Kenya Introduces Tough New Rules for Crypto Firms. Here’s What Businesses Must Do to Stay Licensed.

Kenya has gazetted the Virtual Asset Service Providers Regulations, 2026, formally bringing into effect a licensing and compliance framework for businesses operating across the digital asset market. The regulations cover exchanges (platforms where users buy and sell cryptocurrencies), custodial wallet providers, payment processors, brokers, investment advisers, asset managers, token issuers and stablecoin providers.

The framework is not limited to companies physically based in Kenya. An overseas platform may also fall under the regulations if it actively targets Kenyan customers or earns income from the Kenyan market. Oversight will depend on the service offered. The Central Bank of Kenya will regulate custodial wallet providers, virtual asset payment processors and stablecoin issuers, while the Capital Markets Authority will oversee exchanges, brokers, investment advisers, asset managers, initial coin offerings, tokenisation providers and token issuance platforms. Existing operators have until November 4, 2026, to meet the new requirements, while companies that receive a licence must begin operating within 12 months.

Lower thresholds, but a high bar remains
Although the final regulations reduced several capital requirements proposed in the earlier draft, obtaining a licence will still require substantial financial capacity. Exchanges must maintain at least KSh100 million in paid up capital, down from KSh150 million, while stablecoin issuers require KSh300 million instead of KSh500 million. Initial coin offering providers and token issuance platforms require KSh20 million, sharply lower than the KSh200 million proposed for each in the draft. Tokenisation providers require KSh10 million, also down from KSh200 million, while brokers and payment processors must each hold KSh10 million. Virtual asset managers require KSh20 million, while custodial wallet providers remain subject to a KSh150 million threshold.
Firms offering several regulated services under one licence must meet the capital requirement for the highest cost activity and add 50% of the prescribed capital for every additional service.

Beyond capital, applicants must show that they have the financial and operational capacity to run a regulated business. Existing companies must generally submit three years of audited financial statements, while newly incorporated firms may provide auditor certified opening statements. This requirement is separate from the 36 month licence transfer restriction, which prevents a licensee from transferring its licence until the business has operated for at least three years.

Stablecoins and tokenised assets face stricter oversight
The regulations impose additional safeguards on two areas that regulators view as carrying greater financial and investor risks: stablecoins and tokenised real world assets.

Stablecoin issuers must maintain reserves equal to the full value of coins in circulation, ensuring every token remains backed by assets. At least 30% of those reserves must be held in segregated trust accounts at Kenyan commercial banks, with the remainder invested in Kenya in approved assets. Issuers must also redeem stablecoins at face value within two working days and are prohibited from paying interest or other rewards simply for holding the token. To demonstrate that reserves remain adequate, they will be subject to daily reconciliations, monthly regulatory reporting, quarterly independent audits and periodic stress testing.

The regulations are equally detailed for tokenisation providers, which convert ownership rights in assets such as property or other investments into blockchain based digital tokens. Beyond obtaining a licence, each tokenised offering must receive separate regulatory approval before it can be issued to investors. Providers must verify the existence, ownership, value and condition of the underlying asset and clearly disclose whether a token represents direct legal ownership or only an economic interest. Importantly, the regulations make clear that tokenisation does not replace or override existing land, property or securities laws.

Responsibility extends to the boardroom
The regulations place responsibility for compliance directly on a provider’s leadership. Firms must have at least three directors, with at least one third being independent, while the chief executive must be based in Kenya. They must also establish proper compliance, finance and internal audit functions to oversee the business and ensure regulatory requirements are being followed. Providers will also be required to conduct customer due diligence, maintain anti money laundering controls and report material cybersecurity incidents to the regulator within 24 hours.

That responsibility extends to the handling of customer assets. Client holdings must be kept separate from the company’s own property and cannot be lent, pledged or used to finance the provider’s operations. Firms must also explain fees and risks clearly, confirm transactions promptly, maintain formal complaints procedures and preserve key records for at least seven years.
The same standards apply to marketing. Advertisements must identify the licensed provider and present both benefits and risks fairly. Influencers and other promoters must disclose their relationship with the company, including any fees, commissions or other benefits they receive.

Regulators gain stronger enforcement powers
The regulations give the Central Bank of Kenya and the Capital Markets Authority broad powers to supervise licensed providers and respond to breaches. Depending on the circumstances, regulators may issue corrective directions, impose administrative sanctions, restrict certain activities, or suspend or revoke a licence. The measures are intended to strengthen oversight and ensure providers continue to meet the financial, governance and consumer protection standards required under the framework.