Why this matters (now)

Kenya moves from a grey zone to a rules based market for digital assets. With the Act in force, expect clearer paths to bank accounts, investor confidence and safer retail participation, while regulators clamp down on illicit finance risks.

The big design choice: Two regulators, distinct roles

• Central Bank of Kenya (CBK): oversight of issuance and stablecoins (reserve quality, redemption, paymentsystem safety).
• Capital Markets Authority (CMA): licensing/supervision of exchanges, brokers and custodians, plus market conduct, disclosure, and clientasset protection.
This split aligns oversight with function and mirrors global best practice for systemic stablecoins vs. market venues. 

AntiMoney Laundering/Counter Financing of Terrorism (AML/CFT) is the spine of the framework

Virtual Asset Service Providers (VASPs) become reporting institutions with duties around Know Your Customer/Customer Due Diligence (KYC/CDD), ongoing monitoring, Suspicious Transaction Report (STR) filings, recordkeeping/Travel Rule, governance and cybersecurity and audits, critical to interoperability with banks and crossborder partners.

What changes for key stakeholders

For Virtual Asset Service Providers (VASPs) & Web3 startups

• Bankability + legitimacy under a licensing regime.
• Higher bar: capital/solvency, fitandproper management, custody controls, incident reporting.
• Consolidation risk: compliance costs may push partnerships/mergers.

For consumers & investors

• Safer platforms: asset segregation, clearer fees/risks, cyber standards, and dispute channels.
• Lower counterparty risk on licensed venues vs. informal peertopeer (P2P).

For banks & incumbents

• Shift from blanket derisking to riskbased onboarding of licensed Virtual Asset Service Providers (VASPs).
• New lines: custody partnerships, stablecoin reserve services, analytics for compliance.

For the wider economy

• Investment magnet: legal certainty attracts quality players.
• Tax clarity & compliance improve as activity formalizes (watch Kenya Revenue Authority (KRA) guidance). 

What’s in force and what’s next

• Status: Virtual Asset Service Provider (VASP) Act No. 20 of 2025; assent Oct 15, 2025; commencement Nov 4, 2025 (per Kenya Gazette).
• Next mileposts: Central Bank of Kenya (CBK)/Capital Markets Authority (CMA) to gazette implementing regulations (licence categories, prudential rules, disclosure/marketing standards, Travel Rule mechanics, transitional arrangements and timelines). Monitor regulator sites and Gazette notices. 

90-day action checklist (practical steps)

For Virtual Asset Service Providers (VASPs) / exchanges / custodians

1. Licensing readiness: gap analyse capital, governance, Information Technology (IT)/cyber, ops resilience, client asset segregation.
2. AntiMoney Laundering (AML) uplift: risk assessment, Customer Due Diligence (CDD) tiers, Travel Rule vendor, Financial Reporting Centre (FRC) reporting workflow.
3. Incident & custody playbooks: hot/cold storage policy, key management, breach notification.
4. Disclosure pack: risk summaries, fee tables, Terms and Conditions (T&Cs), privacy + Data Protection Act, 2019 (DPA 2019) alignment.
5. Banking engagement: prepare compliance artefacts for onboarding.

For banks / payments players

1. Update policies to onboard licensed Virtual Asset Service Providers (VASPs) on a risk basis.
2. Explore custody/fiat onoff ramps/stablecoin services.
3. Integrate blockchain analytics for monitoring.

For corporates dabbling in Web3

1. Contract hygiene: clarify asset ownership, keys, Service Level Agreements (SLAs), incident duties with any Virtual Asset Service Provider (VASP) vendor.
2. Tax & accounting: define recognition, basis/realisation events; watch Kenya Revenue Authority (KRA) circulars.
3. Data protection: lawful basis, minimisation, crossborder transfer controls for Know Your Customer (KYC) data. 

FAQs

Is the Virtual Asset Service Provider (VASP) Bill already law?
Yes. It’s now Act No. 20 of 2025, assented Oct 15, 2025, commenced Nov 4, 2025.

Who licenses what?
Central Bank of Kenya (CBK) handles issuance/stablecoins; Capital Markets Authority (CMA) handles exchanges, trading platforms and custody.

Are there transitional windows?
Expect licensing windows and transitional provisions to be set out in gazetted regulations by Central Bank of Kenya (CBK)/Capital Markets Authority (CMA). Keep an eye on official notices.

What happens to peer-to-peer (P2P) trading?
The Act targets intermediaries (VASPs). peer-to-peer (P2P) will persist, but regulated venues should become safer defaults, with enforcement focused on illicit finance risks.

Bottom line

Kenya’s Virtual Asset Service Provider (VASP) regime is now live. If implementation (capacity, coordination, clarity) matches ambition, Kenya can derisk participation, attract quality capital, and lead regionally while protecting users. For market players, the mandate is clear: get complianceready and build for a regulated future.

Legal disclaimer: This article is for general information only and does not constitute legal or tax advice. Engage professional counsel for specific guidance.