Compliance teams in Nairobi are scrambling. The 4 November 2026 deadline is closing in, and every Virtual Asset Service Provider working in or from Kenya now needs a licence under the new Virtual Asset Service Providers Act and its 2026 Regulations. Informal operations are out. The regulatory clock has started ticking for real.
For stablecoin issuers, at least 30% of funds raised must be held in segregated trust accounts at Kenyan commercial banks, with the remainder invested domestically.
What the new rules demand
The Regulations split the sector into ten licensing categories, dividing oversight between the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA). The CBK handles payment flows and monetary stability. The CMA takes investment, trading, and tokenisation. Minimum capital requirements are steep: KSh10 million for brokers and payment processors, KSh100 million for exchanges, KSh150 million for wallet providers, and KSh300 million for stablecoin issuers. The draft rules had set the stablecoin bar at KSh500 million, but the final version cut it to KSh300 million, as detailed in the Liminal Custody regulatory review. Stablecoin issuers must also keep liquid capital of at least KSh60 million or match their 30-day liabilities, whichever is higher. Firms holding more than one licence must meet the highest capital bar plus half again for each extra activity.
Applicants face a tough road. They must name directors, senior officers, major shareholders, and beneficial owners. Business plans, source-of-funds records, and policies on anti-money laundering, data protection, cybersecurity, consumer protection, and business continuity are all required. Exchanges and token platforms must show they have market rules for integrity, order matching, settlement, and dispute resolution. Audited financials, independent IT audits, and penetration test reports are mandatory.
Stablecoin issuers get extra scrutiny. The CBK insists on full asset backing at a 1:1 ratio, with reserves held at a custodian approved by the Central Bank. Quarterly stress tests and independent reserve audits are required. Holders must be able to redeem within two working days. Paying interest to stablecoin holders is banned. These rules aim to guarantee liquidity and protect consumers, as outlined in the Cytonn sector analysis.
The regulatory model introduces dual oversight: the Central Bank of Kenya supervises stablecoin issuers, custodial wallets, and payment operators, while the Capital Markets Authority oversees exchanges and brokers. The rules also address client asset protection and anti-money laundering measures.
Operational consequences for businesses and consumers
VASPs now face a heavy compliance load. Consumer assets must be segregated and reconciled, with clear disclosures on fees, risks, and complaints. Cybersecurity is front and center: regular vulnerability checks, penetration tests, and incident reporting are now standard.
Foreign platforms can’t dodge the rules. Any business targeting Kenyan users or earning from Kenya is inside the regulatory fence, no matter where it is based. Regulatory arbitrage is off the table. After 4 November 2026, running a VASP without a licence becomes a criminal offence under Kenyan law, as confirmed by the Liminal Custody legal update.
For investors and consumers, the new regime offers a due-diligence filter. Users are expected to check a VASP’s licence, understand the risks, and review complaints and redress options. The rules aim to protect consumers and keep the market clean, but they also raise the bar for entry and ongoing operation.
Kenya’s FinTech sector enters a new era
The Virtual Asset Service Providers Regulations end the era of light-touch oversight. Operators who have not started licensing preparations are running out of time. Capital restructuring, governance changes, independent audits, and regulatory paperwork cannot be rushed at the last minute.
The regulatory perimeter is now set. Obligations are spelled out. Non-compliance brings real consequences. The next phase will depend on how businesses adapt to these demands while keeping innovation alive. The sector’s future will be shaped by those who move now. The rest will be locked out after the deadline passes.
