Kenya was grey listed by the Financial Action Task Force in February 2024, due to strategic deficiencies in its anti-money laundering and counter-terrorism financing (AML/CTF) framework. This has resulted in an increased demand for the regulation of cryptocurrency assets. Consequently, the Virtual Assets Providers Bill, 2025 (the “VASP Bill”) was drafted with the intention of regulating virtual assets and curbing money laundering and cybersecurity threats. This article, in a follow up to the Historical Background on regulations of Virtual Assets (VAs), highlights the key regulatory requirements proposed in the VASP Bill.

Licensing Requirements under VASPs Bill 2025

The VASP bill proposes the CMA, the CBK, and any other body appointed by the National Treasury as the key regulatory bodies for VASPs. These regulatory bodies shall be in charge of licensing of VASPs, approval of initial VAs offering, ensuring financial soundness and stability in the financial system, and combating financial terrorism and anti-money laundering be enforcing AML/CFT/CPF including vetting significant shareholders, beneficial owners, directors and senior officers of a virtual asset service provider or issue regulations, amongst other functions.

Prior to the issuance of a licence to undertake the business of virtual asset services, a VASP must satisfy certain requirements which consist of the following:

1. Be a local incorporated company or a foreign company issued with a compliance certificate to operate under the Companies Act, 2015. The VASP Bill prohibits natural persons from carrying out the business of virtual asset services.
2. Undertake the services under the schedule. Some of the services listed include custodial wallet services, virtual assets management, virtual assets investment advisory, brokerage services, virtual assets escrow services, virtual asset exchange services amongst others.
3. Have personnel who possess the necessary skills, knowledge, and experience;
4. comply with data protection and consumer protection requirements;
5. meet the requisite cybersecurity measures under the Computer Misuse and Cybercrimes Act;
6. Appoint a director or a principal who meets the relevant educational and professional qualifications, competence, and soundness of judgment as shall be assessed by the relevant regulatory body;
7. Have a registered office in Kenya; and
8. Have a board of directors consisting of at least 2 directors who shall be natural persons.

It is important to note that the license issued shall be valid from the date it is issued until the 31^st of December of the year it is issued and it is not transferrable to any other person or entity. If you are an entity looking to procure a licence to undertake virtual assets services, reach us on advocate@lexgroupafrica.com for further assistance.

Obligations of VASPs under the Bill

In addition to the licensing requirements discussed above, a VASP must fulfil the following obligations upon issuance of the licence to operate and during its operation:

1. Maintain its business in a financially sound condition, complying with any such capital, solvency, and insurance requirements as may be prescribed;
2. Conduct its business with integrity, due care, skill and diligence and deal with all clients fairly;
3. Have in place policies and procedures satisfactory to avoid and mitigate conflicts of interest between the VASPS with its clients, the VASPs and other third parties as well as between VASPS’ clients;
4. Have its financial statements audited with respect to transactions and balances relating to its businesses;
5. Have in place a mechanism for protecting whistle-blowers; and
6. Notify the relevant regulatory body of any material change into the business. Such material changes include Mergers and Acquisition, change of business activity, sale of a subsidiary, change of domain name, change of directorship, change of principal business amongst others.

It is imperative for a VASP to ensure compliance with post-licensing obligations to ensure that it is not suspended or revoked.

The Schedule to the VASP Bill provides for the roles of the CBK, the CMA and the Communication Authority in regulating the different VASPs dependent on the VA service to be provided. The Bill is currently tabled at the National Assembly following its gazettement on March 17^th 2025.

Transitional provisions of the Bill

On commencement of the Bill as an Act, where a person is providing virtual asset services, the person shall make an application under the Act within 6 months upon commencement, to be issued with a licence under the Act. The person may in transition continue to carry out its business activities until its application for a licence is granted or refused.

Conclusion

While Kenya still remains behind in the VAs and VASPs’ regulations scene, the current attempts through the VASP Bill are commendable steps forward. These proposed regulations not only reflect Kenya’s acknowledgment of the growing importance of VAs but also demonstrate a commitment to ensuring their responsible adoption. If successfully enacted, these policies will offer a clearer legal framework, enhance investor confidence, and pave the way for sustainable growth in the virtual asset sector, while addressing risks such as money laundering, fraud, and consumer protection.

 

---

This publication is meant for general information only and does not constitute legal advice, nor does it create an advocate-client relationship between any reader and Mboya Wangong’u & Waiyaki Advocates. For particular expert advice on any matter dealt with above, please contact us on advocate@lexgroupafrica.com for tailored legal support.

Authored:

CG Mbugua, Partner, Corporate Commercial Practice Group

 

Co-Authored:

Jessica Opiyo, Associate

Shamiah Muchesia, Legal Assistant,

Ian Mwithi, Legal Assistant