Kenya is currently entering a crucial regulatory phase, moving towards a structured compliance regime enshrined in the Virtual Asset Service Providers (VASP) Act of 2025 and the draft rules for implementation until 2026. Developed by the National Treasury, the Central Bank of Kenya (CBK), and the Capital Markets Authority (CMA), the system aims to reduce fraud, increase transparency, and establish formal financial controls over digital assets. The strategy combines encouraging innovation with precautionary measures similar to those used in traditional banking.
The VASP Law legally defines virtual assets and obliges all service providers, including exchanges, wallet operators, and trading platforms, to be licensed to operate in Kenya. This licensing acts as the most important means of protecting consumer rights. Applicants must provide detailed business plans, reliable cybersecurity systems, and anti-money laundering (AML) tools. Regulators are also authorized to conduct compliance checks on directors and senior management in order to prevent non-transparent players from entering the market.
The central element of this system is compliance with AML and «Know Your Customer» (KYC) rules, consistent with the standards of the Global Financial Action Task Force (FATF). Companies should verify user identities, monitor transactions, and report suspicious activity to the Financial Reporting Center. Although these measures reduce risks such as account hijacking fraud and unauthorized transfers, they do not eliminate all types of fraud, especially those related to social engineering.
Kenya has established a structure with two regulatory bodies: the CBK oversees digital assets that function as payment instruments or stablecoins, while the CMA oversees investment-related products and exchanges. This division aims to address regulatory gaps and provide users with clearer ways to resolve disputes.
The draft rules of 2026 also introduce capital adequacy and reserve requirements. For example, stablecoin issuers may be required to keep customer funds in separate bank accounts in Kenya, and invest the remainder in local low-risk assets. This structure is designed to prevent the collapse of liquidity and reduce exposure to offshore risks. In addition, licensed providers must maintain high standards of operational resilience, including data protection and system redundancy, to protect against cyber attacks.
Mandatory reporting, including financial disclosure and audit reports, will introduce market discipline, which will allow regulators to identify early signs of insolvency. Although this compliance-based approach is aimed at turning cryptocurrencies into a controlled financial segment, industry feedback suggests that high compliance costs can consolidate the market among higher-cap players.
As Kenya moves towards finalizing the 2026 rules, the goal is clear: to replace the speculative, lightly regulated environment with a mainstream financial system in which user protection is provided structurally. Recent engagement with the industry, including discussions between exchanges such as Binance and the Kenyan Anti-Money Laundering Association, reflects a growing commitment to this transparent, regulated future.
Comments (0)