The Treasury has published new regulations to govern stablecoin and tokenisation issuers, virtual asset exchanges and wallet providers, brokers, managers, investment advisers and payment processors.
This is in response to the rising use of digital currencies in recent years, as Kenyans adopt them as a payment method for imports, from freelance work to multinational firms, and to wire money home using the tokens.
The new Virtual Asset Service Providers (VASP) Regulations, 2026, form subsidiary legislation for the Virtual Assets Service Providers Act 2025, which became effective in November 2025.
Who exactly will need to be licensed under the new framework?
The regulation covers virtual asset exchanges such as Binance and Coinbase, wallet providers, tokenisation businesses that turn real-world or digital items such as real estate and bonds into digital assets, virtual asset offerings, stablecoin issuers, and virtual asset managers.
Do firms incorporated abroad fall within the regulations if they target Kenyan customers?
Yes. The regulations state that a company is considered to be operating “in or from Kenya” if it actively solicits Kenyan consumers or earns revenue from Kenyan users, regardless of whether it has a physical office in the country.
That means international crypto exchanges wishing to continue serving Kenyans will need to comply with local licensing requirements and regulatory obligations.
What should Kenyan Bitcoin investors expect when opening an account, trading crypto or transferring digital assets?
Consumers should expect more rigorous onboarding procedures. Licensed providers will be required to verify customers’ identities before onboarding, conduct customer due diligence, disclose all fees, explain investment risks, provide complaint mechanisms and give transaction confirmations.
Virtual asset investors should also receive clearer information about withdrawal procedures, cybersecurity measures and consumer protections before using a platform.
Which consumer protection rights do crypto users gain under the new rules?
Virtual asset providers must disclose their licence status, business address, fees, risks, withdrawal policies, cybersecurity measures and complaints procedures in plain language before offering services.
The regulations also demand that providers assess whether investment recommendations are suitable for individual customers and maintain formal complaint-handling systems.
What are the capital requirements?
Stablecoin issuers have the highest minimum paid-up capital requirement of Sh300 million; virtual asset exchanges are required to have Sh100 million, and token issuers and initial coin offering (ICO) platforms Sh20 million.
Firms engaged in virtual asset tokenisation will require Sh10 million, with virtual asset wallet providers requiring Sh150 million, while virtual asset managers are required to hold Sh20 million.
Investment advisers are exempt from minimum paid-up capital requirements.
Why are stablecoins treated differently and more strictly than other digital currencies?
Stablecoins – digital currencies pegged to assets such as the US dollar- are designed to maintain a stable value and therefore resemble payment instruments more closely than speculative cryptocurrencies.
As a result, issuers must obtain separate licences, publish white papers, maintain reserve assets backing every issued stablecoin, ensure redeemability, safeguard reserve assets and submit regular reports.
The regulations also prohibit stablecoin issuers from paying interest on stablecoins.
What are the licence fee requirements for the companies?
Virtual asset exchanges will pay a licence fee of Sh1 million; wallet providers Sh500,000, while stablecoin issuers will pay Sh2 million. Asset managers will, meanwhile, pay Sh200,000.
How will regulation responsibilities be divided between the Capital Markets Authority, Central Bank of Kenya and other agencies?
The CMA will regulate initial coin offerings, trading platforms, token issuance platforms and tokenisation activities, while the CBK authorises businesses converting virtual assets into foreign currencies and licenses stablecoin issuers.
Other State agencies such as the Directorate of Criminal Investigation, the Financial Reporting Centre, and the Ethics and Anti-Corruption Commission also have powers to inspect and investigate licensed firms depending on their mandate.
How do the governance, capital and cybersecurity requirements compare with standards imposed on banks and other financial institutions?
The regulations adopt many prudential standards already common in mainstream finance companies. Licensed firms must maintain minimum capital, appoint compliance officers, establish risk management frameworks, undergo independent cybersecurity audits, maintain disaster recovery plans, separate customer assets from company assets, keep detailed records for at least seven years and implement robust governance structures with independent directors.
These requirements are intended to bring crypto firms closer to the regulatory standards applied to other financial institutions.
