How to Check Whether a Crypto Exchange Is Licensed in Kenya in 2026

Kenya's crypto licensing rules now give customers a clearer way to assess an exchange. The important question is not whether a platform has an attractive website or accepts M-Pesa. It is whether the legal company behind the service holds the right authorisation for what it offers.

The Virtual Asset Service Providers Act, 2025 took effect on 4 November 2025. The final Virtual Asset Service Providers Regulations, 2026 followed in July 2026. Together, they create a framework for checking licensed exchanges, wallets, brokers and payment processors.

But a critical distinction remains: a licensing framework is not the same thing as proof that a particular exchange is licensed. As of our 27 October 2026 review, we could not independently verify a current, publicly accessible CBK or CMA register dedicated to VASP licensees. Customers should therefore check official records and ask the relevant regulator directly when an exchange's claim cannot be verified.

Quick answer: How do you verify a Kenyan crypto exchange?

Start with the exact legal entity that will provide your service. Then identify the regulator responsible for the activity, request the provider's licence details and compare those details with official information.

Use this checklist before depositing money or crypto:

1. 1Find the registered company name. Look in the platform's terms, disclosures and customer agreement. A brand name alone is not enough.
2. 2Identify the activity. An exchange, custodial wallet provider and virtual-asset payment processor can fall under different licence categories.
3. 3Check the relevant regulator. Use the Capital Markets Authority for exchange activities and the Central Bank of Kenya for the wallet and payment-processor activities allocated to it.
4. 4Match the details. Ask for the licence number, legal name, authorised activities, issue date and present status.
5. 5Seek official confirmation when necessary. If the register is unavailable or the entry is ambiguous, email the relevant regulator rather than accepting a screenshot from the company as conclusive proof.

This approach follows the evidence expected by section 17 of the VASP Act. That section requires regulators to keep and publish registers containing a licensee's name and address, authorised services, issue date and licence status.

1. Establish the company behind the crypto brand

An exchange's public brand may differ from the company named in its customer agreement. The legal entity matters because a licence is issued to an identified person, not to a logo, app icon or social-media account.

Check the footer, legal notices, privacy policy and terms of service. Record the entity's full name and country of incorporation. If the company says a Kenyan affiliate or overseas parent provides the service, ask which specific entity is your counterparty.

A Kenyan certificate of incorporation proves a company's registration. It does not prove that the company has received approval to run a regulated cryptocurrency business. Likewise, a foreign virtual-asset licence is not automatically a Kenyan VASP licence.

Also check for impersonation. Scammers may copy an exchange's name or alter a licence screenshot. Verify the website address independently and confirm that the named licensee actually operates the website you are using.

2. Identify which regulator is responsible

Kenya's VASP Act uses an activity-based approach. Its First Schedule allocates specified services to the Central Bank of Kenya and the Capital Markets Authority.

Some platforms combine several activities. For example, an app may facilitate crypto trades, hold customers' assets and process merchant payments. That combination requires checking the authorisations that cover each relevant service, rather than assuming one category covers the whole operation.

Our broader guide to Kenya cryptocurrency regulation in 2026 explains the licensing framework, capital schedules and business obligations. This article focuses on how a customer can check a provider's claims.

3. Look for the official licence register, not a marketing claim

Section 17(2) of the VASP Act requires each relevant regulator to publish an updated licence register on its website. Section 10(7) also provides for a licence grant to be notified in the Kenya Gazette within 30 days.

Begin at CBK's official website or the CMA's official website. CMA also maintains an online directory of capital-market licensees. Do not assume that an existing securities or forex licence category proves virtual-asset authorisation.

If a dedicated VASP register cannot be located, do not invent a licence number or treat the absence of a search result as a definitive enforcement finding. Request confirmation from the regulator and retain the correspondence.

What could we verify on 27 October 2026?

The joint CBK/CMA notice dated 18 November 2025 stated that neither authority had licensed VASPs under the new Act at that time, and that licensing would start after regulations were issued. That notice was historical and cannot establish the licensing status of an individual company in October 2026.

By 27 October, the final 2026 Regulations were listed on CMA's regulatory framework page. During this review, we did not independently establish a current, comprehensive, publicly accessible VASP licence register on either regulator's site. This means individual licence claims require direct checking; it does not establish that no licences exist.

4. Ask the exchange for five specific details

If an exchange advertises itself as 'licensed in Kenya', ask it to identify the licence rather than sending a generic compliance certificate.

Request the legal entity's name, licence number, issuing regulator, approved service categories and current licence status. Compare the response with official records. Ask whether any conditions or restrictions apply to the service you intend to use.

A company may say that its application has been submitted, that it is awaiting approval or that its technology partner is licensed. These are different statements. None is equivalent to evidence that the company itself already holds a licence for the service it offers.

A simple request works: 'Please provide the legal name of the entity serving Kenyan customers, its Kenyan VASP licence number, the issuing regulator and the authorised activities covered by that licence.'

5. Confirm the status directly with CBK or CMA

When the information does not match, contact the regulator using contact details independently found on an official website. The joint November 2025 CBK/CMA notice lists vasp@centralbank.go.ke and virtualassets@cma.or.ke as VASP-related contact addresses. Verify that these remain current before sending personal information.

Include the company's full legal name, public website, claimed licence number and the precise service you wish to check. Ask whether the entity is authorised for that activity and whether the licence is active, suspended, limited or revoked.

Do not share your exchange password, two-factor authentication code, wallet seed phrase or private keys with anyone claiming to perform a licence check. A legitimate regulator does not need those credentials to confirm a licence.

6. Understand the 4 November 2026 transition date

Section 47 of the VASP Act says persons providing virtual-asset services when the Act commenced must comply within one year. Since commencement was 4 November 2025, that points to 4 November 2026 for the transitional period.

This rule is not a general licence certificate. It should not be used as proof that every exchange serving Kenyan customers is authorised. Whether a particular firm qualifies for transitional treatment depends on when and how it was operating, alongside the applicable legal requirements.

A newly launched business cannot safely assume it has the same transitional position as an operator already providing services when the Act commenced. Where a provider invokes the transition, ask it to explain the legal basis and its current regulatory status.

Our Africa crypto regulation directory tracks country-level frameworks and official sources. It should be read alongside the applicable Kenyan law, not substituted for a licence check on an individual company.

7. Red flags that deserve a second look

Licensing claims can be misleading even where a platform operates a genuine trading or wallet service. Watch for statements that rely on unrelated registrations or do not identify the responsible legal entity.

• 'We are a registered company.' Business registration and VASP licensing are separate matters.
• 'We are regulated abroad.' Overseas authorisation does not automatically establish a Kenyan licence.
• 'Our banking or custody partner is licensed.' A partner's permissions do not necessarily authorise every activity of the platform using that partner.
• 'Our application is pending.' An application receipt is not the same as a licence grant.
• 'We have a licence, but cannot identify the regulator.' A genuine claim should be independently verifiable.
• 'Send a wallet deposit to unlock your licence verification.' Licence checking is not a reason to transfer cryptocurrency to an unknown address.

Check more than licensing. Review withdrawal rules, custodial arrangements, trading fees, complaints channels and how the provider handles failed transfers. Our guide to crypto wallets that accept M-Pesa in Kenya explains some of those practical distinctions.

8. What if a platform cannot prove its Kenyan licence?

First, ask for clarification in writing. The company might have supplied a trading name instead of the legal entity, or you may be looking at a directory that does not cover the correct licence category.

If it cannot provide a credible answer, avoid treating its marketing as proof of regulatory approval. Do not deposit additional funds simply because a staff member sends a screenshot. If you suspect impersonation or false licensing claims, report the facts to the relevant regulator.

If your assets are already held with the service, preserve transaction IDs, receipts, screenshots and correspondence. Follow official customer-support channels. Do not give a recovery service your wallet seed phrase or pay an advance fee for a claimed guaranteed refund.

Does a licensed crypto exchange guarantee your money is safe?

No. A licence may involve governance, capital, custody, cybersecurity and consumer-protection duties, but it is not a promise that Bitcoin prices will remain stable or that every investment loss will be reimbursed.

Customers should distinguish regulatory status from financial risk. Check where assets are held, whether the service is custodial, what withdrawal controls apply and whether an advertised return is being presented as guaranteed.

Sources and verification notes

This guide was researched on 27 October 2026. It uses official statutory and regulator sources for legal requirements, and distinguishes those requirements from licence status that could not be individually verified:

• Kenya Law — Virtual Asset Service Providers Act, 2025: sections 8, 10, 12, 15, 17 and 47; First Schedule.
• Capital Markets Authority — Regulatory Framework: final Virtual Asset Service Providers Regulations, 2026.
• Central Bank of Kenya — Press releases and public notices: 18 November 2025 joint commencement notice, including the historical pre-regulations licensing position.
• Capital Markets Authority — Licensees directory: general public licensee lookup, not independently verified here as a comprehensive VASP register.
• Finlazo — Kenya cryptocurrency regulation: complementary category, capital and compliance background.

Editorial limitation: We have not certified the licensing position of any named crypto exchange. A missing public listing is not conclusive evidence that a licence does not exist. Readers should obtain direct regulator confirmation for a specific entity and service. This article provides general information, not legal or investment advice.