Kenya Gazettes Crypto Regulations: New Rules for Exchanges, Wallets and Stablecoins

Imagine opening your usual crypto exchange in Nairobi to buy USDT, only to find that the platform is asking for additional identity information or changing some of its services for Kenyan users.

That may become more common as Kenya begins implementing its new cryptocurrency regulatory framework.

Kenya has officially gazetted the Virtual Asset Service Providers Regulations, 2026, creating detailed licensing and operating requirements for crypto exchanges, custodial wallet providers, payment processors, brokers and stablecoin issuers.

The regulations were published as Legal Notice No. 134 of 2026 on 22 July 2026. They provide the practical rules needed to implement the Virtual Asset Service Providers Act, 2025, which came into operation on 4 November 2025.

The final regulations mark a significant change for Kenya’s crypto industry. Virtual asset businesses now have clearer requirements covering licensing, capital, consumer protection, stablecoin reserves, cybersecurity and anti-money-laundering controls.

What Has Kenya Gazetted?

The new rules are formally known as the Virtual Asset Service Providers Regulations, 2026.

The parent Act established the legal framework and identified the types of crypto businesses that require licences. However, companies still needed detailed regulations explaining how to apply, how much capital they must maintain and how they should protect customers.

The newly gazetted regulations fill much of that gap.

They set rules for:

• Licensing applications and renewals.
• Minimum paid-up and liquid capital.
• Corporate governance.
• Insurance.
• Anti-money-laundering controls.
• Cybersecurity and data protection.
• Consumer complaints.
• Custody and segregation of customer assets.
• Stablecoin issuance and reserve management.
• Virtual asset offerings and tokenisation.
• Regulatory reporting and inspections.

The regulations are now listed by Kenya Law as Legal Notice No. 134 of 2026.

Which Crypto Businesses Need a Licence?

Kenya has adopted an activity-based licensing model. This means a company may need more than one licence if it provides several regulated services.

The framework covers:

• Custodial wallet providers.
• Cryptocurrency exchanges.
• Virtual asset payment processors.
• Crypto brokers.
• Virtual asset investment advisers.
• Virtual asset managers.
• Initial coin offering providers.
• Tokenisation providers.
• Token issuance platforms.
• Stablecoin issuers.

For example, a crypto exchange that also controls customers’ private keys may be providing both exchange and custodial wallet services. Depending on how the platform operates, it could require approval from more than one regulator.

Non-custodial wallets, where users retain control of their private keys, are treated differently from custodial services under the framework.

CBK and CMA Will Share Regulatory Responsibility

The regulations retain Kenya’s dual-regulator structure.

The Central Bank of Kenya will generally supervise payment-related virtual asset services, including:

• Custodial wallet providers.
• Virtual asset payment processors.
• Stablecoin issuers.

The Capital Markets Authority will generally supervise investment and trading-related services, including:

• Cryptocurrency exchanges.
• Crypto brokers.
• Virtual asset investment advisers.
• Virtual asset managers.
• Initial coin offerings.
• Tokenisation services.
• Token issuance platforms.

A company offering several services may therefore need to deal with both the CBK and CMA. The allocation of responsibilities follows the categories established under the Virtual Asset Service Providers Act.

Offshore Crypto Companies Are Also Covered

The regulations are not limited to companies with physical offices in Kenya.

A foreign crypto platform may fall within the framework if it actively solicits Kenyan customers or derives income or another economic benefit from Kenya, regardless of where its servers, headquarters or employees are located.

This could affect international exchanges that allow Kenyans to:

• Open accounts.
• Deposit or withdraw Kenyan shillings.
• Trade crypto using locally targeted services.
• Access Kenyan marketing campaigns.
• Use local payment methods.
• Participate in Kenya-focused promotions or referral programmes.

An offshore exchange cannot necessarily avoid Kenyan regulation simply because it is incorporated in another country.

The extraterritorial approach is consistent with a wider international effort to address risks created by offshore virtual asset platforms. The Financial Action Task Force reported in July 2026 that a growing number of jurisdictions were extending registration or licensing requirements to offshore providers that serve their residents. FATF’s 2026 virtual-assets update

What Will Crypto Companies Need to Provide?

Applying for a Kenyan VASP licence will require more than registering a company and paying an application fee.

Applicants are expected to provide information and documents demonstrating that the business is financially sound, properly managed and capable of protecting customers.

These may include:

• A detailed business plan.
• The proposed ownership and management structure.
• Information about directors and significant shareholders.
• Fit-and-proper assessments.
• Evidence showing the source of the company’s funds.
• Audited financial statements.
• Anti-money-laundering and counter-terrorist-financing policies.
• Cybersecurity and data-protection policies.
• Consumer-protection and complaint-handling procedures.
• Risk-management and business-continuity plans.
• Evidence of the required paid-up and liquid capital.
• Details of custody, transaction monitoring and record-keeping systems.

Applicants will also have to satisfy category-specific capital, liquidity and insurance requirements.

Licences will be renewed annually, meaning compliance will not end after the initial approval.

The Act requires the relevant regulator to publish the grant of a licence in the Kenya Gazette within 30 days. This should not be confused with a guarantee that every licence application will be decided within 30 days.

New Capital Requirements Could Favour Larger Companies

One of the most debated parts of Kenya’s crypto framework is the amount of capital that different providers must maintain.

The regulations establish separate paid-up and liquid-capital requirements for wallets, exchanges, brokers, advisers, managers, payment processors, token platforms and stablecoin issuers.

Higher-risk activities, particularly custody, exchange operations and stablecoin issuance, face significantly higher financial requirements than advisory services.

The government’s reasoning is understandable. A company holding customer assets or issuing a stablecoin can expose the public to substantial losses if it collapses.

However, the requirements could also make it difficult for smaller Kenyan crypto startups to obtain licences. Firms will need capital for regulatory purposes in addition to the money required for technology, employees, cybersecurity, legal support and day-to-day operations.

The result could be a market dominated by larger companies and well-funded international platforms.

What the Regulations Mean for Crypto Exchanges

Crypto exchanges serving Kenya will need to demonstrate that they can operate fair, transparent and secure markets.

Compliance obligations are likely to include:

• Identifying and verifying customers.
• Monitoring transactions for suspicious activity.
• Keeping proper transaction records.
• Separating customer assets from company assets.
• Maintaining adequate cybersecurity controls.
• Disclosing fees and material risks.
• Preventing market manipulation and conflicts of interest.
• Establishing systems for customer complaints.
• Reporting relevant information to regulators.
• Maintaining the required capital and insurance.

The rules could make it easier for Kenyan consumers to identify platforms that are subject to local oversight.

However, they may also cause some foreign exchanges to restrict Kenyan accounts rather than incur the cost of obtaining a Kenyan licence.

What the Regulations Mean for Wallet Providers

The licensing framework mainly targets custodial wallet services.

In a custodial wallet, a company controls or manages the private keys used to access a customer’s crypto. This means the provider may be able to move, freeze or recover the assets, depending on the platform’s structure.

Because customers depend on the provider, custodial wallet companies will face requirements covering:

• Protection of private keys.
• Secure storage of virtual assets.
• Separation of customer and company assets.
• Cybersecurity and access controls.
• Recovery and business-continuity procedures.
• Record keeping.
• Customer disclosures.
• Sufficient reserves to meet withdrawal requests.

This is particularly important following several global crypto failures in which customers discovered that platforms had used or mixed customer assets with company funds.

People using genuinely non-custodial wallets, where they independently control their private keys, are not operating custodial wallet businesses merely by holding crypto for themselves.

New Rules for Stablecoin Issuers

Stablecoins receive dedicated attention under the new regulations.

An issuer will need to maintain reserve assets supporting the stablecoins in circulation. The framework also introduces rules covering:

• Reserve backing.
• Custody of reserve assets.
• Segregation of reserves.
• Regular reconciliation.
• Redemption rights.
• Disclosure of reserve arrangements.
• Independent assurance or audit requirements.
• Stablecoin white papers.
• Restrictions on how reserves may be invested.
• A prohibition on paying interest directly to stablecoin holders.

A white paper must explain how the stablecoin works, the identity of the issuer, the assets supporting it, the risks involved and how holders can redeem their tokens.

These requirements are intended to reduce the risk of an issuer creating tokens without sufficient assets available to honour redemptions.

For users, the key question will no longer be whether a stablecoin claims to be worth one US dollar. Users will need to understand who issued it, where the reserves are held and whether the issuer is licensed to serve the Kenyan market.

Will Ordinary Crypto Users Need a Licence?

No.

The framework regulates businesses providing virtual asset services for or on behalf of other people. It does not require an individual to obtain a VASP licence simply to:

• Buy or hold Bitcoin.
• Store crypto in a personal wallet.
• Transfer crypto between personal wallets.
• Trade using a licensed platform.
• Pay for goods or services using virtual assets where accepted.

The regulations do not ban cryptocurrency in Kenya. Instead, they regulate the companies that provide crypto-related services.

Users may nevertheless experience more identity checks, source-of-funds questions and transaction monitoring as platforms strengthen their compliance systems.

What Happens to Existing Crypto Companies?

The VASP Act gave businesses already providing regulated virtual asset services one year from the Act’s commencement to comply with the new framework.

Since the Act commenced on 4 November 2025, the transitional period is expected to end on 4 November 2026.

That gives existing exchanges, wallets and other crypto providers a relatively short period after the July gazettement to complete applications, raise the necessary capital and implement compliance systems.

Operating without the required licence after the applicable transition period could expose a business and its responsible officers to regulatory action, substantial fines and possible criminal penalties.

Why Kenya Is Regulating Crypto Now

Kenya is one of Africa’s most active digital-finance markets. Crypto is used for trading, investment, cross-border payments, remittances and online business.

However, adoption has developed faster than regulation.

The new framework is intended to:

• Protect consumers.
• Reduce fraud and misuse of customer funds.
• Strengthen anti-money-laundering controls.
• Give legitimate crypto businesses regulatory certainty.
• Attract institutional investment.
• Improve oversight of offshore platforms.
• Support Kenya’s work toward leaving the FATF grey list.

Kenya has been under increased FATF monitoring since February 2024. In February 2026, FATF recognised the country for adopting a legal framework for licensing and supervising VASPs, although Kenya remained under increased monitoring as of June 2026. FATF statement on Kenya, FATF grey-list status

Frequently Asked Questions

Has Kenya banned cryptocurrency?

No. Kenya has created a licensing and supervision framework for businesses providing crypto-related services. Individuals can still buy, hold and transfer virtual assets, subject to applicable laws.

Are Kenya’s crypto regulations now official?

Yes. The Virtual Asset Service Providers Regulations, 2026 were gazetted as Legal Notice No. 134 of 2026.

Who will regulate crypto exchanges in Kenya?

The Capital Markets Authority will generally regulate crypto exchanges, brokers, investment advisers, managers and token-offering platforms.

Who will regulate stablecoins and crypto wallets?

The Central Bank of Kenya will generally regulate stablecoin issuers, payment processors and custodial wallet providers.

Will international exchanges need Kenyan licences?

A foreign platform may require a Kenyan licence if it actively offers virtual asset services to Kenyan customers or derives income or economic benefit from Kenya.

Do personal crypto wallets require licences?

People do not require licences simply to hold their own crypto. Licensing primarily applies to businesses that provide custodial or other regulated virtual asset services for customers.

When must existing crypto companies comply?

The VASP Act provided a one-year transition from its commencement on 4 November 2025. Existing providers should therefore prepare for the transition period to expire on 4 November 2026, subject to any further directions issued by the regulators.