Kenya VASP Act and Draft Regulations 2026: What Crypto Businesses Should Do Now
Kenya’s Virtual Asset Service Providers framework is now a live legal and commercial issue for exchanges, wallet providers, token businesses, digital asset platforms, investors, and founders. With the VASP Act in place and draft regulations under consideration, businesses operating in or targeting Kenya should begin preparing now for licensing, governance, AML/CFT compliance, and regulatory engagement. The key question is no longer whether regulation is coming, but whether your business is ready for it. This article explains the current landscape, the likely compliance implications, and the practical steps virtual asset businesses should take now.
1. Why Kenya’s VASP framework matters now
Kenya has already signaled a clear policy direction: virtual asset activity is moving into a regulated perimeter. This is significant for both local startups and foreign operators seeking access to the Kenyan market. Once a sector enters a formal supervisory framework, businesses can no longer rely on informal operating models, fragmented governance, or offshore assumptions that are not aligned with Kenyan legal and regulatory expectations.
This means crypto businesses should begin reviewing their models now. Key questions include:
- What exact activity are you carrying on?
- Are you dealing with exchange services, custody, transfers, brokerage, issuance, or facilitation?
- Who controls the business, directly and indirectly?
- Where are customer assets held?
- What AML/CFT framework do you operate?
- What customer due diligence standards apply at onboarding, monitoring, escalation, and exit?
- How do you detect suspicious activity and preserve audit trails?
Those are legal and operational questions at the same time. Businesses that address them early will be better positioned than those that wait for a formal filing deadline.
2. Who may be affected by the VASP Act and Draft Regulations
Many applicants focus on the form. Regulators focus on substance.
A business may have an attractive product, a technically capable team, and investor support, but still fail a licensing review if its internal architecture is weak. In our experience, the real pressure points are usually:
Why licensing readiness matters before formal applications begin
- unclear ownership or control structures;
- poor segregation of roles and governance;
- limited AML/CFT documentation;
- insufficient transaction monitoring capability;
- inadequate compliance reporting lines;
- weak incident response and cybersecurity controls; and
- cross-border structures that do not map neatly onto Kenyan regulatory expectations.
That is why licensing preparation should be treated as a readiness project, not a filing exercise. The legal application must be matched by internal policies, board oversight, operational controls, reporting procedures, and documented accountability.
3. AML/CFT will be central, not peripheral
Virtual asset regulation is driven in large part by financial crime risk. For that reason, AML/CFT obligations will sit at the center of the compliance framework.
Businesses should expect scrutiny around customer identification, beneficial ownership verification, source of funds and source of wealth assessment where appropriate, sanctions screening, politically exposed person controls, transaction monitoring, suspicious transaction reporting, and record retention. The quality of the AML framework will often be one of the clearest indicators of whether a business is genuinely fit to operate.
This is especially important for firms that have historically treated compliance as a secondary function. That model does not scale in a regulated environment. Founders should instead view compliance architecture as part of market access and investor readiness.
4. What foreign crypto businesses entering Kenya should consider
One recurring issue in emerging businesses is overconcentration of authority in a founder or small product team. That may work in a very early-stage environment, but it becomes a problem once regulators assess accountability, reporting lines, and risk ownership.
A credible VASP operation should be able to show:
- clear legal ownership and control;
- a defensible governance structure;
- designated compliance responsibility;
- escalation pathways for incidents and suspicious activity;
- approval structures for higher-risk clients, products, and jurisdictions; and
- documented policies that are actually used in practice.
Investors should also care about this. A business with unclear governance may face licensing delays, onboarding friction with banks and partners, and reduced valuation confidence during due diligence.
5. What businesses should do during the public participation phase
A common mistake is assuming that a structure designed for one jurisdiction can simply be transplanted into Kenya. In reality, cross-border models often require careful legal mapping.
Questions arise around local presence, contractual structure, customer terms, data processing, outsourced functions, custody arrangements, complaint handling, financial crime controls, and regulatory touchpoints. In some cases, the issue is not just whether the business can legally operate, but whether its current operating model is persuasive to a Kenyan regulator, bank, institutional partner, or investor.
Cross-border scale should therefore be approached through structured legal alignment, not commercial ambition alone.
6. What businesses should do during the public participation phase
Businesses with exposure to virtual assets in Kenya should consider taking the following steps now:
- Map the exact services offered and identify the likely regulatory touchpoints.
- Review the current group and beneficial ownership structure.
- Assess whether governance, compliance, and reporting lines are fit for a regulated business.
- Update AML/CFT, KYC, sanctions, and monitoring controls.
- Review customer-facing documentation, including terms of use, disclosures, and privacy language.
- Assess outsourcing, custody, cybersecurity, and operational resilience arrangements.
- Prepare a licensing readiness file, even before a formal application is made.
These steps reduce future friction and help management make decisions with more clarity.
Conclusion
Kenya’s VASP framework is not just a legal development. It is a market-structuring event. Businesses that prepare early will be better positioned to secure licensing, engage financial institutions, attract investors, and operate with credibility. Businesses that treat regulation as an afterthought may find themselves reorganizing under pressure.
At S.N. Nyaga & Company Advocates, we advise fintechs, digital asset businesses, startups, and growth-stage enterprises on regulatory structuring, licensing readiness, compliance frameworks, legal documentation, and market entry strategy in Kenya.
Need help preparing for Kenya’s VASP framework?
S.N. Nyaga & Company Advocates advises crypto businesses, fintechs, startups, and investors on licensing readiness, regulatory structuring, AML/CFT compliance, public participation submissions, and market entry strategy in Kenya. Contact us to discuss your VASP licensing and compliance needs.
12. FAQ section
Frequently Asked Questions
Do crypto businesses need a licence in Kenya?
Businesses dealing in virtual asset services in or from Kenya should assess whether their activities fall within the VASP regulatory framework and prepare for licensing and compliance obligations.
What businesses may be covered by Kenya’s VASP framework?
Depending on the final regulations and regulatory interpretation, exchanges, wallet providers, custodial businesses, brokers, transfer platforms, and certain token-related businesses may be affected.
What should a crypto business do now?
It should map its services, review governance, strengthen AML/CFT controls, assess legal structure, review customer terms, and prepare for regulator engagement.
Can foreign crypto businesses operate in Kenya?
That depends on the structure, the services offered, the local regulatory position, and whether local licensing, approvals, or compliance arrangements are required.
