Kenya's VASP Regulations 2026: The Crypto Industry's Compliance Tipping Point

Kenya's crypto industry just crossed from grey market to regulated market. On 22 July 2026, the National Treasury gazetted the Virtual Asset Service Providers (VASP) Regulations, 2026 under Legal Notice No. 134 of 2026, completing the implementation of the VASP Act that President William Ruto assented to in October 2025. The regulations are the most consequential provision for any virtual asset service provider operating in or from Kenya, and they reframe the country's position in the East African crypto ecosystem overnight.

What the VASP Regulations actually do

The regulations create, for the first time, a licensing framework for crypto exchanges, wallet providers, stablecoin issuers, initial coin offering (ICO) platforms, tokenisation operators, and other digital asset businesses serving Kenyan customers. The framework covers 15 operational areas including governance, capital requirements, anti-money laundering (AML) and counter-terrorism financing (CTF) controls, cybersecurity, customer asset safeguarding, market conduct, advertising, and statutory reporting. For firms that serve Kenyan customers without a physical presence in the country, the rules still apply — the regulation extends to foreign providers that actively target Kenyan customers or derive economic benefit from the country.

The minimum capital requirement, cybersecurity controls, and 7-year transaction record retention alone put Kenya's crypto regulation in line with the Financial Action Task Force (FATF) best practice. The framework also brings stablecoin issuers and tokenised real-world asset providers under supervision for the first time, two product categories that have grown rapidly in the region without a clear regulatory home.

How CBK and CMA will share oversight

Kenya's regulatory architecture splits virtual asset supervision between two authorities. The Central Bank of Kenya (CBK) supervises virtual asset-to-fiat conversion services and stablecoin issuers. The Capital Markets Authority (CMA) supervises crypto exchanges, token issuance platforms, ICOs, and tokenisation activities under the VASP Act and accompanying regulations. This dual-regulator model mirrors the experience in South Africa, where the FSCA and the Prudential Authority have shared oversight of crypto assets since 2022, and it is designed to avoid the regulatory gaps that have plagued Kenya's fintech sector in the past.

The CBK moved first on operational readiness. In April 2026, the central bank advertised vacancies for roles covering licensing, product approval and compliance for virtual asset service providers. With the regulations now gazetted, those hires will be the team that processes the first wave of licence applications. The CMA is expected to follow a similar pattern for the exchange, ICO, and tokenisation supervision tracks.

Why the timing matters

Kenya is one of East Africa's largest cryptocurrency markets, recording about $19 billion in crypto inflows between July 2024 and June 2025, according to blockchain analytics firm Chainalysis. Kenya ranked second in the region by transaction value, behind Ethiopia. That volume has been operating in a legal grey zone since 2015, when the CBK issued a warning to banks about servicing cryptocurrency businesses. The grey zone was the reason most Kenyan crypto firms registered holding companies in Seychelles, the British Virgin Islands, or Singapore, and the reason most Kenyan crypto users accessed off-shore exchanges through VPNs.

The gazetting of the VASP Regulations closes that gap. From this month forward, the question is no longer whether Kenya's crypto industry is regulated — it is. The question is what the rules cost, who can absorb them, and whether the regulated market will grow faster than the unregulated market it replaces.

The friction founders are already talking about

The four-month public consultation process that ended in April 2026 surfaced a clear tension. Industry participants argued that some of the proposed capital and compliance requirements risked pricing smaller operators out of the regulated market. The Treasury's draft regulation required minimum capital of KES 500,000 for most virtual asset wallet providers, plus 0.15% of gross turnover in paid-up capital for exchanges, ICOs, and tokenisation operators. Several Kenyan-founded crypto businesses told TechCabal during the consultation that the combination of capital requirements, AML and cybersecurity controls, and 7-year record retention would force them to consolidate or close.

The Treasury's final position was to keep the substantive requirements largely intact, with targeted concessions on the fee structure for early-stage applicants. The result is a framework that is friendlier than the draft but tougher than the grey market. Founders who can absorb the compliance overhead will get a regulatory moat. Founders who cannot will exit or be acquired.

The Pezesha precedent for crypto founders

The most useful precedent for Kenyan crypto founders is the one set by the Capital Markets Authority's sandbox, which produced Pezesha, a Kenyan debt-based crowdfunding platform. Pezesha used its time inside the CMA sandbox to help shape the very regulations that govern Kenyan debt-based crowdfunding today. The lesson is one that founders in the VASP era should hear clearly: a regulator's sandbox is not a place to hide from rules. It is a place to test the product and the rules at the same time. The first licensed Kenyan crypto exchanges will set the precedent for the next decade, and that precedent will be shaped by the founders who engage with the regulator first, not those who wait to see what the regulator does.

What founders should do this quarter

The VASP Regulations take effect immediately upon gazetting. The application window is now open, and the first licences will be issued within the next six to nine months based on the timelines set by the CBK and CMA. For founders, the priorities are:

• Conduct a fit and proper assessment of all directors, senior officers, and significant shareholders. The regulations require a duly filled assessment form as part of the application.


• Build the AML/CFT and cybersecurity policies before the application is filed. The regulations name these as part of the application package, not as conditions to be met after a licence is granted.


• Map the customer due diligence process to the seven-year transaction record retention requirement. Compliance is not a back-office function once the VASP regime is in force.


• Decide whether the regulatory model is to apply for a licence, acquire a licensed entity, or exit the Kenyan market. Foreign providers that target Kenyan customers are in scope, and the offshore workaround is no longer viable.

What the industry needs to watch

The next 90 days will define the Kenyan crypto industry for the next decade. Three things to watch:

• The first wave of CBK and CMA licensing decisions. The application gate is open, and the first approvals will set the compliance bar for everyone else.


• The position foreign providers take. Binance, Coinbase, and Kraken have all served Kenyan customers without a Kenyan licence. The first enforcement action under the VASP Regulations will tell the rest of the offshore market whether Kenya is a serious jurisdiction.


• The tokenisation track. The VASP Regulations are the most explicit tokenisation framework in East Africa. The first tokenised real-world asset issuance under the new rules will be the test case for the entire region.

Kenya's crypto grey market is now a regulated market. The next chapter is being written by the founders who pick up the application form this week.