Kenya’s digital finance sector entered a new era on 15th October 2025, when the Virtual Asset Service Providers (VASP) Act, 2025 was signed into law. For the first time, cryptocurrencies, digital tokens, and the businesses that deal in them are subject to a comprehensive legal and regulatory framework in Kenya.
Before this legislation, virtual assets operated in a largely unregulated space — creating risks for consumers, investors, and the broader financial system. The VASP Act changes that entirely. Whether you operate a crypto exchange, digital wallet, token issuance platform, or virtual asset brokerage, this law applies to you — and non-compliance carries serious legal consequences.
Here is everything you need to know.
What Is a Virtual Asset Under the VASP Act 2025?
Section 2 of the Act defines a virtual asset as a digital representation of value that can be digitally traded, transferred, or used for payment or investment purposes. Importantly, the definition excludes digital representations of fiat currencies, securities, or other regulated financial assets — drawing a clear boundary between virtual assets and traditional financial instruments.
Which Virtual Asset Services Are Regulated?
The First Schedule of the VASP Act sets out the categories of virtual asset services that fall under the regulatory framework. These include:
- Virtual Asset Wallet Providers — Third parties that hold and manage private keys on behalf of users, ensuring proof of ownership and seamless transactions.
- Virtual Asset Exchanges — Platforms enabling users to trade, convert, transfer, and settle virtual assets, including crypto-to-fiat and crypto-to-crypto exchanges.
- Virtual Asset Payment Processors — Entities facilitating transactions between virtual and fiat currencies, commonly used in merchant payments and cross-border remittances.
- Virtual Asset Brokers — Professionals or firms assisting clients in buying, selling, or exchanging virtual assets.
- Virtual Asset Investment Advisors — Providers of investment advice related to virtual assets, including Initial Virtual Asset Offerings (IVAOs) and Non-Fungible Tokens (NFTs).
- Custodial Services — Safekeeping and administration of virtual assets on behalf of clients.
- Transfer Services — Peer-to-peer and cross-border sending and receiving of virtual assets.
- Issuance and Sale of Virtual Assets — Offering new virtual assets to the public through token generation events or IVAOs.
If your business falls into any of these categories, you are now legally required to comply with the VASP Act — regardless of whether you are based in Kenya or serving Kenyan users from abroad.
What Does the VASP Act Set Out to Achieve?
The Act has four core objectives:
1. Establish a Legal Framework for VASPs in Kenya Creating clear rules for how virtual asset businesses are licensed, governed, and supervised — replacing the previous regulatory vacuum.
2. Promote Transparency, Consumer Protection, and Financial Integrity Ensuring that users of virtual asset services are protected from fraud, misrepresentation, and financial loss.
3. Align Kenya with Global AML and Counter-Terrorism Financing Standards Bringing Kenya’s virtual asset regulation in line with Financial Action Task Force (FATF) recommendations — a critical step for Kenya’s international financial credibility and removal from grey lists.
4. Mitigate Cybercrime and Fraud Risks in Digital Asset Markets Imposing cybersecurity and data protection obligations on all regulated entities to protect users and the integrity of Kenya’s digital financial system.
Licensing Requirements — Who Needs a VASP Licence in Kenya?
Under Section 11 of the VASP Act, all virtual asset service providers operating in Kenya must hold a valid licence. Licences are issued annually and come with strict, ongoing compliance obligations.
To qualify for a VASP licence in Kenya, applicants must demonstrate:
- The size, scope, and complexity of the virtual asset service to be provided
- Adequate knowledge, expertise, and experience in virtual asset operations
- Robust cybersecurity and data protection measures in place
- Strong Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) safeguards
- Financial soundness and capacity to meet obligations to clients
- Fit-and-proper standards for directors and senior management, including clean criminal and financial records
Operating as a VASP in Kenya without a licence is a criminal offence attracting fines, imprisonment, or both. Any business currently offering virtual asset services without a licence must move immediately to regularise its status.
Who Regulates VASPs in Kenya?
The VASP Act designates two key regulatory authorities, each with a distinct but complementary mandate:
Capital Markets Authority (CMA)
The CMA oversees issuance, trading, and investment-related virtual asset activities — including token offerings, NFTs, and virtual asset investment advisory services.
Central Bank of Kenya (CBK)
The CBK focuses on payment systems and financial stability — overseeing payment processors, remittance services, and the broader monetary implications of virtual asset use in Kenya.
Both regulators collaborate on consumer protection, cybersecurity, and AML enforcement, and are jointly empowered to investigate, audit, issue administrative sanctions, and refer serious violations for criminal prosecution.
Data Protection Obligations for VASPs
Compliance with the Data Protection Act, 2019 is a specific requirement under the VASP Act. All licensed VASPs must:
- Handle personal data securely and lawfully
- Maintain transparent data processing practices aligned with the Act
- Report data breaches promptly to the Office of the Data Protection Commissioner (ODPC)
- Protect user privacy in accordance with statutory requirements
Data protection breaches attract penalties under both the VASP Act and the Data Protection Act — meaning non-compliant VASPs face a double layer of regulatory exposure.
Penalties for Non-Compliance Under the VASP Act 2025
The Act imposes significant consequences for breaches, including:
- Operating without a licence — A criminal offence attracting fines, imprisonment, or both
- Failure to maintain compliance — Licensed VASPs violating governance, reporting, or cybersecurity standards risk suspension or revocation of their licence
- Fraud or misrepresentation — Providing false information during licensing or operations may lead to criminal prosecution
- Data protection breaches — Mishandling user data attracts additional penalties under both the VASP Act and the Data Protection Act, 2019
The stakes are high. In an environment where both the CMA and CBK have enforcement powers, virtual asset businesses in Kenya cannot afford to treat compliance as an afterthought.
What the VASP Act Means for Kenya’s Digital Economy
The VASP Act 2025 is more than a compliance requirement — it is a signal that Kenya is serious about becoming a credible, well-regulated hub for digital finance in Africa. By aligning with FATF standards, strengthening consumer protection, and bringing previously unregulated actors into the formal financial system, the Act:
- Boosts investor and consumer confidence in Kenya’s virtual asset market
- Reduces the risk of Kenya being used as a conduit for money laundering or terrorism financing
- Creates a level playing field for compliant businesses, rewarding those who invest in governance and compliance
- Opens doors for Kenya’s fintech sector to engage with international partners and regulated markets
For businesses and investors in the virtual asset space, compliance is not just a legal obligation — it is a strategic competitive advantage.
How Unicorn Registrars Can Help Your Business Comply with the VASP Act 2025
At Unicorn Registrars, we provide comprehensive corporate governance, secretarial, and advisory services to help businesses navigate Kenya’s evolving regulatory landscape — including the new VASP Act, 2025.
- Company Incorporation & Secretarial Services — Setting up and maintaining your company in full compliance with the Companies Act and the Certified Public Secretaries Act, with the governance structures required for VASP licensing.
- Corporate Governance Advisory — Helping your board and senior management meet the fit-and-proper standards and governance obligations required under the VASP Act.
- Regulatory Compliance & Filing Support — Managing your ongoing compliance obligations, regulatory filings, and licence renewal requirements with the CMA and CBK.
- Licensing & Restructuring Advisory — Guiding fintech companies, crypto exchanges, and digital asset businesses through the VASP licensing process and any required corporate restructuring.
- Data Protection Compliance — Ensuring your data handling practices meet the requirements of both the VASP Act and the Data Protection Act, 2019 — reducing your risk of regulatory penalties.
Contact Unicorn Registrars today for expert guidance on VASP Act compliance, company governance, and digital asset regulation in Kenya.
Unicorn Registrars is a professional services firm in Nairobi, Kenya, offering business advisory, corporate governance, compliance, licensing support, and company secretarial services across Kenya’s financial and digital sectors.