A recent Legal Alert – Kenya enacts Virtual Assets Service Providers (“VASP”) Regulations 2026 from PwC Kenya examines the implications of Kenya’s new framework for regulating digital asset activities. Published on 22 July 2026 under the Virtual Asset Service Providers Act, 2025, the regulations establish the country’s first comprehensive regime governing virtual asset exchanges, wallet providers, payment processors, brokers, investment advisers, token issuance platforms, stablecoin issuers and tokenisation projects.
According to PwC Kenya, the regulations go beyond licensing by introducing governance, consumer protection, cybersecurity, operational resilience, reporting and prudential requirements. The framework also has a broad territorial scope, applying to businesses operating in or from Kenya, including entities without a physical presence in the country where their activities target Kenyan users or generate economic benefit from the Kenyan market.
Kenya VASP Regulations 2026 Introduce Significant Licensing and Capital Thresholds
One of the most notable aspects of the new framework is the introduction of detailed licensing categories and minimum capital requirements. Oversight will primarily be shared between the Capital Markets Authority (CMA) and the Central Bank of Kenya (CBK), depending on the nature of the activity.
The highest capital requirement applies to stablecoin issuers, which must maintain KSh 300 million in paid-up capital and KSh 60 million in liquid capital, or 100% of current liabilities for at least 30 days, whichever is higher. Virtual asset wallet providers are required to hold KSh 150 million in paid-up capital and KSh 30 million in liquid capital, while virtual asset exchanges must maintain KSh 100 million in paid-up capital and KSh 20 million in liquid capital.
Virtual asset managers must maintain KSh 20 million in paid-up capital and KSh 4 million in liquid capital, while brokers require KSh 10 million in paid-up capital and KSh 2 million in liquid capital. Payment processors must maintain KSh 10 million in paid-up capital, and investment advisers are exempt from minimum capital requirements.
The licensing process requires extensive disclosures covering directors, beneficial owners, significant shareholders, governance arrangements, business plans, source of funds information and fit-and-proper assessments. Applicants must also demonstrate adequate cybersecurity controls, anti-money laundering frameworks, business continuity arrangements and risk management systems. An independent information systems audit, including vulnerability assessments and penetration testing results, is also required.
The regulations establish a formal framework for Initial Coin Offerings (ICOs). Issuers must obtain approval from the CMA and provide detailed white papers covering project objectives, governance structures, risks, use of proceeds and financial information. ICO approval fees are set at 0.25% of the successful offer value, subject to a minimum of KSh 200,000 and a maximum of KSh 30 million. Requests for extensions must be made at least three months before expiry, with extensions limited to six months.
Consumer Protection, Governance and Stablecoin Oversight Take Centre Stage
The regulations introduce governance standards that are closer to those applicable to regulated financial institutions. Boards must comprise at least three directors, and at least one-third of board members must be independent directors. The roles of Chairperson and Chief Executive Officer must remain separate, with boards taking ultimate responsibility for strategy, risk management and regulatory compliance.
Consumer protection is a central feature of the framework. Licensed Virtual Asset Service Providers (VASPs) must provide clear disclosures regarding licence status, fees, risks, complaint procedures, cybersecurity protections and conflicts of interest. Customer assets must be segregated from company assets and protected from creditor claims. Wallet providers are also required to conduct monthly reconciliations and maintain detailed records of customer holdings.
Advertising rules have also been strengthened. Marketing materials must be fair, clear and not misleading, while online promotions must prominently display risk warnings, fees and key conditions. Businesses must retain advertising records for seven years. Transaction records and regulatory reporting documentation must also generally be retained for at least seven years.
Cybersecurity obligations are extensive. Licensed providers must notify regulators within 24 hours of discovering a cybersecurity incident and submit a detailed report within five working days. The regulations also expect firms to maintain insurance against risks such as theft, loss of private keys and operational failures.
Stablecoin issuers face some of the most stringent obligations under the framework. Stablecoins must be fully backed by reserve assets whose value equals or exceeds the value of outstanding stablecoins at all times. At least 30% of funds received must be held in segregated trust accounts in Kenyan commercial banks. Stablecoin holders have a direct claim against issuers and are entitled to redeem their holdings at par value, with redemption requests required to be honoured within two working days.
The regulations also introduce oversight of virtual asset-to-foreign-currency conversion activities. Businesses engaging in these services must obtain written authorization from the CBK. The regulator is required to communicate its decision within 10 days. Failure to obtain authorization may result in penalties of up to KSh 3 million for individuals and KSh 5 million for companies, alongside possible regulatory sanctions.
As highlighted by PwC Kenya, the Virtual Asset Service Providers Regulations 2026 significantly expand the regulatory perimeter for digital asset activities. With new capital thresholds, governance standards, consumer protection obligations and operational requirements, businesses operating in Kenya’s digital asset sector will need to assess licensing requirements, compliance readiness and long-term operating models under a much more structured regulatory environment.
Source: PwC Kenya, Legal Alert – Kenya enacts Virtual Assets Service Providers (“VASP”) Regulations 2026