NAIROBI — Kenya’s one-year grace period for crypto businesses that were already operating when the country’s new virtual asset law took effect has ended. Ten days on, neither of the two regulators responsible for the sector has published a list of licensed firms.
The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025. Section 47 gave anyone already providing virtual asset services one year from that date to comply with the Act, a window that closed on 4 November 2026.
Regulators: everyone must now apply
In a joint public notice dated 13 November 2026, the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) said the VASP Regulations, 2026 were gazetted on 22 July 2026 under Legal Notice No. 134, bringing the Act into operation.
“Any person(s) providing or intending to provide virtual asset services are required to apply for a licence from the relevant regulatory authority,” the notice said. It added that licensing checklists are available on each regulator’s website and that “the list of licensed VASPs will be published by the respective regulatory authorities.” Applications go to vaspapplications@centralbank.go.ke at the CBK and virtualassets@cma.or.ke at the CMA.
The notice did not set a separate deadline for firms that were operating before the law took effect, and it did not name any licensed provider. When the Act came into force a year ago, the two regulators said in a November 2025 notice that licensing would only begin once the regulations were issued and that they had “not licensed any VASPs under the Act.”
Who regulates what
The law splits supervision between the two bodies. According to People Daily, the CBK will oversee virtual asset wallet providers, payment processors and stablecoin issuers, while the CMA will regulate exchanges, brokers, investment advisers, managers and other investment-related services.
Only companies limited by shares and registered under Kenya’s Companies Act, including registered foreign companies, are eligible to apply, under section 8 of the Act. Section 17 requires each regulator to keep a register of licences and publish an updated copy on its website.
Penalties for operating without a licence
Section 8(2) bars anyone from carrying on, or holding themselves out as carrying on, virtual asset business in or from Kenya without a licence. Under section 40(3), a company convicted of the offence faces a fine of up to KSh 25 million. An individual faces a fine of up to KSh 10 million, up to five years in prison, or both.
The squeeze on timing
Firms had little time to prepare. The final regulations arrived 105 days before the transition ended, and neither the Act nor the regulations says what happens to an operator whose application is still being processed after 4 November, according to an analysis by VASP Tracker, an independent tracker of crypto licensing deadlines. As of 14 November it had found no VASP licence register on either regulator’s website.
Some advisers had warned operators to plan for the strictest reading. Edwin Maina, principal at Hodari Ventures, wrote in September that firms should “treat 4 November 2026 as the date by which you need to hold the licence, not merely to have applied,” The Industry Spread reported.
What it means for Kenyan users
Kenya is one of Africa’s most active markets for peer-to-peer crypto trading and mobile-money on-ramps, and the new regime is meant to bring exchanges, wallets and stablecoin issuers under formal consumer-protection, anti-money-laundering and cybersecurity rules. Until the registers are published, users have no official list to check whether the platform they use has applied for or received a licence.
What to watch next
- The first licence registers on the CBK and CMA websites, as required by section 17.
- Gazette notices of individual licence grants.
- Any regulator statement on firms still operating while their applications are pending, and on foreign platforms that serve Kenyan users.
Fintech Telex will update this story when the first licences are announced. The full list of licence categories, with sources, is available on VASP Tracker’s Kenya page.
