“An Act of Parliament to provide a legislative framework to regulate virtual asset service providers and address risks associated with the misuse of virtual assets and virtual asset services, and for connected purposes” – Preamble, The Virtual Asset Service Providers Bill, 2025
The coming into force of Kenya’s Virtual Asset Service Providers Bill, 2025 into law on 15th October 2025 marks a turning point for the country’s fast-growing digital asset market. The Act not only establishes a formal regulatory framework but also redefines how accountability, investor protection, and market stability will shape the crypto regulation sector going forward.
For crypto traders & enthusiasts, exchanges, and investors, this is more than a legal milestone – it’s a structural shift that determines who thrives under the new rules or legitimacy.
Kenya’s Crypto Adoption
According to Chainalysis (Blockchain Analytical firm) 2024 Global Crypto Adoption Index, Kenyans transacted Kshs 426billion between July 2024 and June 2025 through crypto. In addition, the firm ranked Kenya as fourth globally in its adoption of stablecoin (a cryptocurrency pegged to a dollar). These positions Kenya as leader in East Africa on Crypto adoption and transaction volume. (source: Chainalysis 2024).
What the Law Requires
The Act defines a Virtual Asset (VA) as a “digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes and does not include digital representation of fiat currencies, e-money, securities and other financial assets”
It classifies Virtual Asset Service Providers (VASPs) (Local or Foreign company):
- An Exchange – facilitating the exchange of virtual assets for fiat currency or other virtual assets for fiat currency or other virtual assets on behalf of third parties
- Custodian- holding custody or controls virtual assets on behalf of its clients to facilitate an exchange
- Broker- purchases virtual assets from a seller when transactions or bids and offers are matched in order to sell them to a buyer,
The Act, through Parts III-V, establishes three core compliance pillars for all Virtual Asset Service Providers (VASPS):
- Regulatory Compliance
All VASPS must now be licensed by the Capital Markets Authority (CMA) or the Central Bank of Kenya before offering services. They must maintain a registered office in Kenya, demonstrated capital adequacy, solvency, and insurance, and notify the CMA or CBK of ownership or structural changes. VASPs must also meet cybersecurity standards under the Computer Misuse and Cybercrimes Act and satisfy the Authority that they can comply with consumer and data protection laws.
- Customer Protection and Governance
VASPs are required to act with fairness, transparency, and integrity, avoiding conflict of interest and safeguarding clients’ assets. All marketing and promotional materials must be fair, clear, transparent, and not misleading. VASPs must also submit audited financial statements, report cyber or solvency incidents, and ensure directors are fit and proper.
- AML/CFT/CPF Obligations
VASPS are subject to POCAMLA and the Prevention of Terrorism Act, with full accountability for due diligence, transaction monitoring, sanction screening, and suspicious activity reporting.
Risks of Non-Compliance
Failure to comply may trigger license suspension, banking restrictions, regulatory audits and reputation risks.
In addition, the VASPs may be exposed to financial penalties and criminal liability as stipulated under Section 41: Offences and penalties:
For:
a) Individuals to a fine not exceeding Kshs. 10M($77K) or to imprisonment not exceeding ten years or both;
(b) A company, to a fine not exceeding Kshs. 20M($154K) or suspension.
Why Expert Interpretation Matters
The Act’s principles-based design leaves room for regulatory expectation. Knowing how to apply these standards practically requires expertise across law, risk and blockchain forensics.
At RISKHOUSE INTERNATIONAL, we boast of a team of expert investigators who integrate fraud and risk management, regulatory compliance, blockchain forensics, and legal advisory to build frameworks that reflect both the regulator’s expectations and market realities. Partner with RISKHOUSE INTERNATIONAL, to assess your readiness, identify exposure, and build crypto compliance systems that work in practice to stay competitive in Kenya’s Crypto regulatory landscape. Request a VASP Compliance Audit today!