Table of Contents
TL;DR,
- Kenya’s VASP bill is now law—six‑month grace period for existing platforms, with penalties up to KES 10M ($77,400) or 10 years in prison.
- Twin‑pillar oversight by CBK and CMA; strict AML/CFT/CPF, cybersecurity controls, asset segregation, and seven‑year record‑keeping anchor day‑to‑day compliance.
- Licensing requires applications, fit‑and‑proper leaders, independent boards, annual renewals, audited financials, seven‑day incident notifications, and full ICO disclosures pre‑launch.
After months of parliamentary debate and stakeholder consultations, Kenya has finally cleared the legislative hurdle for comprehensive cryptocurrency regulation. The VASP bill 2025 is now officially a law, creating a comprehensive legal framework for licensing, supervising and regulating virtual asset providers.
Kenya, East Africa’s largest digital asset market, now has a policy for traders, exchanges and blockchain entrepreneurs. The timing is impeccable, with the country having fresh wounds from the CBEX scam and the falsely promoted Kenya Digital Token. The governments have finally recognized that regulation is a must to prevent such cases from causing millions of Kenyan shillings to “vanish.”
Understanding Kenya’s New Crypto Law: From Proposal to Reality
The journey toward a Kenya digital asset framework began in 2024, when lawmakers first tabled the VASP bill amid growing concerns about retail investor losses from Ponzi schemes and unregulated exchange collapses. Early drafts proposed creating a standalone Virtual Assets Regulatory Authority (VARA), mirroring models in Dubai and other crypto-friendly jurisdictions. However, Parliament ultimately scrapped that idea to prevent bureaucratic overlap with Kenya’s established financial watchdogs.
Kenya finally joins peers like South Africa, Mauritius and Nigeria in a pro-regulated ecosystem. The Kenya digital asset framework is a shield against retail investor losses in Ponzi schemes and unregulated exchange collapses.
The journey wasn’t without its downsides. Initial draft proposed creating a standalone Virtual Assets Regulatory Authority (VARA), mirroring models in Dubai and other crypto-friendly jurisdictions. Its government, however, scrapped the idea to prevent bureaucratic overlap with Kenya’s established financial watchdogs.
RELATED: Solana-Powered Kenya Digital Token Gains Cabinet Support
The crypto law also briefly had “suspicious” edits in which a segment was added over a potential local stablecoin. The added clause monopolized the distribution to a single entity, hinting and foul play and corrupt officials seeking to pocket some of the lucrative businesses.
Instead, the final version of this crypto law establishes what regulators call a “twin-pillar” model. The Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) will jointly oversee all crypto licensing, compliance monitoring, and consumer protection initiatives. The National Treasury provides policy support and has the mandate to issue subsidiary regulations that will flesh out technical details around stablecoin issuance, custody standards, capital requirements, and cybersecurity protocols.
Kenya among listed African countries under FAFT grey List.[Photo: Reuters]
How to Get a Crypto License in Kenya: The New Entry Requirements
The VASP bill, now law, moves Kenya’s “grey” area into a new, pro-regulated environment. In the next few weeks, we are sure to see a spike in virtual asset providers trying to figure out how to get a crypto license in Kenya. Here’s what the VASP Bill 2025 compliance guide requires
Eligibility and Application: Businesses must send in official applications with the required documents and fees. Every license is valid until December 31 of the year it is issued, and it must be renewed every year.
Fit-and-Proper Assessments: Directors, beneficial owners, and senior officers all go through thorough background checks. Companies must hire a CEO who is fit and proper and have a board of at least two people who are not related to the company.
Operational Standards: Licensed providers must be honest, careful, and fair at all times. It is against the law to lie to customers. Entities must have strong cybersecurity measures, policies against conflicts of interest, and complete record-keeping systems that regulators can access right away. You have to keep records of transactions for at least seven years.
Consumer Asset Protection: This is the most important thing that traders need to do. VASPs must have enough of each type of virtual asset, keep client funds separate from operational capital, and make sure that customer assets aren’t at risk of being claimed by creditors during bankruptcy proceedings.
For existing platforms, the VASP offers a six-month grace period to apply. Fortunately, such providers may continue operations until the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) decide their services infringe on the new law.
VASP Bill 2025 Compliance Guide: Daily Operations Under the New Regime
The Kenya digital asset framework has redefined how crypto business operators operate.
For instance, financial crime is strongly attributed to cryptocurrency. Under the newly approved VASP bill, Full anti-money laundering, counter-financing of terrorism, and counter-proliferation financing (AML/CFT/CPF) compliance is mandatory. This includes adherence to targeted financial sanctions, requirements that align Kenya with international standards and may help the country exit the Financial Action Task Force (FATF) grey list.
RELATED: Kenya Scraps 3% Crypto Tax: New Fee-Based System Explained.
To collect relevant information, all approved VASPs must submit annual audited financial statements within six months of their financial year-end. CEOs bear personal responsibility to notify regulators within seven working days of any insolvency events, major compliance failures, criminal proceedings, or significant cybersecurity incidents.
The crypto law also included a clause on initial coin offerings (ICOs) with specific guidelines for token launches. Before any public offering, issuers must disclose comprehensive project details, leadership identities, and investor protection mechanisms. This is a direct response to Kenya’s “scam” history with crypto.
How the Central Bank of Kenya Regulates Cryptocurrency
The CBK and CMA have a lot of power when it comes to enforcing rules. They can give written warnings, require companies to take corrective action, limit business activities (like not letting companies hire new employees or appoint certain directors), suspend or revoke licenses, impose administrative fines, and start formal investigations.
The punishments for not following the rules are very harsh and meant to stop people from breaking them. Without a license, people can be fined up to $77,400 (KES 10 million) or sent to prison for up to 10 years. Fines for businesses go up to $154,000, and they keep going up every day that they keep doing illegal things.
If you forge licensing documents or materials sent to regulators, you can face separate criminal charges. Providers who don’t work together or fix problems quickly can turn even small mistakes into big ones.
This strong enforcement framework shows that the Central Bank of Kenya will focus on both discouraging and developing cryptocurrency. Regulators want to punish bad actors while encouraging compliant innovation.
