TL;DR — Kenya just opened a real regulated path
For nearly a decade Kenyan banks were told not to touch crypto — Central Bank of Kenya Banking Circular No. 14 of 2015 kept the sector on the wrong side of the correspondent-banking line. That posture has now inverted.
The Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025) commenced on 4 November 2025. Its implementing VASP Regulations, 2026 (Legal Notice No. 134) were gazetted on 24 July 2026. In under a year Kenya moved from a soft ban to a fully articulated, FATF-recognised licensing regime — and, in FATF's own words, the framework is credited as action-plan progress rather than counted as a gap.
For any bank looking at digital assets in Kenya, four facts define the shape of the opportunity:
- ✓ Two regulators, one market. Ten licensable activities are split between the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) by function — the sharpest structural divergence from EU MiCA's one-competent-authority model.
- ✓ Stablecoins are CBK territory. A dedicated stablecoin issuer licence sits with the payments regulator, with substantive rules that map almost one-to-one onto MiCA's EMT regime (full backing, at-par redemption, no interest, bankruptcy-remote reserves).
- ✓ Tokenised deposits stay in the banking perimeter. No bespoke rule yet — but by analogy to the Banking Act, an on-balance-sheet tokenised KES deposit most plausibly remains a deposit product, not a virtual asset. That is a structural gift to banks the market has not yet priced in.
- ✓ Bank direct vs subsidiary is the pivotal question. The Act does not bar a bank from holding a VASP licence, but s.11(k) requires a 'no-objection' from the existing regulator. Practical route is almost certainly a ring-fenced subsidiary — confirm early.
The comparative context (Kenya vs Mauritius, South Africa, Nigeria and MiCA) is set out in our Africa crypto regulatory landscape 2026. This piece is the Kenya deep-dive.
From Banking Circular 14 (2015) to LN 134 (2026)
Kenya's posture inverted in under a decade. The sequencing matters for anyone building a supervisory narrative for CBK or CMA — the regulator is aware that the 2015 posture is being deliberately replaced, and expects to see that acknowledged in an applicant's approach.
December 2015 — CBK Public Notice on virtual currencies. Bitcoin and similar products declared not legal tender and unregulated; via Banking Circular No. 14 of 2015 (as reported), banks were instructed not to open accounts for, or transact with, persons dealing in virtual currencies. The sector was effectively cut off from the banking system for the best part of a decade.
December 2024 — National Treasury Draft National Policy on Virtual Assets and VASPs. First formal government-level acknowledgement that a licensing regime, not a prohibition, was the direction of travel.
15 October 2025 — VASP Act 2025 assented, gazetted 21 October 2025, commenced 4 November 2025.
24 July 2026 — VASP Regulations 2026 gazetted as Kenya Gazette Supplement No. 185, Legal Notice No. 134. Kenya cut most capital thresholds sharply between the March 2026 draft and the July gazettal after industry pushback — a signal that the drafting was iterative and that the regulator is capable of listening.
The 2015 prohibition is superseded by statute rather than by an express repeal notice — a nuance counsel should note when drafting the applicant narrative.
The VASP Act 2025 — scope, definitions and hard bans
A virtual asset is a digital representation of value that can be digitally traded or transferred and used for payment or investment — excluding fiat currencies and securities and other regulated financial assets. The perimeter logic mirrors MiCA: crypto-assets that are already something else (a deposit, a security, a fund unit) remain under their traditional home regime and do not become a virtual asset because they sit on a ledger.
A VASP must be a company limited by shares registered under the Kenya Companies Act, or a registered foreign company. Natural persons are barred from promoting or issuing virtual-asset offerings (s.34(2)).
A stablecoin is defined in s.2 as a virtual asset that aims to peg its value to one or more reserve assets — fiat, commodities, or other virtual assets. There is no separate EMT/ART split as in MiCA (see Section 6 below).
The Act also imposes hard prohibitions familiar from FATF guidance: mixers, tumblers and other anonymity-enhancing services are banned, and unlicensed operation is a criminal offence — penalties reported up to 5 years imprisonment for individuals and fines up to KES 10 million for companies (verify penalty schedule against Act text before quoting).
The dual-regulator architecture — CBK vs CMA
Section 10 designates both CBK and CMA as regulatory authorities; s.6(1)(a) grants both the power to license VASPs. The Act's First Schedule allocates ten licensable activities by function.
The practical consequence — and the sharpest structural divergence from the EU model — is that a business which combines exchange (CMA) with custody and fiat on/off-ramps (CBK) needs parallel licences from both regulators. There is no single 'CASP' authorisation, and no equivalent of MiCA's passport. The Act contemplates the two authorities jointly preparing market-entry rules — a coordinated framework, not a unified one.
| Licensable activity (First Schedule) | Regulator | MiCA / EMD analogue |
|---|---|---|
| Custodial wallet / custody services (corporate & retail) | CBK | CASP: custody & administration |
| Transfer and conversion services of virtual assets | CMA | CASP: transfer / exchange |
| Trading, clearing and settlement platforms (exchanges) | CMA | CASP: operation of trading platform |
| Payment gateway | CBK | PSD2 / e-money rails |
| Brokerage services | CMA | CASP: execution / RTO |
| Investment advisory services | CMA | CASP: advice |
| Virtual-asset management | CMA | CASP: portfolio management |
| Initial Coin Offering (ICO) | CMA | MiCA offer / white paper |
| Virtual-asset tokenisation | CMA | MiCA offer / ART (partial) |
| Stablecoin issuance | CBK | MiCA EMT / EMD e-money |
Rule of thumb: money-like and payments-like activities (custody, payments, stablecoins) sit with CBK. Market-like activities (trading, brokerage, advice, portfolio management, ICOs, tokenisation) sit with CMA. Full-stack offerings need both.
Capital thresholds, fees and the transition window
The 2026 Regulations set minimum paid-up capital by category. Between the March 2026 draft and the July 2026 gazettal, Kenya cut most thresholds sharply after industry pushback — a data point worth carrying into any conversation with CBK/CMA. Reported final figures (verify line-by-line against LN 134):
Fees are calibrated by activity — an exchange licence is reported at roughly KES 1M plus a KES 100K application fee, and an ICO/offering carries a 0.25% fee on successful offer value capped at KES 30M. A proposed per-transaction transaction levy was scrapped in the final draft, and a proposed 33.3% ownership cap was replaced by a lighter 10% shareholding notification threshold. Licences run annually, expiring 31 December.
Incumbents have a one-year transition window from commencement (i.e. from 4 November 2025) to achieve compliance. The precise filing deadline under LN 134 should be pulled from the primary text before you plan your timeline.
| Category | Draft (Mar 2026) | Final (Jul 2026) | Regulator |
|---|---|---|---|
| Stablecoin issuer | KES 500m | KES 300m | CBK |
| Wallet / custody provider | KES 150m | KES 150m | CBK |
| Exchange | KES 150m | KES 100m | CMA |
| Token-issuance platform | KES 200m | KES 20m | CMA |
| ICO | KES 200m | KES 20m | CMA |
| Virtual-asset manager | KES 30m | KES 20m | CMA |
| Tokenisation provider | KES 200m | KES 10m | CMA |
| Payment processor / gateway | KES 50m | KES 10m | CBK |
| Broker | KES 30m | KES 10m | CMA |
| Investment adviser | KES 2.5m | Nil (exempt) | CMA |
Stablecoin issuer licence — the CBK play
This is where Kenya's design is most interesting for a bank. The regime did not adopt MiCA's EMT/ART split. Instead a single 'stablecoin issuer' licence was created, placed with CBK (the monetary/payments authority, not the markets authority), and — through CBK's stated same function, same regulation approach — is treating fiat-pegged stablecoins with the same economic logic as Kenya's existing e-money regime. CBK's Director of Banking and Payment Services put it plainly in May 2026: if a token 'behaves like a payment system and a payment service, we'll try and regulate it as a payment service.'
The substantive rules map almost one-to-one onto MiCA's EMT requirements:
Two divergences matter for a bank. First, Kenya opens EMT-style issuance to any licensed stablecoin issuer meeting the capital test — arguably more permissive for a non-bank issuer, but for a bank it simply confirms eligibility. Second, on foreign stablecoins (USDT, USDC), Kenya takes a market-access gate: an exchange may not list a stablecoin unless it is CBK-approved and issued by a licensed issuer. This creates real delisting risk for offshore dollar stablecoins on Kenyan venues — directly relevant if the bank plans to offer or custody them.
Boundary to watch: Kenya now has two overlapping money-like regimes — the E-Money Regulations 2013 (CBK) and the VASP stablecoin licence (CBK). A KES-pegged token could arguably sit in either. Because both are administered by CBK, the conflict is manageable — but the classification decision (e-money issuer vs stablecoin issuer) drives which rulebook, capital figure and reserve regime applies. Resolve this with CBK early, in writing.
| Dimension | Kenya (VASP Regs 2026) | MiCA EMT |
|---|---|---|
| Backing | Full 1:1 in eligible reserves; peg-currency matching | Full backing; 1:1 |
| Reserve location | ≥30% in segregated trust accounts at Kenyan banks; remainder low-risk, held in Kenya | Segregated, safeguarded; largely bank deposits + HQLA |
| Redemption | At par within two working days | At par, at any time |
| Interest to holders | Prohibited (broadly drafted) | Prohibited |
| Bankruptcy remoteness | Reserves legally separated / bankruptcy-remote | Reserve segregation on issuer insolvency |
| Issuer eligibility | Licensed stablecoin issuer (CBK), KES 300m capital | Credit institution or authorised EMI |
Tokenised deposits — the bank's quiet advantage
There is no Kenya-specific law, CBK guidance, or named sandbox project on tokenised commercial-bank deposits as of August 2026. The IMF's 2025 Technical Assistance Report on Kenya explicitly flags this classification gap and urges Kenya to clarify the perimeter.
In the absence of bespoke rules, the analysis proceeds by analogy — and here the EU precedent is directly instructive. A tokenised deposit — a bank liability representing an on-ledger, 1:1-redeemable claim on a KES deposit held on the bank's balance sheet — is economically deposit-taking, which is the exclusive preserve of institutions licensed under the Banking Act (Cap. 488) and supervised prudentially by CBK, with KDIC deposit-insurance overlay.
Just as in the EU (where a true tokenised deposit falls under CRD/CRR, not MiCA), such an instrument would most plausibly stay inside the banking perimeter rather than the VASP stablecoin regime. The critical line is structural: if the token is issued by a separate vehicle against segregated reserves rather than booked as an on-balance-sheet deposit liability, it risks being recast as a stablecoin (CBK VASP category) or as e-money.
For a bank, keeping a tokenised-deposit product on-balance-sheet is the way to preserve banking-law treatment — lighter incremental licensing, KDIC insurance overlay, ability to bear interest, and no MiCA-style stablecoin caps. There is no published safe harbour, so pre-engagement with CBK is prudent. But the design gift is real, and the market has not yet priced it in.
Can a bank hold a VASP licence directly?
This is the pivotal structuring question and the primary text gives a clear starting point but not a complete answer.
The Act does not prohibit a bank from holding a VASP licence. A licensee must be a company limited by shares (s.8(1)), which a bank is, and there is no express bar on deposit-taking institutions. Critically, s.11(k) requires an applicant that is already regulated elsewhere to obtain a 'no-objection' from its existing regulator — for a bank, that means CBK sign-off on the crypto activity. This is the Kenyan counterpart to MiCA Article 60, under which EU banks provide CASP services by notification to their competent authority.
What the Act does not settle is whether the bank may hold the licence on its own balance sheet or must ring-fence the activity in a subsidiary. No primary text resolves this.
- ✓ Banking Act consolidation. The Banking Act typically restricts banks from non-banking / trading business and forces ancillary financial businesses into CBK-approved subsidiaries.
- ✓ Client-asset segregation. The VASP Regulations' strong client-asset segregation and bankruptcy-remoteness requirements are cleanest to satisfy in a dedicated entity.
- ✓ Basel-style consolidated supervision. Prudential treatment of crypto-asset exposures for a Kenyan bank is not yet codified. Consolidated supervision points toward ring-fencing so that any prudential add-ons attach to the subsidiary rather than the bank.
The reasoned expectation — to be confirmed with CBK before any capital commitment — is that a ring-fenced VASP subsidiary is the practical (and likely required) route, secured with a formal s.11(k) no-objection early in the process. Map the intended product set to the CBK/CMA activity split up front, because a product suite spanning custody plus exchange plus fiat ramps will require parallel CBK and CMA licences even inside a single subsidiary.
POCAMLA, FATF grey list, and the Travel Rule
Kenya's AML/CFT baseline is the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), supervised by the Financial Reporting Centre (FRC). The AML (Amendment) Act 2023 overhauled POCAMLA and related statutes (beneficial ownership, thresholds, DNFBP scope) but did not itself bring VASPs into scope — VASPs were captured later, by the 2025 Act and 2026 Regulations, which impose CDD/KYC, transaction monitoring, 7-year record-keeping and regulatory reporting directly on licensees.
One open technical point: commentary suggests POCAMLA may still need a consequential amendment to formally list VASPs as FRC reporting institutions. Verify this before relying on VASP-to-FRC reporting flows. FATF Travel-Rule specifics (originator/beneficiary thresholds) should likewise be confirmed against LN 134.
On FATF status: Kenya was grey-listed in February 2024 and, as of the 13 February 2026 plenary, remains on the increased-monitoring list. The important nuance for a bank is that FATF's February 2026 statement expressly credits Kenya with 'adopting a legal framework for the licensing and supervision of virtual asset service providers' — the VASP Act is counted as progress, not a gap. Remaining action-plan items are broader (risk-based supervision, STR filing, TFS, NPO oversight). Practically, grey-list status means enhanced correspondent-bank due-diligence expectations persist, but the crypto framework is a completed FATF-recognised deliverable and exit is actively pursued.
Digital shilling status and the sandbox routing
No digital shilling. CBK issued a CBDC discussion paper in February 2022 and, after reviewing public comments (June 2023), concluded a CBDC is not a near-term priority — reasoning that Kenya's payment pain-points can be addressed by strengthening existing rails (M-Pesa, PesaLink). As of 2026 there is no digital shilling and no commitment to one. CBK's digital-money energy has instead gone into the VASP framework and, notably, into licensing private stablecoins — a deliberate policy choice to regulate private money rather than issue sovereign digital money. (Contrast Mauritius, which is piloting a retail Digital Rupee.)
Sandbox routing. The CMA Regulatory Sandbox (Policy Guidance Note 2019) is the established venue for live-testing capital-markets-classified crypto products (exchanges, tokenisation, ICOs), and CMA has signalled openness to virtual-asset testing since 2021. On the CBK side there is no long-standing formally constituted sandbox — payments and stablecoin products would proceed via direct supervisory test-and-learn engagement under the payments and VASP framework. The routing mirrors the dual-regulator split: classify the product by economic function, then engage CBK (payments / e-money / stablecoin / custody) or apply to the CMA sandbox (markets), and finally seek the full VASP licence in the relevant category.
Five moves before you commit capital
For a bank building a Kenya digital-assets strategy, these are the actionable steps in the order that matters — most decisive first:
- ✓ Map the product set to the CBK/CMA split first. The dual-regulator architecture is the defining feature of the regime. Before anything else, classify each intended product — custody, exchange, fiat ramps, stablecoin, advisory, tokenisation — and identify which requires CBK, which requires CMA, and which requires both. A full-stack offering will need parallel licences.
- ✓ Assume a ring-fenced VASP subsidiary and secure the s.11(k) no-objection early. The Banking Act treatment of ancillary financial businesses and the VASP Regulations' segregation and bankruptcy-remoteness requirements both point to a subsidiary. Confirm both with CBK before filing — this is the highest-priority open question and it determines the entire capital and governance structure.
- ✓ Treat stablecoins and tokenised deposits as different animals. A KES-pegged stablecoin sits in the CBK VASP stablecoin licence (KES 300M capital + reserve/redemption rules). A tokenised deposit kept on-balance-sheet most plausibly stays inside the Banking Act / CBK banking perimeter — lighter incremental licensing and the more natural fit for a bank. Preserve banking treatment by keeping the deposit product on-balance-sheet.
- ✓ Mind the foreign-stablecoin listing gate. If the strategy involves offering or custodying USDT/USDC, the CBK-approval listing requirement and the delisting risk on Kenyan venues must be built into product design — or the bank issues/uses an approved KES stablecoin instead.
- ✓ Use the sandbox route to de-risk. Live-test market-side products in the CMA sandbox; engage CBK on payments/stablecoin products through direct supervisory dialogue. In both cases, a documented sandbox or test-and-learn outcome materially strengthens the eventual full-licence application.
What still needs to be confirmed with counsel
These are the points where the primary text is silent, sources conflict, or the fast-moving 2026 Regulations should be read line-by-line. Ranked by decision-weight for a bank.
- ✓ Bank direct vs subsidiary (highest priority). Confirm with CBK/CMA whether a bank may hold the VASP licence directly or must use a ring-fenced subsidiary, and the s.11(k) no-objection process in practice.
- ✓ Prudential / Basel capital treatment of crypto-asset exposures for a Kenyan bank — not yet codified. Confirm CBK's expected approach before dimensioning capital.
- ✓ Stablecoin vs e-money boundary. Clarify with CBK which regime (E-Money Regs 2013 vs VASP stablecoin licence) governs a KES-pegged token, and the definitive reserve/capital rules under LN 134.
- ✓ Final 2026 Regulation figures. Verify all per-category capital, fees, the ≥30% reserve rule and the redemption window against Kenya Gazette Supplement No. 185 / Legal Notice No. 134 — some outlets still quote higher draft figures.
- ✓ POCAMLA reporting status of VASPs and the express FATF Travel-Rule provision — confirm whether a consequential POCAMLA amendment is still needed for VASP-to-FRC reporting.
- ✓ Transitional filing deadline for incumbents under LN 134 (the Act gives a one-year window from 4 November 2025). Pull the precise date from the gazetted text before planning applications.
If you are structuring a Kenya footprint — whether as a Kenyan bank building the subsidiary, a foreign bank routing through a local subsidiary, or an EMI/PSP evaluating whether to lead with Kenya or Mauritius — we regularly walk through exactly these questions. Happy to trade notes on your specific perimeter.
Primary sources
Kenya — primary: Virtual Asset Service Providers Act 2025 (Kenya Law) · CBK Public Notice on VASP Act commencement · National Treasury: Draft National Policy on VAs and VASPs · Draft VASP Regulations 2026 · CBK E-Money Regulations 2013 · National Payment System Act 2011 · CBK CBDC Discussion Paper (2022) · CBK Public Notice on virtual currencies (December 2015) · AML (Amendment) Act 2023 · IMF Technical Assistance Report: Kenya Crypto Regulation (2025)
Analysis and 2026 Regulations detail: TechCabal: Kenya gazettes VASP Regulations 2026 · Business Daily: Treasury cuts crypto capital limits · The Star: stablecoin backing / reserve / redemption / capital · TechCabal: offshore stablecoin delisting risk · TechTrends KE: CBK/CMA stablecoin direction · Global Law Experts: VASP Act 2025 explainer · Cliffe Dekker Hofmeyr: VASP Act 2025 alert
FATF and regional: FATF Jurisdictions under Increased Monitoring (February 2026) · ESAAMLG Fintech First Follow-Up Report (September 2025)