Is Your Crypto Exchange Licensed In Kenya? The VASP Act Explained (2026)
Kenya went from "unregulated" to "licensed" in twelve months
For years the honest answer to "is my crypto exchange regulated in Kenya?" was no. Cryptocurrency was not illegal, but nobody was licensing the platforms, and the Central Bank of Kenya's position was simply that virtual currencies are not legal tender and that if your platform failed, you had no recourse.
That changed with the Virtual Asset Service Providers Act, 2025 — Act No. 20 of 2025. It was gazetted on 21 October 2025 and came into force on 4 November 2025. For the first time, running a crypto exchange, a custodial wallet, or a virtual asset brokerage in or from Kenya is a licensed activity, and doing it without a licence is a criminal offence.
The practical deadline for the industry is 4 November 2026 — about two months from now. This article explains what the law actually requires, what it will and will not do for you as a customer, and the one check you can do today before you send money to any platform.
If you are still deciding whether to hold crypto at all, start with our plain guide to whether crypto is legal in Kenya and the practical mechanics of buying USDT in Kenya.
Who regulates what: CBK or CMA
The Act designates two regulators, and splits the work between them according to the list of services in the First Schedule. This split matters, because the right place to complain depends on which one licenses your platform.
The Capital Markets Authority (CMA) takes the investment side: virtual asset exchanges and trading platforms, brokers, virtual asset investment advisers, virtual asset managers, initial coin offering providers, tokenisation of real-world assets, and token issuance platforms. If you buy and sell coins on a platform, the CMA is your regulator.
The Central Bank of Kenya (CBK) takes the money-movement side: custodial wallet providers, virtual asset payment processors and gateways, and stablecoin issuers. If a business holds your coins for you or converts crypto to shillings as a payment service, CBK is in the frame.
A single business can easily fall on both sides. An exchange that also runs a custodial wallet and lets merchants accept crypto payments needs more than one licence and will deal with both regulators. That is one reason licensing has been slow.
The CMA already runs this kind of regime for currency trading — see our guide to CMA-licensed forex brokers in Kenya and whether forex trading is legal in Kenya. The virtual asset regime is being built on the same logic.
The rules only became workable in July 2026
The Act was in force from November 2025, but it could not be used. In their joint public notice of 18 November 2025, CBK and CMA said plainly that licensing would only begin once the Cabinet Secretary for the National Treasury issued Regulations, and that at that date they had not licensed a single VASP to operate in or from Kenya.
The Treasury published draft Regulations for public comment on 18 March 2026, with comments closing on 10 April 2026. The final Virtual Asset Service Providers Regulations, 2026 were gazetted on 22 July 2026.
Those Regulations set the capital a licensed firm must hold. As reported by law firms reviewing the gazetted text, the minimums are substantial: KES 100 million for an exchange, KES 150 million for a wallet provider, KES 300 million for a stablecoin issuer, KES 20 million for a virtual asset manager or a tokenisation provider, and KES 10 million for a broker, payment processor, ICO provider or token issuance platform. Application fees are reported in the KES 10,000 to KES 100,000 range, with licence fees from KES 50,000 up to KES 2 million.
Read those numbers as a consumer, not as a founder. A KES 100 million capital floor is a deliberate filter. Most of the small platforms, Telegram "trading desks" and WhatsApp P2P operations Kenyans currently use will never meet it. Some will apply, some will quietly exit, and some will keep operating illegally and hope nobody notices.
What happens on 4 November 2026
Section 47 of the Act gives anyone who was already providing virtual asset services one year from commencement to comply. Commencement was 4 November 2025, so the date is 4 November 2026.
You will see six-month and other figures quoted online. They are wrong; the Act says one year, and that is what governs.
After that date, operating without a licence bites. Section 8(3) makes it an offence to provide virtual asset services without a licence, and section 40(3) sets the penalty: an individual faces a fine of up to KES 10 million, imprisonment for up to five years, or both. A body corporate faces a fine of up to KES 25 million.
For you as a customer, the risk is not prosecution — it is disruption. A platform that misses the deadline may be blocked from Kenyan payment rails, may lose its bank and M-Pesa connections, or may simply stop serving Kenyan users at short notice while your balance is still sitting on it.
The check you can run today
Here is the single most useful thing in this article, and it is a fact you can verify yourself in two minutes.
The CMA publishes its licensee register at licensees.cma.or.ke. As at 6 September 2026 that register offers twenty searchable categories — stockbrokers, investment banks, fund managers, dealing and non-dealing online foreign exchange brokers, REIT managers, collective investment schemes and so on. There is no virtual asset, VASP or crypto category on it at all.
Combine that with CBK and CMA's own statement that no VASP had been licensed, and the conclusion is uncomfortable but clear: as things stand, no platform can honestly tell you it holds a Kenyan virtual asset licence. If a platform's marketing says it is "licensed in Kenya", "CMA regulated" or "CBK approved" for crypto today, treat that as a red flag rather than reassurance. It may hold a licence somewhere else entirely — Seychelles, Mauritius, Lithuania — which is a very different thing from being answerable to a Kenyan regulator for your money.
This will change, possibly within weeks. So the check to build into your habits is: search the regulator's own register for the platform's name, and ask which category and which regulator. Do not accept a screenshot, a certificate image, or a licence number you cannot look up. The same discipline applies to lending apps — see how to spot an unlicensed loan app in Kenya — and to the tactics in our guide to forex and crypto scams in Kenya.
What a licence will actually buy you
Once licences start being issued, the Act gives licensed customers real protections that unlicensed platforms simply do not owe you.
Your coins must be kept separate from the company's. Section 31 requires a provider to hold enough virtual assets in custody to cover what it owes clients, to segregate client holdings from its own, and to keep client assets out of reach of the company's creditors. This is the provision that matters most in a collapse — it is designed to stop a failing exchange from spending customer coins to pay its own bills. The same principle governs money held with a broker, which we cover in how client money works with a forex broker or crypto exchange. The 2026 Regulations reinforce it by barring licensees from lending, pledging or otherwise encumbering customer assets, and by requiring regular reconciliation of holdings and statements to customers.
Advertising has to be honest. Section 24(j) requires promotional material to be fair, accurate, identifiable, transparent and not misleading. The "guaranteed 20% monthly returns" school of Kenyan crypto marketing becomes a licence problem, not just a moral one.
There has to be somewhere to complain. Section 24(l) requires a licensee to have a mechanism for handling customer complaints, and the Regulations require clear disclosure of licence status, fees, risks and complaint procedures at the point of service. Today, if a platform ignores your withdrawal ticket, you have no regulator to escalate to. That is precisely what changes.
What a licence will not protect you from
Be clear-eyed about the limits, because this is where people get hurt.
A licence is not deposit insurance. The Kenya Deposit Insurance Corporation covers KES 500,000 per depositor per bank — see KDIC deposit insurance explained. There is no equivalent for crypto. If a licensed exchange fails, segregation is supposed to mean your coins are still yours, but there is no compensation fund topping you up.
A licence does not make the asset safe. Bitcoin can halve while sitting in a fully licensed, fully compliant, perfectly segregated wallet. Regulation addresses the platform's conduct, not the price. Even so-called safe assets carry issuer risk — read stablecoins explained before assuming a dollar token is a dollar.
A licence does not defend your own keys. Most Kenyan crypto losses are not exchange failures; they are SIM swaps, phishing links and shared seed phrases. Our guide to crypto wallet security in Kenya covers the practical defences, and self-custody stays outside the licensing regime entirely — no regulator can recover a seed phrase you gave away.
Tax is separate, and you must check it. The VASP Act is licensing law, not tax law. Kenya's treatment of digital-asset gains and trading income has been amended repeatedly, and the figures circulating online contradict each other. We will not quote a rate we cannot source to the KRA. Confirm the current position directly with the Kenya Revenue Authority or a tax adviser before you file, and keep a full record of every trade — dates, amounts, shilling values and fees. If you are working out gains on other assets, our capital gains tax calculator covers the conventional cases.
Practical steps between now and November
Do not keep more on any platform than you can afford to lose access to for months. Withdraw balances you are not actively trading to a wallet you control.
Write down where your assets actually are. Which platform, which wallet, which recovery method. Households discover the hard way that nobody else can reach these — a problem we cover in what happens to your money when you die.
Export your transaction history now, while you can still log in. If a platform exits the Kenyan market, that export becomes very hard to get and you will need it for tax.
Watch for the first licence announcements from CBK and CMA. When the registers open, move toward platforms that are actually on them. You can compare the options available to Kenyans on our crypto exchanges comparison page.
Ask, in writing, what your platform is doing about the deadline. A serious business will tell you whether it has applied and under which category. Silence is an answer too.
Frequently asked questions
Is crypto now legal in Kenya? Holding and trading virtual assets was never illegal, and still is not. What changed is that the businesses providing the service now need a licence from CBK or CMA. Virtual assets remain outside legal tender — the shilling is Kenya's only legal tender.
My exchange says it is licensed. How do I verify that? Ask which regulator, which licence category, and which licence number, then look it up on that regulator's own register — licensees.cma.or.ke for the CMA. If it cannot be found there, it is not a Kenyan licence. You can also email CMA at virtualassets@cma.or.ke or CBK at vasp@centralbank.go.ke to ask.
What happens to my coins if my platform is not licensed by 4 November 2026? The Act penalises the operator, not the customer. But an unlicensed platform may lose its Kenyan banking and mobile money connections or withdraw from the market, and getting funds out could become slow or impossible. Reduce your exposure before the deadline rather than after it.
Does the VASP Act cover a wallet I control myself? The regime licenses service providers — exchanges, custodians, brokers, payment processors, issuers. A non-custodial wallet where you alone hold the keys is not a licensed service, which also means no regulator can help you if you lose the keys.
What tax do I pay on crypto gains in Kenya? Kenya's digital-asset tax treatment has changed more than once and the figures circulating online conflict, so we will not state a rate here. Confirm the current position with the KRA or a qualified tax adviser, and keep complete records of every transaction.
Which regulator do I complain to? It depends on the service. Exchanges, brokers, advisers and token platforms sit with the CMA; custodial wallets, payment processors and stablecoin issuers sit with the CBK. Complain to the platform first and keep the reference, then escalate to the regulator that licenses that activity.
Reviewed 6 September 2026 against the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025), the joint CBK/CMA public notice of 18 November 2025, and the CMA licensee register as at the date of writing. Licensing is moving quickly — verify a platform's status on the regulator's own register before you act. This is general information, not financial advice.
