Virtual Asset Service Providers Act, 2025

The Virtual Asset Service Providers Act, No. 20 of 2025, assented to on 15 October 2025 and in force from 4 November 2025, is Kenya's first dedicated statute for the regulation of virtual assets and virtual asset service providers (VASPs). It creates a comprehensive licensing and supervision framework for the digital-asset sector, replacing the prior position in which crypto activity sat largely outside formal regulation, and it aims to manage money-laundering, terrorism-financing and proliferation-financing risks, mitigate financial and systemic risks, protect consumers, and support investment and innovation in the digital-asset market. The Act adopts a dual-regulator model: it designates the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) (and any future regulator that may be established) to license, supervise and regulate VASPs, and it allocates permissible activities between them, with the CBK responsible for activities such as the issuance of virtual assets and stablecoins and payment-related services, and the CMA responsible for exchanges, custody and investment-type activities. The Act requires VASPs to be licensed before offering services in Kenya, sets fit-and-proper, governance, capital and operational requirements, and imposes obligations on AML/CFT compliance, consumer protection, disclosure, cybersecurity, custody and the safeguarding of client assets. It provides for ongoing supervision, reporting and inspection, and for enforcement through penalties, directions and the suspension or revocation of licences. At the time of drafting, the Cabinet Secretary for the National Treasury, in consultation with the CBK and CMA, was developing subsidiary regulations to prescribe licence types, forms and fees and to facilitate implementation, so detailed operational rules will follow. As the statutory foundation for Kenya's digital-asset regime, the Act brings crypto-asset businesses within the financial regulators' perimeter and is a significant addition to the country's fintech regulation.

1. 1Kenya's first dedicated statute licensing and regulating virtual assets and VASPs
2. 2Dual-regulator model: CBK (issuance/stablecoins/payments) and CMA (exchanges, custody, investment activities)
3. 3Mandatory licensing before offering virtual-asset services, with fit-and-proper, governance, capital and operational requirements
4. 4AML/CFT, consumer-protection, disclosure, cybersecurity and client-asset safeguarding obligations
5. 5Supervision, reporting and inspection, with penalties, directions and suspension/revocation
6. 6Subsidiary regulations on licence types, forms and fees under development at time of drafting