Kenya Makes Crypto Law: The VASP Act Is Now Official
This morning, the Virtual Asset Service Providers (VASP) Bill, 2025, received Presidential Assent and officially became an Act of Parliament. This move establishes the country’s first comprehensive legal framework for virtual assets and marks a defining moment for Kenya’s fintech evolution.
The country now joins Mauritius, South Africa, and Nigeria on the shortlist of African nations with dedicated digital-asset laws. This serves as a collaborative model designed to bring regulators and innovators to the same table.
Dual Regulators, Unified Vision
In a landmark partnership, the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) will co-regulate the virtual-asset sector, bridging monetary policy with capital markets supervision.
Together, they will license and monitor exchanges, wallet providers, token issuers, and investment managers. The Act also empowers the Cabinet Secretary for the National Treasury to issue detailed regulations covering stablecoins, the tokenization of assets, DeFi protocols, and digital-asset advertising.
What the VASP Act Covers
The framework establishes clear guardrails for the entire ecosystem. We’re gonna get a bit legal here. So this is what’s going on:
1. Stablecoin issuance and reserve management
The VASP Act explicitly brings stablecoin issuers into the regulatory perimeter, requiring those who issue or operate stablecoins to be licensed and to meet reserve, custody and disclosure rules designed to ensure the token’s backing is credible and auditable. The law empowers regulators to set reserve-asset standards and periodic attestation or audit requirements so that dollar-pegged tokens cannot claim backing without verifiable reserves
2. Tokenization of real-world and financial assetsTokenization is recognized and regulated: the Bill provides for rules around issuance, custody, and transfer of tokenized real-world assets (from property to securities), including record-keeping, provenance, and how token rights map to legal claims on underlying assets. A necessary step for on-chain collateralization or securities token offerings. Regulators can set rules ensuring tokenized assets meet existing property and securities laws
3. Public Offerings (ICOs, STOs, IEOs)
Public token offerings must follow the Act’s licensing and disclosure regime: issuers running ICOs/IEOs/STOs are required to register, provide prospectus-level disclosures, and comply with investor-protection and anti-fraud rules. The CMA’s remit over capital-markets-style token offerings means tokens that function like securities will be subject to securities law-style oversight
4. Exchanges and Custody providers
Crypto trading platforms, custodians and wallet providers must obtain licences, implement operational controls, and meet safekeeping and segregation requirements for client assets. The law gives regulators powers to inspect, require proof of solvency, and impose operational standards for custody and settlement to reduce counterparty and custody risk.
5. Investment Advisory, fund management, and broker-dealer roles
The Act brings digital-asset investment advisory and fund management into a regulated gate: anyone advising on virtual-asset investments or managing pooled tokenized funds must be licensed, comply with suitability and disclosure rules, and fall under conduct-of-business supervision similar to traditional investment managers. This is meant to protect retail investors and limit unregulated wealth management in crypto.
6. Capital, solvency, and insurance thresholds
Licensees are required to hold minimum capital, meet solvency tests, and, where relevant, secure insurance or contingency funding to protect clients against operational failure or fraud. The Act empowers regulators to set capital adequacy rules and require insurance or guarantee mechanisms for custodial losses, mirroring traditional prudential standards adjusted for crypto risks.
7. Advertising, market-conduct, and cybersecurity standards
The Bill sets market-conduct rules and advertising controls for virtual assets. This will include truthful marketing, disclosures of risks, and bans on misleading claims, while obliging VASPs to adopt cybersecurity, incident-response and data-protection controls to guard platforms and client data. Regulators can publish codes of conduct and impose penalties for breaches.
8. AML/CFT/CPF compliance aligned with global FATF benchmarks
The Act builds AML/CFT/CPF requirements into the VASP licensing regime, requiring robust KYC, transaction monitoring, suspicious-activity reporting, and cross-border cooperation consistent with FATF guidelines, reflecting Kenya’s existing AML priorities and IMF recommendations. Regulators are empowered to enforce sanctions, require audits, and ensure VASPs plug into national AML frameworks.
In short, every part of Kenya’s digital asset ecosystem now falls under direct legal supervision.
Why This Moment Matters
For years, Kenya’s crypto builders operated in a policy vacuum. Startups have innovated, banks have hesitated, and regulators have observed. The VASP Act transforms this landscape.
It creates a regulatory runway for:
→ Licensed exchanges to emerge from the grey market.
→ Tokenized projects to raise capital with compliance.
→ Investors to trade and hold assets with legal protection.
→ Stablecoins to gain legitimacy for payments and remittances.
This Act is the bridge between grassroots innovation and institutional trust; the clarity that investors and enterprises have been waiting for.
With the rules of engagement finally in black and white, expect to see a rapid market formalization: local startups re-incorporating as licensed VASPs, banks cautiously reopening financial rails to vetted crypto clients, and DAOs exploring legal wrappers.
The real test, however, lies in execution. How the CBK, CMA, and Treasury coordinate and enforce this Act will determine whether Kenya becomes Africa’s crypto capital or a cautionary tale of good policy and slow delivery.
Either way, this is history.
In Conclusion
Kenya just turned its crypto conversation into law. The next chapter is implementation—and we’ll be here to cover every block of it.
