Eight months before the deadline, Kenya’s VASP Act remains stuck in regulatory limbo — and the firms it was designed to govern have no path to compliance.
Kenya’s Virtual Asset Service Providers Act came into force on 4 November 2025, giving the country East Africa’s most comprehensive crypto regulation and a clear compliance clock: all virtual asset service providers must be licensed by 4 November 2026, or face fines of up to KSh 25 million (~$194,000) and potential shutdown.
Four months into that clock, the Central Bank of Kenya and Capital Markets Authority confirmed the obvious — that licensing hadn’t started yet, and wouldn’t until the National Treasury published implementing regulations. No timeline was given.
It is now March 2026. The Treasury has still not published those regulations. Kenya’s 733,000 crypto users and the exchanges serving them are operating in a legal grey zone that the VASP Act was specifically designed to eliminate.
The Law Without the Rules
The timeline tells the story of a structural bottleneck baked into African regulatory design. Parliament passes the law. The executive — in this case, the Cabinet Secretary of National Treasury — must follow up with implementing regulations that define the actual licensing conditions. Only then can regulators issue licences.
Kenya’s VASP Act is not unusual in this regard. But the stakes are higher here because the compliance window is fixed at 12 months from commencement. Regulators cannot extend that deadline. Yet they control, indirectly, how much of that window is useful to industry — because until Treasury acts, there is nothing to apply for.
On 18 November 2025, two weeks after the Act came into force, the CBK and CMA issued a joint public notice: “The Cabinet Secretary for the National Treasury and Economic Planning is currently developing Regulations to provide further guidance on the implementation of [the VASP Act]. Licensing of VASPs will begin once these Regulations are issued.”
As of March 2026, those regulations remain unpublished. Exchanges, brokers, stablecoin platforms, and wallet providers cannot begin the licensing process. They cannot know with certainty what the “fit and proper” test for directors will require in practice. They cannot price the compliance spend — independent IT audits, insurance minimums, advanced AML monitoring infrastructure — without knowing the regulatory specifications. They are, in effect, preparing for a race where the starting gun has been fired but the track has not been built.
What the Act Actually Requires
When implementing regulations are published and licensing opens, VASPs in Kenya will face a two-regulator framework. The CBK will oversee issuance of digital assets and custodial services — stablecoin issuers, asset custodians. The CMA will license crypto exchanges, brokers, and trading platforms.
Both tracks carry significant operational obligations:
- Fit and proper assessments for all directors and senior management
- AML/CFT controls meeting Kenya’s Financial Reporting Centre standards
- Governance frameworks including board composition and risk management requirements
- Consumer protection mechanisms including clear dispute resolution processes
- Advance regulator approval for any material business changes — new products, ownership changes, business model shifts
The Act amended three existing statutes — the Capital Markets Act, the Central Bank of Kenya Act, and the National Payment Systems Act — to designate VASPs as reporting institutions, bringing them into the formal financial intelligence reporting chain.
For Binance Kenya, YellowCard, Luno, and other established platforms already operating with international compliance infrastructure, the framework is demanding but navigable. For the dozens of smaller local exchanges, payment gateways, and crypto lending platforms that proliferated during Kenya’s digital finance boom, the cost burden is existential.
The Innovation Gap Kenya Built In
The most significant structural critique of Kenya’s VASP Act is what it omits: a regulatory sandbox mechanism.
Ghana’s Securities and Exchange Commission, by contrast, admitted 11 firms to its VASP regulatory sandbox in March 2026 — providing a supervised trial environment where companies can test products under reduced compliance obligations before full licensing. Firms admitted include domestic startups alongside international platforms, allowing smaller operators to demonstrate viable business models without the capital outlay of full institutional compliance.
Kenya’s framework offers no such pathway. A startup building a stablecoin remittance product faces the same licensing requirements as a multinational exchange. The compliance spend — estimated at tens of millions of shillings when auditing, legal, and infrastructure costs are totalled — creates a structural barrier that advantages incumbents and international platforms over domestic innovation.
Rwanda’s dual-track approach offers a different model. Its Virtual Assets Law, passed in late 2025, creates separate licensing lanes for speculative digital asset trading versus payment-oriented virtual assets, with its CBDC pilot (e-FRW) running in parallel as a state-anchored digital currency alternative. The regulatory architecture acknowledges that the sector contains fundamentally different risk profiles.
Kenya’s VASP Act treats all virtual asset businesses as equivalent. That is a regulatory choice, and industry observers are beginning to flag it as a competitive liability as the region’s crypto landscape matures.
Eight Months and Counting
With implementing regulations still unpublished, Kenya’s crypto industry now faces a compressed compliance calendar. Once Treasury publishes its regulations, exchanges must:
- Review the specific licensing conditions and confirm their business activities are accurately categorised
- Conduct internal fit-and-proper assessments for all directors and senior management
- Commission independent IT audits of their security infrastructure
- Build or procure compliant AML monitoring systems
- Prepare and submit licensing applications to the CBK or CMA
Legal practitioners working in the fintech space estimate that a mid-sized exchange with a complex product offering requires six to nine months to prepare a complete licensing application under a comparable framework. For smaller operators, the preparation period may be longer due to limited internal compliance capacity.
If implementing regulations are not published before June 2026, a meaningful segment of Kenya’s crypto market faces a binary choice between a compressed, under-resourced compliance sprint or a decision to exit the market ahead of the November 4 deadline.
The Regional Stakes
Kenya’s position as East Africa’s largest crypto market — with the highest Bitcoin trading volumes and broadest exchange ecosystem in the subregion — gives this regulatory bottleneck outsized regional significance. The EAC Cross-Border Payment System Masterplan, approved in May 2025, is designed in part around the assumption that Kenya’s regulatory framework will anchor regional payment system interoperability.
The Kenya-Rwanda mutual recognition MOU for payment service providers, signed on 11 March 2026, signals growing ambition for cross-border licensing passporting. But passporting only works when domestic licensing is functional. If Kenya’s VASP licensing remains open when the MOU’s implementation timeline begins, the regional interoperability agenda stalls at the first step.
The Treasury and the regulators are presumably aware of this. What is not clear is whether the administrative backlog at the National Treasury is a systemic resourcing problem — or whether there are substantive policy disagreements about what the implementing regulations should contain.
If it is the latter, the crypto industry has a right to know. The compliance clock is ticking for everyone except the regulator.
BETAR.africa tracks African technology regulation across 54 countries. Policy Alerts and Regulatory Intelligence Briefs are published as part of the Policy & Regulation Desk’s continuous monitoring mandate.
Sources:
- Kenya’s 733,000 crypto users — Chainalysis 2025 Global Crypto Adoption Index; supported by Central Bank of Kenya Financial Sector Stability Report 2025 (cryptocurrency usage section).
- CBK and CMA joint public notice, 18 November 2025 — Central Bank of Kenya Official Notice No. CBK/PG/18/2025; also available via Capital Markets Authority press releases archive (cma.or.ke), November 2025.
- Legal practitioners estimate six to nine months — Based on guidance from Anjarwalla & Khanna (ALN Kenya) and Cliffe Dekker Hofmeyr Nairobi practice advisories on VASP licensing preparation under equivalent frameworks (South Africa FSCA CASP licensing, 2023–2024); no named practitioner has provided an on-record quote; attribution kept general pending formal comment.
- EAC Cross-Border Payment System Masterplan, approved May 2025 — East African Community Secretariat, EAC Cross-Border Payment System Masterplan 2025–2030, published Arusha, May 2025 (eac.int); also covered by EAC press release, May 2025.
- Kenya-Rwanda mutual recognition MOU for payment service providers, 11 March 2026 — Central Bank of Kenya and National Bank of Rwanda joint communiqué, 11 March 2026; see also BETA-515 (Kenya-Rwanda EAC PSP Licence Passporting MOU) for sourcing and analysis.
UphivaBETAR
