Kenya has published the Virtual Asset Service Providers (VASP) Regulations, 2026, a 116-page rulebook that will govern the country's digital asset industry under the Virtual Asset Service Providers Act. The framework represents one of Africa's most comprehensive regulatory regimes for crypto and blockchain-based assets, arriving as several nations across the continent—including South Africa and Nigeria—have been racing to establish formal crypto oversight. Kenya, already recognised as a fintech innovation hub and home to mobile money pioneer M-Pesa, has seen significant grassroots crypto adoption, making formal rules consequential for a large base of existing users and platforms.

Scope and Extraterritorial Reach

The regulations extend well beyond licensing crypto exchanges. They introduce dedicated rules covering:

• Stablecoin issuers
• Tokenized real-world assets (RWAs)
• Initial coin offerings (ICOs)
• Wallet providers
• Cybersecurity
• Consumer protection
• Advertising
• Market conduct

Importantly, the regulations apply not only to companies physically operating in Kenya but also to firms that actively target Kenyan consumers or derive economic benefit from the country, regardless of whether they maintain a local presence. This extraterritorial scope means offshore platforms serving Kenyan users will also fall within the regulatory perimeter—a notable design choice given that a substantial share of African crypto trading has historically flowed through unlicensed international exchanges.

Licensing Requirements

Applicants seeking a VASP licence must disclose directors, beneficial owners, source of funds, governance structures, cybersecurity policies, AML procedures, and business continuity plans. They must also undergo independent information systems audits, including penetration testing. Foreign-owned firms must additionally disclose cross-border operations and their regulatory status in other jurisdictions.

Regulators are required to determine complete licence applications within 30 days after due diligence is completed.

Central Bank of Kenya Authority Over Conversion Services

The regulations grant the Central Bank of Kenya (CBK) authority over businesses that convert virtual assets into foreign currencies and vice versa. Companies offering such conversion services must obtain separate authorization from the CBK before commencing operations, with approvals subject to annual renewal.

Stablecoin Regulatory Regime

For the first time, Kenya establishes an entire regulatory framework specifically for stablecoins. The regulations require stablecoin issuers to:

• Obtain separate licences
• Publish white papers
• Maintain reserve assets
• Ensure redeemability
• Undergo audits
• Submit ongoing reports

The rules also prohibit issuers from paying interest on stablecoins. This dedicated stablecoin regime is particularly significant given Kenya's deep familiarity with digital payments through M-Pesa, and it positions the country among a small group of jurisdictions worldwide that have crafted standalone stablecoin rules rather than folding them into broader crypto frameworks.

Tokenized Real-World Assets

Kenya has created a legal pathway for tokenized real-world assets. The framework introduces licensing requirements, disclosure obligations, white paper standards, and listing requirements for tokenized assets, signaling regulatory support for on-chain representations of traditional financial instruments and property.

Exchange Listing Due Diligence

Virtual asset exchanges will be required to conduct due diligence before listing any token. The assessment must consider factors including regulatory status, liquidity, market capitalization, trading volume, smart contract security audits, token distribution, community support, and AML risks. Exchanges must also continuously monitor listed assets after admission to trading.

Consumer Protection and Suitability

Licensed firms must clearly disclose licence status, fees, risks, cybersecurity measures, complaint procedures, and conflicts of interest before providing services. The regulations also introduce suitability requirements, obligating providers to assess whether products are appropriate for individual customers before recommending investments.

Governance, Compliance, and Reporting

The framework requires VASPs to appoint compliance officers, establish independent boards, maintain risk management frameworks, conduct annual cybersecurity audits, and implement business continuity plans. Firms must retain transaction records for at least seven years and report security incidents, fraud, and transaction data to regulators on a monthly basis.

Criminal Penalties for Non-Compliance

Recent amendments to Kenya's anti-terrorism and AML laws have strengthened enforcement. The latest amendment goes beyond barring, adding criminal penalties, including imprisonment.

pic.twitter.com/0BJk9RD7rh

— BitKE (@BitcoinKE) September 19, 2025

Market Conduct Rules

The regulations introduce explicit prohibitions against insider trading, market manipulation, false trading, front-running, churning, and misleading statements, bringing crypto market conduct standards closer to traditional securities regulation. Detailed rules governing crypto advertising are also established, requiring clear risk disclosures while prohibiting misleading promotional practices.

Significance

The regulations demonstrate that Kenya is building a comprehensive regulatory framework covering nearly every segment of the digital asset industry—from issuance and trading to custody, tokenization, and stablecoins. The inclusion of dedicated regimes for stablecoins and real-world asset tokenization places Kenya among a relatively small group of jurisdictions that have developed bespoke rules for emerging blockchain sectors. For industry participants, the key questions going forward will be how quickly the Capital Markets Authority and CBK begin processing applications, whether major offshore platforms serving Kenyan users seek compliance, and how enforcement unfolds against firms that choose to operate outside the new perimeter.

The full text of the regulations is available here.