Is Buying Bitcoin with M-Pesa Legal in Kenya Under the New VASP Rules?
Kenya's VASP framework regulates providers. A personal Bitcoin purchase also needs the right service, payment arrangement and current licence checks.
On this page
Kenya's Virtual Asset Service Providers Act, 2025 took effect on 4 November 2025. Section 47 gives persons already providing virtual-asset services one year from commencement to comply. That points to 4 November 2026.
The final Virtual Asset Service Providers Regulations, 2026 followed on 22 July 2026. They were published as Legal Notice No. 134 in Kenya Gazette Supplement No. 185. The gazetted regulations are different from the earlier consultation draft.
For a buyer, the legal question has several parts. A personal Bitcoin purchase, a provider's regulated business and an M-Pesa payment arrangement need separate checks.
The VASP framework does not make a personal purchase prohibited merely because M-Pesa funds it. It also does not approve every platform or payment route. The actual transaction and provider must comply with applicable requirements.
This assessment is dated 13 October 2026. It explains the framework rather than certifying any named provider or individual transaction.
Buying for yourself is different from offering a service
Section 8 of the Act addresses carrying on, or holding oneself out as carrying on, the business of virtual-asset services in or from Kenya.
Buying BTC for your own account is a different activity from operating that business. The provider licensing rule should not be described as a requirement for every retail buyer to obtain a VASP licence.
The distinction becomes less simple when someone handles other people's money or Bitcoin. Brokerage, exchange operation and custody can involve regulated services.
| Situation | Relevant distinction | What to establish |
|---|---|---|
| Buying BTC for your own account | Personal purchase versus service provision | Provider status, lawful funding and accepted payment terms |
| Facilitating client purchases commercially | Potential brokerage or other regulated activity | Applicable licence category and business obligations |
| Holding customers' Bitcoin keys | Custodial service | Custody licence, customer-asset protections and service agreement |
| Running an exchange or commercial trading platform | Virtual-asset business | Entity eligibility, permitted activities and regulatory approval |
These are illustrative distinctions. They are not exemptions for arrangements whose actual conduct amounts to a regulated business.
A repeated commercial operation should be assessed on its activities. Calling it P2P does not settle its regulatory position.
M-Pesa is the payment route, not the virtual-asset licence
An M-Pesa option tells you how a provider proposes to collect shillings. It does not establish who is authorised to supply the Bitcoin service.
Check the recipient, collection arrangement and purpose permitted by the actual order. Do not assume a working payment prompt approves the underlying business.
A successful payment also does not establish that Bitcoin was delivered. The payment receipt and completed purchase are separate records.
Our M-Pesa versus P2P comparison explains the different counterparties a buyer can encounter. Neither label provides a universal legal or safety guarantee.
Payment providers and banks can apply their own terms within the applicable legal framework. A VASP licence should not be treated as automatic approval for every M-Pesa collection arrangement.
Match the licence to the service and legal entity
The Act's First Schedule allocates different activities to different regulators. The Central Bank of Kenya and the Capital Markets Authority have distinct roles.
| Selected activity in the Act's First Schedule | Relevant regulator |
|---|---|
| Custodial virtual-asset wallet services | Central Bank of Kenya |
| Virtual-asset payment processor | Central Bank of Kenya |
| Virtual-asset exchange | Capital Markets Authority |
| Virtual-asset broker | Capital Markets Authority |
A business offering several services may need to address more than one category. A licence for one activity does not establish permission for every activity advertised.
Regulation 24 requires licensees to disclose their current licence status and the specific service categories covered. It also requires legal-name and contact information.
Read the contracting entity in the terms. A brand name, incorporation certificate or overseas approval should not be substituted for the applicable Kenyan virtual-asset authorisation.
A disclosed partner relationship needs scrutiny too. Ask which entity provides each service and which approval covers it. A partner's licence does not by itself establish another company's regulatory status.
Check current evidence rather than an old announcement
The November 2025 commencement notice said no VASPs had been licensed at that time. It linked the start of licensing to the issuance of regulations.
That statement is historical. It should not be repeated as an undated claim about October 2026.
Section 17 requires the relevant regulator to maintain and publish an updated licence register. The entries should identify the entity, authorised services, issue date and status.
Check official records for the exact company. If the available record is unclear, seek confirmation from the relevant regulator before relying on a licensing claim.
This article assigns no licensed or unlicensed status to Finlazo or another provider. An incomplete search result would not support either conclusion.
Understand the transition date
Section 47 concerns persons providing virtual-asset services when the Act commenced. Its one-year compliance period is tied to 4 November 2025.
It is not a blanket licence. Nor should it be presented as a general permission for new businesses to begin operating without the required approval.
| Regulatory milestone | Date | Meaning for this article |
|---|---|---|
| Act commenced | 4 November 2025 | The statutory framework took effect |
| Final regulations gazetted | 22 July 2026 | The detailed rules were published |
| One year from commencement | 4 November 2026 | Section 47 compliance date for existing providers |
A provider relying on transitional treatment should explain its basis. A submitted application is not the same evidence as a granted licence.
The distinction matters while the compliance window is approaching its end. Recheck official requirements and the provider's status at the time of purchase.
Provider capital is different from your purchase minimum
The regulations impose capital requirements on providers. Those sums are not minimum amounts that a retail buyer must spend on Bitcoin.
The Fifth Schedule specifies the following paid-up capital requirements for three selected categories:
| Category | Value (KSh million) |
|---|---|
| Virtual asset wallet provider | 150 |
| Virtual asset exchange | 100 |
| Virtual asset broker | 10 |
Provider requirements, not retail purchase minimums, deposited customer money or safety ratings. Separate liquidity and other conditions also apply.
Source: Virtual Asset Service Providers Regulations, 2026, Fifth Schedule; CMA-hosted gazetted text
These figures illustrate why the rules target service businesses. They do not guarantee solvency, insure a buyer's balance or eliminate Bitcoin price risk.
A provider's order minimum is a separate commercial term. It should be read in the actual purchase quote.
Verification is part of the framework
Regulation 32 requires a licensee to identify and verify a consumer before onboarding. It links that due diligence to anti-money-laundering obligations.
Identity checks are therefore relevant to the regulated service. A promise of unrestricted anonymous purchases should prompt questions about the provider's compliance arrangements.
Use the official verification process. Do not send an M-Pesa PIN, wallet recovery phrase or private key to someone claiming to help with KYC.
For a personal Finlazo purchase, the sending account must belong to and match the verified customer. That funding policy is separate from the statutory licensing assessment.
A provider may request further information to assess a transaction. Ask what is required and submit it through the verified official channel.
Licensing does not promise a profit or remove other obligations
The VASP Act establishes a provider framework. It does not turn Bitcoin into a guaranteed investment or declare it Kenyan legal tender.
Do not confuse lawful purchase arrangements with protection from losses. Market movements, custody problems and fraud remain separate risks.
Other legal obligations can still apply to the funds, parties and conduct involved. A VASP approval is not a general exemption from tax or other laws.
Keep the purchase confirmation, fees, shilling payment record and relevant wallet-transfer details. Obtain advice on your circumstances where tax treatment or a business activity is uncertain.
Ask for clear terms before sending money
Regulation 24 requires disclosures on charges, risks, withdrawals, suspension and cancellation. Regulation 103 addresses the consumer service agreement.
Those provisions give a buyer concrete questions to ask:
- Which legal entity supplies the service?
- What current licence or applicable regulatory position covers that service?
- Which M-Pesa arrangement does the order accept?
- What total KES amount and final BTC quantity are agreed?
- Who controls the Bitcoin after purchase?
- What happens if payment succeeds but delivery fails?
- How are complaints escalated?
The regulations also address complaint procedures. Read the provider's current process before relying on informal support messages.
Our Bitcoin scams guide covers misleading payment requests and promises. A licensing claim should be verified with the same care as a recipient.
For payment-route context, see Finlazo's Bitcoin with M-Pesa in Kenya page. A product page is not a substitute for current regulatory evidence.
Sources and editorial basis
- Virtual Asset Service Providers Act, 2025 — CMA-hosted gazetted text. Commencement, sections 8, 17 and 47, and First Schedule.
- Virtual Asset Service Providers Regulations, 2026 — CMA-hosted gazetted text. Legal Notice No. 134; regulations 24, 32, 103 and 110; Fifth Schedule.
- CBK/CMA — November 2025 commencement notice. Historical licensing position, not a current provider register.
Sources were checked on 13 October 2026. Dates and capital figures come from the primary legal texts. The chart shows paid-up capital only; it does not summarise every financial requirement.
This is general legal information. A particular transaction or service business needs assessment against its actual facts and the requirements then in force.
