Kenya VASP Bill 2025 Passes Third Reading: One Signature Away From Becoming Law

TL:DR,

•  Kenya VASP Bill clears third reading; existing providers get six months to apply, with VASP fines up to $154,000 and individuals facing up to 10 years.
• The bill establishes a “twin-pillar” regulatory model, appointing the Central Bank of Kenya (CBK) and Capital Markets Authority (CMA) as joint regulators to oversee all crypto licensing, compliance, and consumer protection.
• Market impact hinges on Treasury subrules, capital, custody, and disclosure definitions will determine whether Kenya attracts global exchanges or cedes ground to neighbors.

Kenya is only one signature away from securing its first crypto law, joining South Africa, Ghana, Mauritius and Nigeria in a pro-regulated ecosystem. On Tuesday, October 7, 2025, the Kenya VASP Bill passed its third reading, marking the final legislative stage.

Now Attorney General Dorcas Odoru is preparing the final text for presidential assent. The Kenya VASP Bill has had its fair share of controversies, especially with its recent “fiasco”; however, the approved version includes new compliance and licensing clauses.

How CBK crypto regulations and CMA oversight will work

The Kenya VASP bill was first introduced in 2024, following an extensive committee stage debate and public consultation. This strategy was deliberate, with many governments focusing on learning how crypto essentially affects the economy as a whole.

The Kenya VASP bill outlines various clauses essentially appointing the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) as joint lead regulators of virtual assets. Under this twin-pillar model, the Treasury Cabinet Secretary has the mandate to issue subsidiary rules that operationalize the laws.

Digital assets are broad, hence the subregulations will span core market infrastructure and safeguards around:

• Stablecoin issuance and tokenisation of real‑world assets.
• Token issuance (ICOs and STOs), exchanges, and trading platforms.
• Investment advisory and management services.
• Capital, solvency, and insurance requirements.
• Conflict‑of‑interest, consumer‑protection, and market‑conduct standards.
• Advertising and cybersecurity requirements.
• AML/CFT/CPF compliance in line with risk‑based supervision.

As per its government, Kenya, being among Africa’s leading digital asset adopters, must provide a comprehensive framework to meet with ever-growing demand. The VirtualAsset Service Providers Act 2025 intends to address the risk associated with the misuse of virtual assets while fostering a regulated ecosystem for growth.

What the new crypto rules in Kenya mean for VASPs and traders

Currently, the updated version of the Kenya VASP bill isn’t publicly available; however, as per the reading, only a few changes occurred. Typically, the bill classifies a virtual asset as a digital representation of value that can be traded or transferred and used for payments or investments. It’s specifically excluded from fiat, e-money, securities and other financial assets.

At its core, it depicts who is and isn’t allowed to operate digital asset services in Kenya. As per its Clause:

• Included: Virtual asset service providers operating in Kenya.
• Excluded: Closed‑ecosystem tokens that are non‑transferable and non‑exchangeable; digital representations regulated elsewhere (e.g., securities); central‑bank digital currencies; and NFTs that are not used for payment, investment, or other financial purposes.

Unlike CBK crypto regulation and CMA rules, licensing effectively becomes the green card or operations. Only companies can apply via a formal application with prescribed requirements and fees(Clause 11). As per the Kenya VASP bill formally accessible to the public, any license approved can only run until December 31 of the year issued(Clause 14), and authorities may impose conditions or vary, suspend, or revoke licences for non‑compliance (Clauses 13 and 16).

The Kenya VASP Bill Baseline for the Crypto Industry

The Kenya VASP bill explicitly states, under clause 47, that existing providers like Busha, Yellow Card, and Swypt must apply within six months and may continue operating until their applications are decided. It also includes other specifications, including:

• Governance: Board of at least two natural persons (Clause 21); appoint a fit‑and‑proper CEO (Clause 31).
• Conduct: Act with integrity, due care, and fairness; do not mislead clients (Clause 22).
• Consumer asset protection: Hold sufficient amounts of each asset type, segregate custody, meet financial requirements, and avoid subjecting client assets to creditor claims (Clause 32).
• AML/CFT/CPF: Full compliance, including targeted financial sanctions (Clauses 25(e) and 33).
• Cybersecurity: Implement appropriate and effective measures (Clause 29).
• Conflicts of interest: Maintain policies to prevent and manage conflicts (Clause 24).
• Record‑keeping: Maintain adequate records and controls; regulators can obtain online, real‑time, read‑only access to client and firm transaction records, retained for at least seven years (Clause 44).
• Reporting: Annual audited financial statements within six months of financial year‑end (Clause 30); CEOs must notify authorities of insolvency, major non‑compliance, criminal proceedings, or Cybersecurity events and furnish a detailed report within seven working days (Clause 26).

Unfortunately, not all generally comply and operating without a license will incur upto $77,400(KES 10M) or up to 10 years imprisonment for individuals. For VASPs, the price doubles up to $154,000 and daily penalties for continuing the services. Forgery, being a common approach for the desperate, will lead to fines or imprisonment.

The CBK and the CMA can issue written warnings, remedial directions, business restrictions (including on new business or directors), license suspension or revocation, administrative fines, and investigations.

FOLLOW UP: IMF Warns, but Kenya Leads: Shape Africa’s Crypto Revolution

The Bigger Picture: Why Now?

The latest updates on VASP reading indicate that the Kenyan government is fast-tracking its regulatory move. Nigeria, South Africa and Ghana have recently doubled down on ensuring that digital assets stick within the boundaries of the law.

The competition is stiff, however, as previously witnessed in the past decade, simply having a set guideline and licensing doesn’t do much. The real test lies in the Treasury’s subregulations how capital adequacy, custody, and disclosure are defined, and will determine whether the market attracts providers or pushes them into peer nations.

The latest updates on VASP readings also align with Kenya’s “grey list dilemma”. The nation is one among many African countries on the FAFT greylist. The pressure to tap into a billion-dollar market to meet revenue and fiscal budget linked to its IMF extended facility(which was cancelled in March).

The Virtual Asset Service Providers Bill 2025 is a Hail Mary to get things rolling, finally.

FAQ: Key Questions Answered

When does it take effect? The specific commencement date is not provided, the next stage of the Kenya VASP bill is the president’s signature and while comprehensive might still not make it to the final stage.

What changes first? Licensing will become the entry ticket and supervisory expectations. Factors like AML/CFT, capital, cybersecurity, and consumer safeguards will become the operating baseline. The framework heavily emphasised clearer disclosures, marketing standards, and asset‑segregation protections are its central features.

How do the new crypto rules in Kenya affect existing platforms? If passed into law, the Kenya VASP Bill will provide entities like Binance(international exchanges) and Swypt(local exchanges) a six-month period to apply.

ALSO INTEREST: Kenya’s Biometric Data Ruling Sparks Bold Regulatory Shift