Kenya published its Virtual Asset Service Providers (VASP) Regulations, 2026, in the official Kenya Gazette on July 22, completing a regulatory process years in the making. Banks had long denied services to crypto operators, draft regulations emerged in early 2026, and a public consultation ran from March 2026 through an April deadline. The gazette notice gives crypto exchanges, wallet providers, stablecoin issuers, and a range of other digital asset businesses a formal legal basis to operate in the country and approximately three months to secure licences before the compliance deadline.

The regulations, gazetted as Kenya Gazette Supplement No. 185 under Legal Notice No. 134, implement the VASP Act signed by President William Ruto. Some sources place the Act's initial passage in October 2024; others reference October 2025, which aligns with the timeline of the gazetted implementing regulations. Verse Press has not independently confirmed the exact signing date against the official gazette text. Firms currently serving Kenyan users must obtain licences by November 4, 2026. No crypto firm has been licensed under the new law yet.

---

A Split Regulatory Structure

Oversight is divided between two regulators based on business type. The Central Bank of Kenya will supervise companies that convert crypto to local currency as well as stablecoin issuers. The Capital Markets Authority will cover exchanges and token issuance platforms. Initial coin offerings (ICOs), fundraising mechanisms through which companies sell new crypto tokens to raise capital, also fall under CMA jurisdiction, as do custody providers, brokers, and tokenised real-world asset platforms. The regulatory assignment for wallet providers, listed in this article's opening as a covered business type, has not been confirmed by Verse Press against the gazette text and warrants clarification from regulators before the November deadline.

Capital requirements vary by licence category. Brokers face a minimum of KSh 30 million (roughly $230,000), while stablecoin issuers must hold at least KSh 500 million (roughly $3.8 million) in capital. These figures are drawn from secondary reporting and have not been independently confirmed by Verse Press against the gazette text; they should be treated with the same caution applied to the transaction levy figure that follows. The regulations also propose a 0.05% transaction levy on exchanges and token platforms, though Verse Press has not independently confirmed that provision survived intact from the draft into the final gazetted text.

The 116-page framework addresses cybersecurity standards, including mandatory annual penetration testing; advertising rules; consumer protection requirements; and a seven-year minimum for transaction record retention. Firms will be required to submit monthly reports covering security incidents, fraud, and transaction data. Kenya's Finance Bill 2026 goes further, requiring VASPs to share annual user data with the Kenya Revenue Authority.

---

Extraterritorial Reach and Surveillance Capacity

The regulations extend beyond Kenya's borders. Foreign platforms that actively target Kenyan users or generate revenue from Kenya fall within the framework's scope, a provision with direct implications for large exchanges operating across East Africa.

Alongside the licensing framework, the Capital Markets Authority is procuring a blockchain analytics platform capable of monitoring Bitcoin, Ethereum, and at least 20 other networks. The system, consistent with the capabilities of tools such as Chainalysis, TRM Labs, or Elliptic, will be used to flag high-risk wallets, mixer activity (services that obscure transaction origins), darknet-linked addresses, and suspicious transfers. The procurement signals that Kenya intends to enforce as well as regulate. Industry observers expect that users relying on peer-to-peer channels will face increased identity verification requirements from licensed platforms, an inference that follows directly from the surveillance infrastructure now being assembled.

---

Why Kenya's Market Matters

Kenya is the fourth-largest crypto market on the African continent by value received, according to Chainalysis data. The country received approximately $19 billion in crypto inflows between July 2024 and June 2025, behind Nigeria ($92 billion), Ethiopia, and South Africa. Individual figures for Ethiopia and South Africa were not available at time of publication, though both markets received more than Kenya's $19 billion over the same period. Chainalysis estimates more than six million Kenyans use digital assets, most of them through peer-to-peer trading rather than formal exchanges.

Sub-Saharan Africa as a whole received $205 billion in on-chain value over the same period, a 52% increase year over year, underscoring why a regulatory framework of this depth matters beyond Kenya's own borders.

Stablecoin issuers operating under the framework will be prohibited from paying interest on their products, a position aligned with the European Union's Markets in Crypto-Assets (MiCA) regulation and rules from Dubai's Virtual Asset Regulatory Authority. The prohibition prevents stablecoins from functioning as unregulated deposit substitutes.

Notably, the framework includes an explicit legal pathway for tokenised real-world assets, covering listing requirements and white paper disclosure standards. That carve-out positions Kenya as a potential destination for projects building on-chain representations of land titles, agricultural receivables, or treasury bonds, particularly given the existing reach of M-Pesa's mobile payment infrastructure.

---

A Tight Timeline Against a Patchy Digital Infrastructure Backdrop

The November deadline puts meaningful pressure on operators. With no firms yet licensed and a dense compliance document to work through, exchanges and wallet providers serving Kenyan users will need to move quickly. Firms such as Binance, Yellow Card, and Quidax are illustrative of the exchanges that will face Kenya-specific licensing decisions in the coming weeks; their current operational footprints and licensing posture toward Kenya have not been independently verified by Verse Press.

The broader infrastructure context adds a note of caution. A scheduled 20-hour maintenance of the Kenya Revenue Authority's eTIMS invoice system on July 22 and 23 stretched to at least three days, extending through the weekend of July 24 and 25, leaving thousands of businesses unable to generate legally required tax invoices. For VASPs that will eventually be required to integrate with KRA systems for reporting, the outage was a reminder that Kenya's digital public infrastructure still carries operational risk.

Kenya's framework now ranks among the most comprehensive on the continent, comparable in scope to South Africa's active VASP licensing regime and ahead of Ghana's still-developing Virtual Assets Regulatory Office. Unlike Nigeria's fragmented approach, which splits crypto oversight across the Securities and Exchange Commission, the Central Bank of Nigeria, and the Economic and Financial Crimes Commission, Kenya's dual-regulator model, dividing responsibility between the CBK and CMA, offers cleaner jurisdictional lines that may give it a competitive advantage in attracting crypto-native companies seeking an East African base. That comparison carries weight given that Nigeria is already the continent's largest crypto market by volume, at $92 billion in inflows over the same period. Industry observers anticipate that the first CMA licensing decisions will arrive in the fourth quarter of 2026, and those decisions will serve as an early test of whether the regulatory architecture functions as designed.