Kenya is taking a significant step toward regulating the digital finance ecosystem through the Virtual Asset Service Providers Bill 2025. This landmark legislation aims to create a comprehensive legal framework for the licensing, regulation, and supervision of virtual asset service providers (VASPs) in the country.
This bill provides long-awaited clarity for businesses in the virtual asset and fintech space – such as crypto exchanges, digital wallets, NFT platforms, and decentralized finance (DeFi) providers.
Definition of a Virtual Asset Under Kenyan Law
Under the Bill, a virtual asset is a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes. It excludes digital representations of fiat currencies, securities, and other financial assets.
To operate as a Virtual Asset Service Provider in Kenya, an entity must be either:
A domestic company registered under the Companies Act, or
A foreign company with a certificate of compliance under the same Act.
Importantly, natural persons are prohibited from carrying out VASP business in their capacity.
Types of VASP Licenses and Their Functions
The Bill outlines several categories of licenses, each aligned with specific business models in the virtual asset ecosystem:
1.) Virtual Asset Wallet Provider
Facilitates the storage of virtual assets on behalf of clients and enables the transfer or exchange of digital assets, including conversions to and from fiat currency.
2). Virtual Asset Exchange
Operates a digital platform for trading, exchanging, and transferring virtual assets, including issuing proprietary tokens and holding client assets.
3). Virtual Asset Payment Processor
Arrange transactions involving the exchange of virtual assets and fiat currency or between different virtual assets.
4.) Virtual Asset Broker
Acts on behalf of clients – such as retail users, institutional investors, or funds – to execute trades through exchanges and wallet providers.
5.) Virtual Assets Investment Advisor
Offers investment advice on virtual assets, including Initial Coin Offerings (ICOs) and Non-Fungible Tokens (NFTs), to individual and institutional clients.
6.) Virtual Asset Manager
Manages client portfolios containing virtual assets, on a discretionary basis and by client mandates.
7.) Virtual Asset Offering Provider
Issues and sells virtual assets to the public and may also offer related financial services tied to initial virtual asset offerings.
Regulatory Authorities for VASPs in Kenya
Oversight of VASPs will be shared between key regulatory bodies:
The Capital Markets Authority (CMA), established under the Capital Markets Act
The Central Bank of Kenya (CBK)
The Bill also grants the Cabinet Secretary for the National Treasury authority to appoint additional regulators via a Kenya Gazette notice, allowing flexibility as the sector evolves.
Licensing Requirements for VASPs in Kenya
To operate legally, a company must obtain a license from the relevant authority and meet the following criteria:
Be a company registered under the Companies Act or have a certificate of compliance
Demonstrate that personnel possess relevant skills, knowledge, and experience
Show capability to meet consumer protection and data protection requirements
Have the financial capacity, including insurance, capital, and solvency
Appoint credible and reputable key officers
Comply with cybersecurity standards under the Computer Misuse and Cybercrimes Act
Have suitable premises or data systems for recordkeeping
Ensure the business model serves the public interest
The authority may approve, conditionally approve, or reject the application. Rejections must be issued in writing with reasons provided. Applicants must also notify the authority within 14 days of any changes to submitted information.
Key Duties and Obligations for Licensed VASPs
Once licensed, VASPs must meet the following operational and ethical standards:
Fit and Proper Persons: Ensure senior management meets suitability criteria
Local Presence: Maintain a physical office in Kenya and appoint two independent directors
Honest & Fair Conduct: Act in clients’ best interests with integrity
Financial Soundness: Maintain minimum capital, solvency, and insurance requirements
Conflict of Interest: Establish internal policies to identify and manage conflicts
Operational Compliance: Adhere to laws governing AML, CFT, CPF, data protection, cybersecurity, and client complaints
Incident Notification: Promptly report operational incidents affecting clients
Change Management: Notify authorities of changes to ownership, key officers, or structure
Cybersecurity Framework: Implement and regularly update cybersecurity protections
Financial Reporting: Submit audited accounts within three months of the financial year-end
CEO Requirements: Employ a CEO approved by the regulator who meets fit and proper criteria
Asset Protection: Ensure clients’ virtual assets are safeguarded from loss or misuse
Additional Conditions: Comply with any further directives from the regulator
Anti-Money Laundering, Terrorism Financing, and Proliferation Financing
The VASP Bill places a strong emphasis on compliance with AML, CFT, and CPF laws. Regulatory bodies may:
Vet VASP staff and board members
Conduct regular inspections and surveillance
Supervise institutions and related entities
Demand documents and information
Issue penalties and enforce compliance measures
All parties involved in the management and operation of VASPs must strictly adhere to these obligations, and violations are classified as criminal offences.
Penalties for Non-Compliance
Failure to comply with the provisions of the Bill carries severe consequences:
Unauthorized Share Transfers:
Individuals: Fine of up to KES 3 million, imprisonment up to 3 years, or both
Companies: Fine of up to KES 5 million
False or Misleading Information:
Individuals: Fine of up to KES 7 million, imprisonment up to 3 years, or both
Companies: Fine of up to KES 20 million
Severe Violations (e.g., operating without a license, money laundering):
Individuals: Fine of up to KES 10 million, imprisonment up to 5 years, or both
Companies: Fine of up to KES 25 million
This post was originally published here.
Follow us on X for the latest posts and updates
Join and interact with our Telegram community
___________________________________________
___________________________________________
