Amka illustration explaining Kenya's Virtual Asset Service Providers Regulations 2026

Kenya now has a formal regulatory framework for businesses that provide virtual-asset services. The Virtual Asset Service Providers Regulations, 2026 were published after the Virtual Asset Service Providers Act, 2025 created the legal basis for licensing and supervising the sector.

The important distinction is this: the framework regulates service providers and activities around virtual assets. It should not be read as a government guarantee that any particular crypto asset is safe, stable or suitable for investment.

Final regulationsPublished in July 2026
Main regulatorsCBK and CMA
Core focusLicensing and supervision
Consumer angleSafeguarding, disclosures and complaints

So, is crypto legal in Kenya?

Kenya has moved away from an unregulated-provider environment toward a statutory framework for virtual-asset businesses. The VASP Act and the 2026 Regulations establish how covered service providers can be licensed and supervised in Kenya.

That does not mean every website, app, token or promoter offering crypto-related services is automatically approved. A platform still needs to fall within the framework and satisfy the applicable licensing and regulatory requirements.

The practical takeaway: “crypto exists under a legal framework” and “this specific provider is licensed and safe” are two different questions. Users should verify the provider, not just the asset name.

What is a VASP?

VASP stands for Virtual Asset Service Provider. In simple terms, it refers to businesses carrying out regulated virtual-asset services such as exchange, transfer, custody or other covered activities for customers.

The regulations operationalise the VASP Act by setting out licensing and supervisory requirements for these businesses.

Why did Kenya introduce the rules?

The regulatory impact statement published during the rule-making process identified several risks associated with an unregulated market: fraud, hacks, insolvency, money laundering, market manipulation, weak safeguarding of customer assets and operational failures.

The stated objectives of the framework include stronger consumer and investor protection, AML/CFT controls, cybersecurity standards, prudential requirements and clearer legal responsibilities for providers.

What changes for crypto platforms?

Providers covered by the framework face formal requirements instead of operating solely on general company registration or an overseas licence. Depending on the activity, the rules deal with areas such as licensing, governance, capital and reserves, client-asset protection, disclosures, record keeping, complaints, cybersecurity and financial-crime controls.

The exact regulator and obligations depend on the type of virtual-asset service being offered. Kenya's framework assigns regulatory responsibilities across the Central Bank of Kenya and the Capital Markets Authority.

What should users check before trusting a platform?

1. Regulatory status: Check whether the provider is authorised for the service it is offering in Kenya.
2. Who holds your assets: Understand custody arrangements and whether client assets are segregated.
3. Fees and withdrawal rules: Read the full fee schedule and any limits before sending money.
4. Risk disclosures: A regulated provider does not make the underlying asset risk-free.
5. Complaints process: Know where to escalate a dispute if something goes wrong.

Does regulation remove crypto risk?

No. Regulation can improve standards around the provider, but virtual assets can still be highly volatile and can lose value. There can also be technology, custody, liquidity and fraud risks.

A licence should therefore be treated as a minimum verification check, not as a promise of returns or protection from market losses.

What should businesses know?

Businesses offering covered virtual-asset services in or from Kenya need to understand whether their activity falls within the licensing framework and which regulator is responsible. The final regulations are now part of the CMA's published regulatory framework.

The National Treasury developed the regulations through a multi-agency process involving CBK and CMA, following public participation earlier in 2026.

Why this matters beyond crypto

The rules are significant because they bring virtual-asset providers into Kenya's wider financial-regulation architecture. That means the conversation is no longer only about token prices. It is also about custody, market conduct, consumer protection, financial crime and accountability.

For ordinary users, the most useful habit is simple: verify the provider before sending money, and separate regulatory status from investment performance.

Sources

Important: This article explains regulation and consumer checks. It is not a recommendation to buy, sell or hold any virtual asset. Regulatory status does not guarantee investment returns or prevent losses.