How to Register a Crypto Exchange or VASP Business in Kenya (VASP Act 2025 Guide)

Before the enactment of the Virtual Asset Service Providers Act, 2025, the legal status of crypto businesses in Kenya was uncertain. Such businesses operated without explicit prohibition or licensing, resulting in regulatory ambiguity. The Act, which was assented to on 15 October 2025 and commenced on 4 November 2025, together with its implementing regulations published in 2026, introduced Kenya's first comprehensive licensing framework for virtual asset businesses. Operating without a license is now expressly an offence under the Act.

This development provides legal certainty, which is essential for institutional clients, banking partners, and investors. However, obtaining a license requires substantive preparation. Applicants should focus on meeting regulatory examination standards rather than merely submitting an application. This guide outlines the categories of businesses requiring a license, regulatory expectations, preparation steps, and post-licensing obligations.

The Road Here: Why Regulation Arrived

Kenyan regulators have addressed the crypto sector incrementally, beginning with public cautions from the Central Bank in 2015, followed by the Capital Markets Authority's regulatory sandbox initiatives, and tax measures such as the 3% Digital Asset Tax introduced by the Finance Act 2023, later replaced by a 10% excise duty on VASP fees under the Finance Act 2025. These measures indicated that regulatory uncertainty was temporary. The VASP Act formally recognizes virtual assets as a regulated financial activity and requires platforms to obtain licenses. The Act should be viewed as establishing the legal foundation for virtual asset businesses in Kenya.

Who Needs a VASP License in Kenya?

The Act's licensing net is deliberately wide. If your business does any of the following for others, in or from Kenya, assume licensing applies until formal advice says otherwise:

• Operating a virtual asset exchange — order books, matching, conversion between virtual assets and fiat
• Providing custodial wallet services — holding clients' private keys, however the technology is dressed.
• Providing virtual asset transfer services — moving assets on behalf of others
• Brokering or dealing in virtual assets — acting as agent or principal for client trades
• Advisory or management services relating to virtual assets, where conducted as a business

Activities such as pure technology development, the provision of self-custody tools in which the provider does not hold private keys, and businesses transacting solely on their own account may fall outside the core licensing perimeter. However, it is essential to obtain a written legal opinion on perimeter questions before commencing operations. Additionally, a business may require multiple license categories depending on its service offerings. It is advisable to assess the full scope of intended services at the outset.

Who Regulates What: CBK and CMA?

The Act establishes co-regulation:

• Central Bank of Kenya (CBK) — the principal licensing authority for VASP activity: exchanges, custodians, transfer and dealing services.
• Capital Markets Authority (CMA) — token offerings and crypto assets with investment-contract characteristics, extending the approach already validated by Kenyan courts in the KeniCoin litigation, in which a token was treated as a security under the Capital Markets Act.

Where a business model includes both a platform and a token offering, it is necessary to engage with both the CBK and the CMA. Disclosure obligations under the CMA are more extensive than those required for a VASP license. Applicants should plan for both regulatory processes from the outset.

Eligibility: What Regulators Assess

The substance of any serious financial-services application in Kenya is consistent, and VASP applicants should build for it from day one:

• Kenyan establishment: a locally incorporated company (foreign founders are welcome as shareholders and directors) with genuine governance — resident decision-makers and fit-and-proper controllers. The CBK evaluates directors, significant shareholders, and senior officers for integrity, competence, and financial soundness. Full disclosure is required, as adverse findings will be identified during the assessment process. Non-disclosure or concealment of material information is grounds for refusal of an application. Concealment, not the finding, is what kills applications.
• Minimum capital: The Regulations specify minimum capital requirements for licensed VASPs. Applicants should ensure that funding meets the prescribed threshold and provides sufficient operating capital for at least twelve to eighteen months. A license granted without adequate capitalization may prove unsustainable in practice.
• A credible business plan: target market, volumes, revenue model, custody architecture, and how the model behaves in a drawdown. Examiners model your stress case themselves; be ahead of them.
• Compliance leadership: a designated compliance officer with actual authority, an MLRO for anti-money-laundering reporting, and documented policies your team can be examined against,t not shelf documents.

The Application Process, Step by Step

1. 1.The first step is to incorporate the company and establish its structure. This includes obtaining company PINs, ensuring sound governance, and maintaining transparent beneficial ownership. The use of opaque nominee arrangements is not acceptable under current beneficial ownership requirements.
2. 2. Build the compliance core before applying. AML/CFT risk assessment, customer due diligence, sanctions screening, transaction monitoring, the FATF travel rule, suspicious-transaction reporting to the Financial Reporting Centre (FRC), and record-keeping. Kenya's AML framework under POCAMLA applies in full.
3. 3. Register under the Data Protection Act, 2019. A VASP is a data controller and processor of concentrated KYC data; registration with the Office of the Data Protection Commissioner is a legal requirement and an examination point.
4. 4. Prepare the license application to the CBK with prescribed fees and supporting documentation: corporate, financial, technical (custody and cybersecurity architecture) and compliance.
5. 5. Answer interrogatories like a serious institution. Expect detailed questions and document requests; the quality and speed of responses set the tone for the entire examination.
6. 6. Receive the license with conditions and comply from day one. Conditions are enforceable; breaches are grounds for suspension or revocation.
7. 7 . Banking arrangements should be pursued concurrently with the licensing process. It is important to secure banking relationships at an early stage, as some Kenyan banks remain cautious due to FRC supervision. A clear payment infrastructure plan is essential for operational viability.

A realistic timeline from initial preparation to license receipt is approximately 6 to 12 months for a well-prepared applicant. Planning should be based on this timeframe.

The Licensing Business Plan: What Examiners Actually Read

Applications live or die on the business plan, and examiners read for specifics:

• Custody, technically described. Hot/cold wallet split, key management (multigeniture, HSMs, shard distribution), signing ceremonies, compromise scenarios and the incident runbook. "Industry best practice" is not an answer; an architecture is.
• Market and volumes. Who are your users, what volumes justify the capitalization, and what does the model do in a drawdown?
• Fiat rails: Identify the institutions that will hold client funds, the segregation methods, and the procedures for daily reconciliation. The absence of credible fiat arrangements may undermine the licensing application.
• The compliance operating model. Headcount, reporting lines, the MLRO's real authority, training cadence, alert triage.
• Honest risk disclosure. Pretending mark Risk disclosure: Applicants should provide a comprehensive assessment of market, custody, and counterparty risks. Understating these risks is viewed negatively by examiners, while thorough risk modelling is regarded favorably. Practical Checklist

Before filing, the following should exist, be board-adopted, and be executable by your team:

• Enterprise risk assessment (AML/CFT, sanctions, fraud, custody, cyber, market) on a defined review cycle
• Risk-tiered customer due diligence with enhanced due diligence for high-risk categories and periodic refresh
• Sanctions screening with blocking and reporting protocols
• Transaction monitoring calibrated to virtual-asset typologies: structuring, rapid layering, mixing exposure, dormant-wallet activation, with alert handling and STR workflows to the FRC.
• Travel rule implementation for transfers with counterparty VASPs: the operational work of exchanging originator and beneficiary data is consistently underestimated; build it into vendor selection early.
• Record-keeping for transactions, KYC and monitoring decisions for the prescribed retention period, retrievable for investigators.
• Data-protection compliance: ODPC registration, privacy notices, breach response;e your KYC database is exactly what the Data Protection Act targets.
• Consumer-facing terms matching operations: fees, custody risk allocation, complaint handling, and marketing rules that forbid guaranteed-return language
• A board-approved incident-response plan: key compromise, platform breach, fraud surges, regulator notification

Regulators assess the actual implementation of compliance measures, not merely the existence of documentation. It is most efficient to establish these systems before submitting the application.

Group Structures, Offshore Parents and Banking

Many applicants operate as Kenyan companies within foreign holding structures. This is permissible provided that regulators have full transparency, including complete beneficial ownership disclosure and properly notarized and legalized or apostilled corporate authorizations from each relevant jurisdiction. The Kenyan entity must be substantively resourced and not merely a nominal presence. Banking arrangements should be initiated during the licensing process, with the compliance framework presented to potential banking partners. Treasury management should be planned across multiple institutions.

Token Offerings: The CMA Track

Raising capital by selling tokens is CMA territory: expect prospectus-grade disclosure, fit-and-proper standards and continuing obligations, with the KeniCoin precedent confirming that investment-flavored tokens are securities in Kenyan eyes. Run the offering and the platform as separate workstreams with coordinated counsel, and sequence the offering after the operating license is stable; regulators and investors both reward the order.

Ongoing Obligations and the Cost of Ignoring Them

Licensed VASPs are subject to ongoing obligations, including the submission of annual returns and audited financial statements, notification of material changes (such as changes in directors, shareholders, systems, or custody arrangements), continuous AML/CFT compliance, implementation of cybersecurity controls with breach reporting, adherence to consumer protection standards, and maintenance of records for the prescribed period. Operating without a license constitutes an offence under the Act, with penalties including fines and potential imprisonment for responsible officers. Enforcement may also extend to third parties who facilitate unlicensed operations. Businesses must either obtain a license, secure a formal legal opinion confirming they are outside the regulatory perimeter, or cease operations.

Ten Mistakes Crypto Founders Make in Kenya

1. 1 . Commencing operations before obtaining a license exposes the business to enforcement action.
2. 2. Submitting generic compliance documents is insufficient; regulators will assess whether the MLRO is capable of effectively implementing the compliance programme.
3. 3. Failure to disclose all beneficial owners will result in the rejection of the application.
4. 4 . Insufficient capitalization undermines the application; the minimum capital requirement is a baseline, not a substitute for a comprehensive business plan.
5. 5 . Failure to implement the travel rule and conduct due diligence on counterparty VASPs constitutes a significant compliance deficiency.
6. 6 . Failure to register under data protection laws or improper handling of KYC data exposes the business to regulatory penalties.
7. 7 . Neglecting CMA regulatory requirements when planning a token offering may result in non-compliance.
8. 8 . Delaying the establishment of banking arrangements may impede business operations.
9. 9. Using foreign terms of service without adaptation fails to comply with Kenyan consumer protection and data laws.
10. 10 . Making marketing claims that guarantee returns may result in regulatory enforcement and private legal actions.

Frequently Asked Questions

Q1. Is it legal to run a crypto exchange in Kenya?

A. Yes, with a license under the VASP Act, 2025 administered by the Central Bank of Kenya. Operating without one is an offence.

Q2. How long does a VASP license take in Kenya?

A. Well-prepared applicants should plan for six to twelve months from serious preparation to grant; unprepared applications take longer and often fail.

Q3. Can foreigners own a licensed Kenyan crypto business?

A. Yes, foreign shareholders and directors are permissible, subject to fit-and-proper assessment and transparency requirements.

Q4. What does a VASP license cost?

A. Prescribed government fees plus the real costs: minimum capital, compliance staffing, audits, cybersecurity and legal. Budget the whole picture, not the filing fee.

Q5. Does the Act cover crypto mining?

A. The licensing perimeter centers on services to others:s exchange, custody, transfer, dealing, advisory. Pure mining sits outside the core categories, but selling mined output, hosting for others or pool operations can pull you in; obtain a perimeter opinion.

Q6. What happens to unlicensed platforms?

A. Offences attract fines and potential imprisonment for officers, with enforcement against facilitating providers. The direction of travel is unmistakable.

Q7. Do I need one license or several?

A. Model the service roadmap: exchange, custody, transfer and dealing can each constitute regulated activity, and a token offering adds the CMA track. One company often holds multiple permissions.

Q8. Can I get a Kenyan bank account as a crypto business?

A. Yes, though selectively banks apply enhanced due diligence. A serious compliance stack presented early is your strongest banking argument.

How We Can Help

At Anyega Osiemo & Company Advocates, we advise crypto founders through the full licensing lifecycle: perimeter analysis and structuring, incorporation and governance, compliance programme design, CBK and CMA applications, data protection registration, banking strategy, and ongoing regulatory relations. We also advise investors conducting due diligence on licensed and unlicensed platforms.

Early preparation is essential for regulatory compliance. Contact us before commencing operations or submitting an application to ensure the process is completed correctly.