────────┘
Market Conduct & Anti-Abuse Standards
The framework aligns digital asset market conduct with traditional capital markets securities law:
-
Prohibited Practices: Explicit statutory bans on insider trading, market manipulation, front-running, false trading, churning, and misleading price signaling.
-
Advertising Disclosures: Crypto advertisements must prominently feature standardized risk disclaimers, explain volatility, and avoid promising guaranteed investment returns.
-
Incident Reporting: Licensees must report cybersecurity breaches, operational outages, and fraud attempts to regulators on a monthly basis.
Strategic Takeaway
With over $19 billion in on-chain transaction volume recorded between 2024 and 2025, Kenya represents one of Africa’s largest digital asset hubs. By gazetting the VASP Regulations, 2026, Kenya transitions from informal crypto adoption to a institutionalized, compliance-first market.
While compliance costs—ranging from capital reserves to local entity setup—will likely consolidate smaller operators, the framework provides the regulatory certainty required for traditional financial institutions, institutional custodians, and global exchanges to operate legally within East Africa.
