Kenya’s Gazetted VASP Regulations 2026: Lessons for Digital Asset Governance Across Africa

by Edison Irabor, Senior Policy Reporter

Introduction

Kenya has officially gazetted the Virtual Asset Service Providers (VASP) Regulations, 2026. This regulatory milestone operationalizes the Virtual Asset Service Providers Act (Act No. 20 of 2025), establishing a mandatory statutory licensing and supervisory regime for all cryptocurrency exchanges, wallet custodians, stablecoin issuers, peer-to-peer (P2P) desks, and digital asset intermediaries operating in or from Kenya.

Developed through a multi-agency framework led by the National Treasury in consultation with the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA), the framework transitions Kenya from a historically cautious supervisory posture to one of the most structured, comprehensive digital asset legal frameworks on the African continent.

This brief analyzes Kenya’s new regulatory regime, contrasts it with peer African and international jurisdictions, and extracts strategic takeaways for regulators, financial institutions, and operators across Africa.

Architecture of Kenya’s VASP Regulatory Regime

Kenya’s VASP framework introduces a cohesive statutory structure that spans entity licensing, risk management, market integrity, consumer protection, and prudential oversight.

Executive Oversight and Core Components of the Framework

The National Treasury sits at the apex, providing overall policy leadership and legislative backing for the regulatory architecture. 

• Dual-Agency Coordinated Oversight: Rather than creating a single agency, Kenya establishes joint supervisory jurisdiction between the CBK (governing monetary stability, foreign exchange, and payment systems) and the CMA (governing market conduct, virtual asset offerings, and exchange platforms).
• Broad Territorial Scope (“In or From Kenya”): The regulations apply to any entity deriving economic benefit or servicing users within Kenya, regardless of whether the provider maintains a physical headquarters in Nairobi.
• Corporate Form Restrictions: Unincorporated entities, informal P2P groups, and sole proprietors are expressly barred from operating as VASPs. All applicants must be registered as companies limited by shares under the Companies Act.
• Prudential & Capital Requirements: Applicants must demonstrate minimum capital adequacy (ranging between KSh 50 million and KSh 200 million depending on activity class) and maintain professional indemnity insurance.
• Customer Asset Protection: Mandates the absolute segregation of client funds from corporate balance sheets, prohibiting platforms from re-hypothecating, lending, or commingling user assets.
• Market Integrity & AML/CFT Compliance: Strict enforcement of the FATF Travel Rule, mandatory fit-and-proper vetting for board executives and major shareholders, zero-tolerance prohibitions against insider trading/market manipulation, and mandatory listing due diligence.

Core Operational Domains

Under a joint supervisory framework, regulatory responsibilities are structured across three functional pillars:

• Payment Rails & Foreign Exchange: Focuses on stablecoin issuance guidelines and integration with traditional banking channels.
• Licensing & Market Conduct: Governs the authorization and operational standards for crypto exchanges, wallet providers, and digital asset custodians.
• Market Integrity & Compliance: Enforces Anti-Money Laundering (AML) standards, FATF Travel Rule requirements, and strict client asset segregation protocols.

Comparative Jurisdictional Analysis

Comparing Kenya’s approach with established peer jurisdictions highlights key regulatory strategies across different economic contexts:

 

Parameter	Kenya (VASP Act 2025 / Regulations 2026)	South Africa (FSCA / FAIS Framework)	Nigeria (SEC ARIP / CBN Guidelines / Executive Order on Virtual Asset Coordination 2026)	European Union (MiCA Regime)
Primary Statutory Basis	Standalone VASP Act (Act No. 20 of 2025).	Declared “Financial Product” under existing FAIS Act.	CBN-led VAC  Operational Model	Standalone MiCA Regulation across 27 EU member states.
Regulatory Lead	Coordinated Dual-Lead: CBK + CMA.	Financial Sector Conduct Authority (FSCA).	Central Bank as Chair of the Virtual Asset Council (VAC) and Nigeria Revenue Service (NRS) +  Securities and Exchange Commission (SEC) + Nigeria Financial Intelligence Unit (NFIU) + Office of the National Security Adviser (ONSA)	European Securities and Markets Authority (ESMA) + National Competent Authorities.
Banking Integration	Explicit statutory alignment to prevent arbitrary bank de-risking.	Informal banking integration; banks apply individual risk limits.	Formal VASP settlement bank accounts permitted for SEC-approved VASPs only under strict CBN limits.	Fully integrated; regulated CASPs access standard European fiat banking rails.
Stablecoin & Token Oversight	Regulated jointly via CBK payment rules and CMA asset listing approvals.	Treated under existing foreign exchange and payment regulations.	Regulated as Digital Assets / Asset-backed Tokens under SEC rules, but the CBN to now potentially regulate stablecoins and custody pursuant to a new Executive Order	Strict e-Money Token (EMT) and Asset-Referenced Token (ART) reserve mandates.
Minimum Capital / Local Presence	Mandatory company registration; defined statutory capital tiers.	Fit-and-proper capital checks under financial advisor licensing.	Strict minimum paid-up capital requirements for as high as $1.4 million for exchanges and custodians.	Capital requirements linked to VASP tier (€50,000 to €150,000+).

Regulatory Intelligence: 5 Strategic Takeaways for Africa

1. The Transition from Central Bank Circulars to Enacted Law

For over a decade, many African economies managed crypto assets via restrictive Central Bank warnings or informal circulars. Kenya’s movement—from initial warnings to a statutory VASP Act (2025) and VASP Regulations (2026)—proves that long-term monetary stability and investor protection require explicit legislation rather than prohibition. Primary law grants regulatory clarity, unlocks tax revenue, and builds investor confidence.

2. Solving the CBK-CMA Jurisdictional Conflict

In many jurisdictions (such as Nigeria, Ghana, and Uganda), digital assets occupy a grey zone between securities regulators (viewing crypto as investment contracts) and central banks (viewing crypto as payment instruments or foreign exchange risks). Kenya’s Multi-Agency Task Force approach bridges this gap by granting joint supervisory roles:

• Central Bank of Kenya (CBK): Focuses on stablecoin reserve audits, foreign exchange leakage, and fiat banking gateway stability.
• Capital Markets Authority (CMA): Focuses on exchange order books, token listing standards, preventing market manipulation, and protecting retail traders.

3. Eliminating Shadow P2P Networks

Unregulated crypto adoption in Africa has historically flourished on unmonitored P2P platforms and social media messaging groups, creating significant AML/CFT blind spots for Financial Intelligence Units. By restricting licenses exclusively to registered corporate entities with strict capital and asset segregation requirements, Kenya incentivizes operators to transition from informal shadow desks to institutionalized, audited platforms. It is particularly instructive that under the new regulatory regime, P2P has not been “blacklisted” or illegalized but brought under regulation. 

4. Overcoming the De-Banking Bottleneck

As seen in mature international markets like the UK (where Parliament recently launched an inquiry into crypto de-banking), granting regulatory licenses without securing fiat banking access creates severe operational friction. Kenya’s whole-of-government model directly involves the Central Bank of Kenya in the VASP formulation process. This ensures that commercial banks receive regulatory clarity to service licensed VASPs safely without fearing punitive sanctions from bank examiners.

5. FATF Compliance and Grey-List Mitigation

African nations face heightened scrutiny from the Financial Action Task Force (FATF) regarding AML/CFT enforcement. By hardcoding Recommendation 15 (covering new technologies and the Travel Rule) directly into the 2026 VASP Regulations, Kenya strengthens its international financial standing, shielding its broader banking system from potential FATF grey-listing pressures.

Actionable Recommendations for African Stakeholders

For African Governments & Regulators

• Adopt Inter-Agency Supervision Models: Avoid single-agency silos. Largely, virtual assets are inherently cross-functional. Combine the technical expertise of capital market regulators, banking supervisors, and cybersecurity agencies into a unified VASP supervisory task force.
• Enact Risk-Proportional Capital Rules: Tier minimum capital requirements so that local, early-stage fintech innovation is not completely priced out by global conglomerates while maintaining strict solvency standards for custodial institutions.
• Establish Clear Stablecoin Standards: Given high reliance on USD-backed stablecoins across Africa for cross-border trade, establish explicit reserve verification, audit, and redemptions rules that safeguards the local currency.

For Commercial Banks

• Transition to Risk-Based Assessment: Shift away from blanket account bans toward risk-based due diligence for VASPs licensed under official frameworks.
• Integrate On-Chain Analytics: Utilize blockchain intelligence tools to monitor fiat-to-crypto gateways in real time, enabling transaction-level risk management.

For Digital Asset Service Providers (VASPs)

• Incorporate Local Entities: Foreign operators must prepare to establish local corporate presences, appoint resident directors, and maintain operational capital within host jurisdictions.
• Institutionalize Compliance Early: Prioritize robust proof-of-reserves, clear client asset segregation protocols, Travel Rule solutions, and active transaction monitoring software before seeking formal regulatory authorization.

Conclusion

The gazetting of Kenya’s VASP Regulations 2026 under Legal Notice No. 134 represents a pivotal transition from informal supervisory warnings to a mature, statutory governance model. By dividing oversight between the Central Bank of Kenya and the Capital Markets Authority while hardcoding FATF standards into law, Kenya provides a workable blueprint for dual-agency coordination across the continent.

For policymakers across Africa, the central lesson is clear: long-term monetary stability, foreign investment, and consumer protection cannot be achieved through prohibition or ad-hoc circulars. True market integrity requires statutory clarity, enforceable prudential standards, and a balanced compliance framework that transitions activity out of shadow networks and into the formal financial system. As implementation begins, Kenya’s execution will serve as a crucial test case for how African nations can successfully balance strict financial oversight with digital economy innovation.