Kenya Gives Crypto Firms Days to Comply With New Licensing Rules

Crypto companies operating in Kenya have until November 4, 2026, to comply with the country’s new virtual asset licensing requirements or risk penalties for operating without regulatory approval.

The deadline marks the end of a one-year transition period under Kenya’s Virtual Asset Service Providers (VASP) Act, 2025. The law requires businesses offering regulated crypto services in or from the country to obtain licences from the relevant authorities.

The Kenya crypto licensing framework places responsibility for regulating the industry on the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA).

However, the transition period applies to businesses that were already providing virtual asset services when the law took effect on November 4, 2025. Companies that began operating after that date were not automatically covered by the grace period.

Kenya Crypto Licensing Deadline Approaches

Kenya introduced the VASP Act to establish a formal regulatory framework for cryptocurrency businesses and other virtual asset service providers.

The legislation took effect on November 4, 2025. However, the government initially delayed the start of licensing until the relevant implementation regulations were issued.

The National Treasury later published the Virtual Asset Service Providers Regulations, 2026, which provide further details on licensing applications, capital requirements and compliance obligations.

The final regulations were published in July 2026, allowing the licensing process to move forward.

Under Section 47 of the Act, existing virtual asset service providers were given one year from the commencement date to comply with the law. That period ends on November 4, 2026.

CBK and CMA to Oversee Crypto Licensing

Kenya has adopted a dual-regulator approach, with the CBK and CMA responsible for different categories of virtual asset services.

The Central Bank of Kenya will oversee payment-related services, including virtual asset payment processors, custodial wallet providers and stablecoin issuers.

Meanwhile, the Capital Markets Authority will regulate activities such as crypto exchanges, brokers, investment advisers, fund managers and virtual asset offering providers.

This division means that a crypto company may need to apply to the regulator responsible for the services it provides. Businesses operating across different regulated categories may also need to consider whether they require approvals from both authorities.

The framework is intended to bring more oversight to crypto-related financial activities while establishing clearer requirements for companies serving Kenyan customers.

What Crypto Businesses Must Do Before November 4

Companies covered by the transition period must meet the requirements of the VASP Act and its accompanying regulations.

The licensing process involves more than submitting an application. Businesses must satisfy requirements relating to their corporate structure, management, financial resources and internal controls.

Among the requirements are:

• Local corporate presence: Applicants must meet the applicable incorporation and local establishment requirements.
• Capital requirements: Businesses must demonstrate the required paid-up and liquid capital for their licence category.
• Management standards: Directors, senior officers and significant shareholders must meet fit-and-proper requirements.
• Anti-money laundering controls: Companies must establish procedures to prevent money laundering and terrorist financing.
• Cybersecurity: Applicants must demonstrate appropriate security systems and undergo independent information systems assessments.
• Operational policies: Businesses must provide policies covering data protection, complaints, business continuity and market conduct.

The regulations also require supporting documents, including business plans, financial information, proof of funding sources and relevant operational policies.

Penalties for Operating Without a Licence

Crypto businesses that continue providing regulated services without the required licence after the applicable deadline risk criminal penalties.

Under the VASP Act, an individual convicted of operating an unlicensed virtual asset business may face a fine of up to KES 10 million, imprisonment for up to five years, or both.

Companies may face fines of up to KES 25 million.

The law also creates potential liability for directors, partners and senior officers who knowingly authorise, permit or assist in an offence.

However, the treatment of businesses with pending licence applications remains an important concern. The law does not expressly state that submitting an application automatically allows a company to continue operating after the transition period expires.

As a result, operators should not assume that an application still under review gives them permission to continue providing regulated services.

You may also like : OPay IPO: Company Cancels $304M NYSE Listing Over Foreign Regulatory Inquiry

What Kenya’s New Rules Mean for the Crypto Industry

The new licensing framework could reshape Kenya’s cryptocurrency market by requiring businesses to meet more formal regulatory and operational standards.

For established exchanges, wallet providers and payment companies, compliance may involve additional costs, changes to internal processes and stronger financial controls.

Smaller operators could face greater pressure if they struggle to meet the capital, governance and technology requirements.

On the other hand, clearer rules could improve regulatory oversight and provide a more structured environment for businesses and customers.

Kenya is an important market for digital financial services, and its approach to crypto regulation could influence how other African countries develop their own virtual asset frameworks.

With November 4 approaching, the immediate priority for existing crypto businesses is to determine whether their activities fall under the Act and ensure they meet the applicable licensing requirements.