Kenya Crypto Licensing Deadline: What November 4 Means for VASPs
Kenya's VASP Act transition reaches its one-year anniversary on November 4, 2026. What section 47 says, how CMA and CBK responsibilities differ, and what operators should check.
On this page
Kenya's one-year statutory transition for existing virtual asset service providers reaches its anniversary on 4 November 2026, based on section 47 of the Virtual Asset Service Providers Act. The Act commenced on 4 November 2025. Section 47 gives existing operators one year to comply.
This is a deadline for businesses already providing covered services when the Act commenced. It is not a new one-year grace period for companies launching later.
The Act and implementing rules affect exchanges, brokers, wallet providers, payment processors and other covered businesses. Operators should check the actual activity, not the label on their websites.
Kenya crypto deadline: important dates
| Event | Date | What it means |
|---|---|---|
| Act assented to | 15 October 2025 | Parliament's framework received assent |
| Act gazetted | 21 October 2025 | Publication of Act No. 20 of 2025 |
| Act commenced | 4 November 2025 | Regulatory framework came into effect |
| Implementing regulations | 2026 regulations listed by CMA | Operators must use the final applicable requirements |
| Statutory transition anniversary | 4 November 2026 | One year after commencement |
The anniversary is calculated from section 47. The statute uses the phrase within one year, which does not itself establish that every provider's licensing application must be decided by that date. Businesses should confirm the exact compliance position with their legal advisers and regulators.
Which businesses face the transition deadline?
Section 47 addresses any person already providing virtual asset services when the Act commenced. The First Schedule describes the regulated service categories.
Businesses potentially affected include cryptocurrency exchanges, brokers and custodial-wallet operators. Payment processors and qualifying virtual-asset offering services also need careful analysis.
A software business is not automatically a VASP merely because it discusses cryptocurrencies. Its actual customer flows and contractual responsibilities matter.
Existing provider versus new market entrant
| Situation | What to check |
|---|---|
| Operating a covered service on 4 November 2025 | Section 47's one-year transition applies |
| Incorporated before the Act, but not operating | Incorporation alone does not establish transition eligibility |
| Starting a covered service after commencement | Do not assume section 47 grants a fresh grace period |
| Using an overseas custody or payout partner | Identify who actually contracts with customers and performs each service |
| Publishing research without conducting regulated services | Separate publishing from transactional activities |
For an overview of licensing categories, read Kenya cryptocurrency regulation. Consumers can use our Kenya exchange licensing checklist.
Which regulator oversees the business?
The Act names two regulatory authorities. Responsibility depends on the licensed activity.
| Authority | Activities described in the framework |
|---|---|
| Capital Markets Authority (CMA) | Virtual asset exchanges, brokers, investment advisers and managers |
| Central Bank of Kenya (CBK) | Wallet providers, payment processors and specified stablecoin offering activities |
| Both, as applicable | Businesses conducting multiple services may face overlapping considerations |
The CMA regulatory framework lists the Virtual Asset Service Providers Regulations, 2026. The CMA final regulation entry is distinct from its March consultation draft. The CBK legislative resource also provides sector materials.
Never rely on an old consultation draft when a final regulation is available. Confirm the current instrument and application process with the relevant regulator.
What operators should do before November 4
1. Map every customer-facing activity
List where customers deposit, exchange, hold and withdraw virtual assets. Note the legal entity providing each function.
2. Check the licensing category
Compare your services with the Act's First Schedule. Review broker, exchange, wallet and payment-processing definitions.
3. Identify the responsible regulator
An API integration does not settle the licensing question. The regulator may examine who controls funds, takes instructions and serves customers.
4. Assemble compliance records
Prepare corporate documents, ownership information, governance arrangements and policies. Include customer verification, transaction monitoring, cybersecurity and custody controls where required.
5. Confirm the filing route
Use the regulator's published instructions. Do not assume a commodities-broker or crowdfunding form is a substitute for a VASP application.
6. Document the operating decision
Record filing progress and regulator correspondence. If authorization is unavailable or unresolved, obtain advice on restricting affected activities.
Do not claim a pending application equals an issued licence. Keep customer communications accurate.
What penalties does the Act provide?
The Act contains licensing restrictions and criminal offences. It also contains administrative enforcement provisions.
Operators should read sections 8, 39 and 40 together. Liability depends on the offence and legal person involved.
For specified section 39(2)(f) administrative breaches, the Act permits penalties of up to KES 3 million for individuals and KES 10 million for companies. Separately, section 40(3) provides, for specified offences, up to KES 10 million or five years' imprisonment (or both) for individuals and up to KES 25 million for companies. These are statutory maxima for particular breaches, not automatic penalties for every licensing issue. Read sections 39–40 in the Act.
Does a foreign provider need Kenyan authorization?
A foreign licence does not automatically authorize local regulated activity. Assess where services are performed, advertised and contracted.
The answer may depend on local customers, payment rails, employees and economic activity. Seek regulator confirmation for cross-border models.
For users, see how to verify a crypto exchange's Kenyan licence. For African comparisons, visit the Africa crypto regulation directory.
The bottom line
Section 47 gives existing VASPs one year from 4 November 2025 to comply. That produces the 4 November 2026 transition anniversary.
Check which activities your company actually performs. Confirm the final rules, the filing route and any new regulator notice.
Source review: Kenya Law, Act No. 20 of 2025; CMA regulations directory; joint commencement notice. Status reviewed 2 November 2026.
