Kenya’s VASP Act 2025: What It Means for Foreign Investors and Operators
Kenya’s enactment of the Virtual Asset Service Providers Act 2025 is the most significant development in the country’s digital finance regulatory landscape to date. Passed by Parliament in October 2025, the Act establishes the first comprehensive legal framework governing crypto exchanges, digital wallet providers, custodians, and related virtual asset service platforms in Kenya. It marks a decisive shift away from the informal and legally ambiguous crypto environment that preceded it, toward a structured, supervised, and internationally aligned regulatory regime.
For foreign companies and individuals, who have been among Kenya’s most active blockchain and digital asset sector participants, the implications are both substantial and immediate. This insight sets out what the Act introduces, how it affects foreign operators and investors, and what practical steps responsible organisations should take now, ahead of the implementing guidelines that will give the regime its operational detail.
Important context: The VASP Act 2025 establishes the legislative framework. Implementing guidelines from the National Treasury are awaited. Until those guidelines are issued, certain procedural details including licensing timelines, fee structures, and specific AML/KYC thresholds remain subject to those forthcoming rules. This article reflects the framework as currently enacted.
1) A formal licensing regime: what it requires and who it covers
The most structurally significant change introduced by the VASP Act is the requirement that all virtual asset service providers obtain a licence before operating in Kenya. The Act covers a broad range of activities: crypto exchanges, digital wallet operators, custodians, digital asset brokers, token issuers, and platforms facilitating cross-border payments using digital assets. Licensing is supervised jointly by the Central Bank of Kenya and the Capital Markets Authority, reflecting the dual financial and capital markets dimensions of virtual asset activity.
For foreign operators, this creates a structural decision point. Informally onboarding Kenyan users from offshore is no longer a viable or legally defensible model. Foreign VASPs must either obtain a local licence, which involves meeting fit and proper requirements and satisfying the CBK and CMA’s supervisory expectations, or operate through a licensed Kenyan VASP partner under a model that allocates responsibilities clearly between the parties.
This approach mirrors the direction taken by regulators in the EU, Singapore, and the UAE, all of whom have moved to require territorial authorisation or regulated partner arrangements for virtual asset activities affecting their residents. Kenya’s decision to align with that direction raises its standing among internationally operating digital finance businesses and signals that the country intends to be a credible regulatory jurisdiction rather than a permissive offshore gateway.
2) AML/KYC and consumer protection standards
The VASP Act introduces mandatory anti-money laundering and know-your-customer obligations for all licensed providers. This includes customer identity verification, ongoing transaction monitoring, and suspicious activity reporting. Consumer protection safeguards are also embedded in the framework, addressing fraud prevention, data misuse, and the standards of disclosure owed to users of digital asset platforms.
For foreign investors using Kenyan platforms, the practical consequence is that the anonymous or lightly verified access that characterised earlier market participation is no longer available. Identity verification will be required and enforced. For foreign firms operating in Kenya, AML compliance is an additive obligation that sits alongside their home-country AML framework, increasing the operational complexity and cost of serving the Kenyan market.
The longer-term benefit, however, is a more trusted and fraud-resistant market. The period before the VASP Act saw a significant number of unregulated offshore platforms operating in Kenya, some of which exposed users to exit scams, insolvency events, and fraud with no regulatory recourse. The new framework is specifically designed to close that gap.
3) Cross-border investment and remittances
Kenya is consistently ranked among the highest-adoption crypto markets globally, and a significant portion of that activity is remittance-driven. The VASP Act acknowledges the importance of digital assets in cross-border financial flows and provides a legal structure within which those flows can operate with certainty.
Diaspora communities and foreign workers in Kenya benefit from a predictable, legally recognised framework for using digital asset platforms to send and receive funds. Transactions through licensed VASPs will be documented and compliant, which carries secondary benefits: those records can support immigration, tax, and financial reporting obligations in other jurisdictions. Foreign fintech businesses with a cross-border remittance focus gain access to a regulated Kenyan operating environment that was previously unavailable to them in a structured form.
Kenya’s established position in mobile money, built significantly through M-Pesa’s growth, and its large crypto adoption base make it a strategically important market for any firm seeking East African expansion with digital asset capabilities. The VASP Act gives that expansion a compliant and structured pathway.
4) A more orderly market: what the removal of unregulated operators means
One of the most commercially significant effects of the VASP Act is the exclusion of unlicensed foreign platforms from the Kenyan market. Before the Act, offshore entities with no local presence, no supervisory accountability, and no compliance infrastructure could and did operate in Kenya. The consequences for Kenyan users were well-documented: fraud exposure, custody risks, and losses from platform failures with no legal recourse.
The Act changes this materially. Unregistered foreign platforms are barred from serving Kenyan clients. Foreign investors engaging with the Kenyan digital asset market are directed toward licensed, regulated, and accountable entities. The reduction in regulatory ambiguity also helps foreign individuals whose trading or investment activity from within Kenya previously created uncertainty for tax reporting and cross-border financial disclosure purposes.
5) Compliance obligations vs reduced legal risk
The VASP Act increases the compliance obligations of foreign companies seeking to participate in the Kenyan market. This includes audit requirements, transaction reporting, record retention, cybersecurity standards, and the resourcing of compliance functions capable of meeting ongoing supervisory expectations. These costs are real and should be factored into any market entry plan.
Against that, the Act removes the legal uncertainty that previously made institutional engagement with the Kenyan crypto market difficult. Banks, telecom operators, and regulated financial institutions that were reluctant to partner with crypto firms, due to the absence of a legal framework and the reputational and regulatory risk of association with unregulated entities, have a clearer basis for engagement once licensing becomes operational. For larger foreign players, this unlocks commercial relationships that were structurally blocked before the Act.
6) Tax transparency and reporting implications
Although the VASP Act is not a tax statute, its licensing and record-keeping architecture supports the broader direction of Kenya’s digital economy tax policy. Kenya has been developing its approach to taxation of digital market participants, and the documentation trail created by licensed VASP operations provides infrastructure on which tax obligations can be more accurately assessed and enforced.
For foreign crypto investors, this means a greater likelihood of clearer and enforceable tax obligations on Kenya-related digital asset activity. Foreign VASPs operating locally will need reporting systems capable of supporting both domestic tax filings and, where applicable, cross-border information exchange obligations. For foreign individuals transacting through Kenyan exchanges, structured records create a more straightforward basis for international tax compliance, which is increasingly expected by regulators in major economies.
7) Summary: the dual impact on foreign participants
The VASP Act transforms Kenya from a loosely regulated and legally uncertain crypto market into a structured digital asset environment with compliance standards comparable to leading international jurisdictions. For foreign participants, the impact falls into two categories that operate simultaneously.
On the opportunity side, the Act provides legal certainty for compliant foreign firms, a legitimate gateway for East African market expansion, the possibility of institutional partnerships with banks and regulated financial entities previously unavailable, and a safer operating environment for foreign individuals using digital asset platforms for trading, investment, or remittances.
On the obligation side, the Act requires local licensing or a licensed partner arrangement, ongoing AML/KYC compliance, consumer protection adherence, transaction reporting and record-keeping, and cybersecurity standards. These obligations are not trivial, but they are the standard expected of any serious digital finance business operating in a regulated market.
Strategic point: The firms that will be best positioned when implementing guidelines are released are those that begin compliance readiness planning now: classifying their activities, assessing their licensing pathway, and building the internal frameworks that any licence application will require.
How MN Legal helps
MN Legal supports virtual asset businesses, fintech operators, and foreign investors navigating Kenya’s evolving digital asset regulatory landscape. As implementing guidelines from the National Treasury are issued, our regulatory and fintech team will be ready to support clients with precision and depth.
Our support covers
Preparing and submitting VASP licence applications, including documentation and regulatory engagement with CBK and CMA. Designing compliant AML/KYC and risk management frameworks tailored to Kenya’s revised standards. Structuring market entry strategies for foreign firms, including subsidiaries, partnership models, and local agent arrangements. Developing internal policies, governance systems, and reporting mechanisms to ensure ongoing compliance. Advising on tax, data protection, and consumer protection considerations that arise under the new regime.
FAQ
What is the Kenya VASP Act 2025?
The Virtual Asset Service Providers Act 2025 is Kenya’s first comprehensive legal framework governing virtual asset service providers including crypto exchanges, wallet providers, custodians, and related platforms. It was passed by Parliament in October 2025 and introduces licensing, AML/KYC obligations, and consumer protection standards under joint CBK and CMA supervision.
Do foreign crypto businesses need a licence to operate in Kenya?
Yes. Under the VASP Act, foreign VASPs can no longer informally serve Kenyan users from offshore. They must either obtain a local licence or operate through a licensed Kenyan VASP partner. The specific licensing procedures will be detailed in the implementing guidelines from the National Treasury.
When will the implementing guidelines be released?
The implementing guidelines are expected from the National Treasury but had not been released at the time of writing. The practical details of licensing procedures, fee structures, and specific compliance thresholds will be contained in those rules. Monitoring their release and preparing in advance is the recommended approach.
What does the VASP Act mean for foreign individuals using Kenyan platforms?
Foreign individuals will face identity verification requirements under AML/KYC standards. In exchange, they gain a more regulated and fraud-resistant environment. Documented transactions through licensed platforms may also support tax and financial reporting obligations in their home jurisdictions.
How should a foreign firm start preparing for VASP Act compliance?
The recommended starting point is to classify your activities under the Act, assess whether a local licence or a licensed partner model is appropriate, begin building AML/KYC and risk management frameworks, and align data protection and cybersecurity standards with what a licence application will require. Legal structuring advice at this stage reduces rework when implementing guidelines are issued.
Disclaimer: This article is general information and does not constitute legal or regulatory advice. The VASP Act 2025 implementing guidelines had not been released at the time of publication. Requirements may change as guidelines are issued. Consult a qualified Kenyan regulatory lawyer for advice specific to your business model and activities.
