Briefing
The Kenyan National Assembly has passed the Virtual Assets Service Providers Bill 2025, which, upon presidential assent, will fundamentally restructure the operating environment for all Virtual Asset Service Providers (VASPs) by placing them under the direct regulatory oversight of the Capital Markets Authority and the Central Bank of Kenya. This decisive legislative action immediately operationalizes a comprehensive Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) framework, mandating that all VASPs obtain an annual license, maintain a physical office in Kenya, and report transaction details above a specified threshold. The law provides a critical one-year compliance window for all existing VASPs before enforcement actions, which include license revocation and fines up to KSh 25 million, take effect.
Context
Prior to the passage of this bill, the digital asset market in Kenya operated in a state of regulatory fragmentation, relying on general financial laws and intermittent advisories without a dedicated, unified legal framework for virtual assets. This ambiguity presented a significant compliance challenge, as the absence of clear VASP definitions and mandatory licensing requirements created gaps in the national AML/CFT architecture, leaving the market exposed to illicit finance risks and hindering legitimate institutional engagement. The bill directly addresses this by scrapping the initial proposal for a new regulatory body and instead placing VASPs under the purview of existing, established financial regulators.
Analysis
This new law compels a fundamental update to the operational architecture of all VASPs targeting the Kenyan market, shifting the compliance focus from reactive risk management to proactive, systemic licensing and control. The mandate for a physical office and annual licensing acts as a jurisdictional anchor, directly integrating all VASP operations into the national regulatory perimeter for immediate oversight by the CMA and CBK. Consequently, firms must immediately initiate the process of establishing local corporate structures and overhauling their existing AML/KYC protocols to meet the new transaction reporting thresholds and ongoing due diligence standards, making regulatory adherence a prerequisite for market access. The requirement to comply with the AML/CFT framework will necessitate the integration of blockchain analytics tools and enhanced client onboarding procedures to ensure the traceability of funds and the mitigation of financial crime risk.
Parameters
- Compliance Window → One year (VASPs have 12 months from enactment to fully comply with all licensing and operational requirements).
- Maximum Fine → KSh 25 million (The maximum penalty for non-compliance, equivalent to approximately $194,000).
- Regulatory Authority → CMA and CBK (The two primary existing financial regulators now jointly overseeing VASPs, replacing the initially proposed new agency).
Outlook
The bill’s imminent enactment establishes a clear, precedent-setting framework in East Africa, likely influencing regulatory design in neighboring jurisdictions and accelerating the adoption of the Financial Action Task Force (FATF) standards across the continent. The next phase involves the issuance of detailed regulations and guidelines by the CMA and CBK to clarify specific licensing criteria and transaction reporting thresholds, which will be critical for operationalizing the law. While the clarity is a strategic benefit, the stringent physical presence and capital requirements may present a short-term barrier to entry for smaller, decentralized foreign operators, potentially consolidating the market around well-capitalized, locally-compliant entities.
Verdict
This legislation is a definitive maturation signal, transitioning the Kenyan digital asset market from an unregulated frontier to a formal, compliance-driven financial sector, thereby unlocking institutional confidence while systematically mitigating financial crime risk.
