Kenya's VASP Act: a technology checklist for exchanges and brokers

Kenya’s Virtual Asset Service Providers Act, 2025 came into force on 4 November 2025. Section 47 gives any business already providing virtual asset services one year from that date to comply, which Kenyan law firms such as Oraro & Company Advocates read as 4 November 2026; we found no regulator statement giving the exact date. Complying includes holding a licence: section 8(2) bars anyone from carrying on virtual asset business in or from Kenya without one.

The Capital Markets Authority (CMA) licenses exchanges and brokers. The Central Bank of Kenya (CBK) licenses custodial wallet providers, payment processors and stablecoin issuers. Licensing could only start once the regulations were issued, on 22 July 2026, which left existing operators about three and a half months to file.

This article maps what the Act and the 2026 Regulations ask your systems to show to the control that delivers it, the evidence an assessor can open and the person who owns it. It is a technical reading, not legal advice. Section numbers refer to the Act (No. 20 of 2025) and regulation numbers to the Virtual Asset Service Providers Regulations, 2026 (Legal Notice 134 of 2026), both on Kenya Law.

What are the key dates?

Date	What happened
15 October 2025	The President assents to the Act
21 October 2025	The Act is published in Kenya Gazette Supplement No. 173
4 November 2025	The Act commences
18 November 2025	CBK and CMA say licensing will start once regulations are issued, and that they have licensed no VASPs
March to 10 April 2026	Public consultation on draft regulations
22 July 2026	The Regulations are gazetted and commence
4 November 2026	The one-year transition in section 47 ends, as Kenyan law firms read it; confirm the cutoff with counsel

What if the deadline has passed?

The Act says nothing about an application still pending when the year runs out. When we last checked, on 31 October 2026, we found no regulator notice on that point and no extension on the CBK’s site or in the press. The CMA’s website did not load that day, so we could not check it directly.

Carrying on business without a licence is an offence (section 8(3)). Section 40(3) sets fines of up to KES 25 million for a company, and for an individual a fine of up to KES 10 million, up to five years in prison, or both; section 41 extends liability to directors and senior officers who knowingly authorised the offence. What you may do from 5 November is a question for your counsel this week.

The engineering question is whether your file is complete. Regulation 6(4) gives the regulator 30 days to decide, but only after it has every required document and has finished its due diligence.

Which regulator licenses your business: CMA or CBK?

The First Schedule to the Act assigns each activity to a regulator. The Regulations set fees in their First Schedule and capital in their Fifth.

Activity	Regulator	Paid-up capital	Liquid capital (higher of)	Application / licence fee
Virtual asset exchange	CMA	KES 100 million	KES 20 million or 8% of total liabilities	KES 100,000 / 1,000,000
Virtual asset broker	CMA	KES 10 million	KES 2 million or 8% of total liabilities	KES 100,000 / 100,000
Custodial wallet provider	CBK	KES 150 million	KES 30 million or 100% of current liabilities for 30 days	KES 100,000 / 500,000
Payment processor	CBK	KES 10 million	100% of current liabilities for 30 days	KES 100,000 / 200,000

At the CBK’s rate of KES 129.95 to the dollar on 30 October 2026, KES 100 million is about USD 770,000. A licensee with several activities holds the capital of the highest category plus 50% of each additional one (regulation 85(6)), and shareholder loans do not count (85(5)).

These are working classifications, not regulator rulings; counsel should map the services you actually provide:

• Order book or instant buy and sell platform: exchange, CMA.
• Executing client orders through other exchanges: broker, CMA.
• OTC desk: the Act has no dealer category, so counsel maps it to broker, exchange or both. Regulation 35 puts client orders ahead of your own, and regulation 37 makes you report trades done away from a licensed exchange.
• Holding customers’ keys: custodial wallet provider, CBK. Ask whether the custody inside your exchange needs its own CBK licence; if it does, capital is KES 150 million plus half of KES 100 million, so KES 200 million.
• Converting virtual assets to or from foreign currency: a separate CBK authorisation (regulation 14).

The same texts require a physical office in Kenya (section 19), accounts at a bank licensed in Kenya (regulation 104(1)), a chief executive domiciled in Kenya (regulation 44), a compliance officer (regulation 39) and a chief information security officer or equivalent (regulation 96(3)).

What does the application ask about your systems?

Regulation 6(2) lists the package. The technical items are:

• a description of the systems and controls (6(2)(e));
• a cybersecurity and IT policy, and a business continuity and disaster recovery plan (6(2)(f));
• copies of contracts and oversight arrangements (6(2)(g)), which we would read as including hosting and software vendors;
• an independent information systems audit report, including a vulnerability assessment and penetration test, by a qualified person (6(2)(l));
• business rules, for exchanges and wallet providers (6(2)(n), regulation 20);
• evidence of market integrity controls (6(2)(o)).

Book the systems audit first. The text requires it to be independent; we would have it test the system you will actually run, and would not rely on a vendor’s report on its own product.

Two listing rules matter to exchanges. Regulation 33 requires documented due diligence before an asset is admitted and monitoring afterwards. Regulation 60(6) bars an exchange from listing a stablecoin unless the CBK has approved it and a licensed issuer issues it. If your markets quote in USDT or USDC, ask counsel how that applies to them.

What controls and evidence will an assessor look for?

The first column is the legal requirement, paraphrased, with its citation. The control and evidence columns are our implementation recommendation, drawn from building and running exchange, wallet and custody software at the EX5 exchange since 2024 and from technical files we have prepared in several markets. They are not legal requirements.

Requirement (citation)	Control in the platform	Evidence	Owner
Protect and segregate client assets (s. 31); wallet providers also have specific rules on separate addresses and ledger accounts, no lending or pledging, and omnibus only with consent (reg. 66(1)(a)–(g))	Separate client and house wallets; double-entry ledger with distinct accounts; per-client sub-ledger behind omnibus wallets	Wallet map; chart of accounts; consent wording	CTO, finance
Holdings match client claims; wallet providers reconcile on-chain holdings monthly and make the records available to the CBK by the 10th (reg. 66(1)(d), 104(2), 107(3))	Automated reconciliation per asset and per client; breaks raised, not hidden	Monthly reports; exception log with resolutions	Treasury
Reliable key security, hot and cold storage (reg. 105)	Hot, warm and cold tiers; M-of-N approvals with hardware keys; whitelists and delays	Key management policy, ceremony records, approval logs	CISO
Wallet providers: register of positions; statements at least quarterly and on request (reg. 66(1)(l)–(m))	Statement generator: asset, balance, value, transfers	Sample statement; register export	Operations
Transaction records for seven years, with wallet addresses, chain identifiers and interaction logs (s. 44(2); reg. 22)	Append-only store with chain ID, address, hash and session logs	Retention policy; sample export; archive restore test	CTO
Real-time read-only access for the regulator on request (s. 44(1))	Read-only regulator role or reporting replica, logged	Design note; access log	CTO, compliance
Audit trail that reconstructs all transactions, protected from tampering (reg. 26(1), 97(4)(b))	Tamper-evident log of every money action and settings change	Log export; integrity check	CISO
Vulnerability assessment and penetration test “bi-annual” in the first licensed year, then at least yearly (reg. 97(4)(a)); plan for twice in year one and confirm the wording with the regulator	Test calendar; remediation tracker	Reports; remediation status	CISO
Cyber incidents, key loss or unauthorised transactions reported within 24 hours; detailed report within five working days (reg. 99; also s. 25)	Alerting, incident classes, on-call, notification template	Response plan; incident register; drill record	CISO, CEO
Board-approved continuity and incident plans with recovery time objectives, tested yearly (reg. 21)	Encrypted backups, standby site, restore drills on clean hardware	Board resolution; timed drill report	CTO
Monthly reports by the 10th on volumes, values, geography, fraud, outages, complaints (reg. 26(2)); exchanges add trading data and listings (reg. 60(5), 93)	Reports generated from the ledger and registers	Templates; generated samples	Compliance
Market abuse prevention, surveillance, approved business rules (s. 24(n); reg. 20, 112)	Self-trade prevention; surveillance alerts; client and proprietary order flags	Alerts; case log; rules	Compliance
Due diligence before onboarding (reg. 32); no mixers or anonymity-enhancing services (s. 21)	KYC before any deposit; address screening	Decision logs; screening hits	MLRO
Outsourcing approved 30 days ahead; regulator can supervise the provider (reg. 113)	Third-party register: hosting, KYC, nodes, software vendor	Register; contracts with access clause	CEO
Complaints register; progress update within 21 days (reg. 110)	Ticketing with timers	Register export	Support lead

Section 44(2) keeps the records at your principal place of business, and section 10(6)(h) asks for premises or data solutions the regulator deems suitable; neither, on its own, is a blanket local-server rule. If a vendor hosts your platform abroad, ask counsel how those provisions and the outsourcing rule fit together.

What does the law not spell out?

These are general good practice, not Kenyan requirements we could cite:

• Travel rule data. We found no Kenyan text setting travel rule fields. Section 24(e) requires “the full range” of AML measures, so capture originator and beneficiary data in the form FATF Recommendation 16 describes, and ask counsel what the Financial Reporting Centre expects.
• Proof of reserves. A signed export of liabilities against on-chain balances lets an auditor check your reconciliation independently. On its own it does not prove that liabilities are complete, assets unencumbered or the business solvent.
• Two KYC providers, or a documented fallback.
• Restore drills on new hardware, not only backup success messages.

Where do existing stacks fall short?

The gaps we see most often when writing technical files:

• One hot wallet holds house and client funds, where regulation 66(1)(b) wants wallet providers to use separate addresses.
• Trades live in a Telegram bot or CRM that cannot give chain metadata for seven years.
• The only way to show the regulator data is the admin panel.
• Monthly reports are assembled by hand.
• No independent penetration test has ever been run.
• The hosting vendor has not agreed to a regulator access clause.

What should an operator do now?

1. Settle your position with counsel: operate, restrict onboarding or pause from 5 November, and what to tell customers.
2. Complete the file. A complete application, not a placeholder.
3. Book the independent systems audit if you lack one.
4. Separate wallets and run one monthly reconciliation before anyone asks.
5. Fix retention and read-only access.
6. Start outsourcing approvals, which need 30 days.
7. Rehearse an incident against the 24-hour limit.

If a step will not fit before review, say so in the file and give a date. A gap with a plan reads better than one the reviewer finds alone.

Kenya VASP Act FAQ

What is the deadline for existing crypto businesses in Kenya?

Section 47 gives businesses already operating one year from the Act’s commencement on 4 November 2025, which Kenyan law firms put at 4 November 2026. We found no extension as of 31 October 2026.

Who licenses crypto exchanges in Kenya, the CMA or the CBK?

The CMA licenses exchanges, brokers, advisers, managers and token offerings. The CBK licenses custodial wallet providers, payment processors and stablecoin issuers.

How much capital does a crypto exchange licence in Kenya require?

KES 100 million paid-up, and separately a liquid-capital test of KES 20 million or 8% of total liabilities, whichever is higher.

Do foreign exchanges serving Kenyans need a licence?

Regulation 4(2) treats a business as operating in or from Kenya if it targets Kenyan consumers or earns income from Kenya, even with no presence there. A licensee must be a Kenyan company or a foreign company registered in Kenya (section 8(1)).

How long is a Kenyan VASP licence valid?

Until 31 December of the year it is issued (section 13). Renewal applications go in at least two months before expiry (regulation 11).

Does licence-ready software make an exchange compliant?

No. Software provides controls and evidence; compliance depends on your company, people and conduct, and the regulator decides.

How BitPolaris helps

BitPolaris builds the exchange, wallet and custody software that has run in production at the EX5 exchange since 2024. Self-hosted, the keys stay on your servers; it is software, not a custodian or a licence. Custody adds hot, warm and cold tiers, M-of-N approvals with hardware keys, whitelists and delays, ledger-against-chain reconciliation around the clock, proof-of-reserves exports and an exportable log of every operator action. Our cloud option runs on EU servers, so in Kenya assess it as outsourcing under regulation 113 and against data-protection and cross-border transfer rules.

The Licence Technical Pack covers the documentation side:

Item	Price excl. VAT (31 October 2026)	What you get
Lite	€1,250 one-time	For platform customers: standard sections, your regime noted
Pro	€6,300 one-time	Section by section to one regime, your diagrams, third-party register, recorded restore drill; 50% credited against a platform licence within six months
Regulator Q&A	€1,450 a month	Engineer answers to technical questions during review

Pro maps MiCA, the Central Bank of Armenia, SPK and VARA as standard. Kenya is not on that list yet, so a Kenya scope has to be agreed with us before you buy. A first draft takes two weeks from the scoping call. Background: what regulators ask for and MPC vs multisig.

We are not a law firm and do not file applications; your counsel does. The pack describes controls but is not an audit, so it cannot replace the independent systems audit in regulation 6(2)(l). Installing our software does not make anyone compliant or licensed.

Sources

• Virtual Asset Service Providers Act, 2025 (No. 20 of 2025), Kenya Law
• Kenya Gazette Supplement No. 173 (Acts No. 20), 21 October 2025, copy hosted by the CMA
• Virtual Asset Service Providers Regulations, 2026 (Legal Notice 134 of 2026), Kenya Law
• Central Bank of Kenya and Capital Markets Authority, Public notice on the commencement of the Act, 18 November 2025
• National Treasury, Public notice on the draft Regulations, March 2026
• Oraro & Company Advocates, Virtual Asset Service Providers Regulations, 2026, August 2026
• Central Bank of Kenya, daily KES exchange rates, 30 October 2026