Crypto ATM / kiosk operator in Kenya
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Kenya with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD/EDD: Verify customer identities, maintain UBO records, and apply enhanced due diligence for high-risk relationships under the VASP Act and POCAMLA (ke.licensing.customer-due-diligence-cdd-verify).
- Suspicious Transaction Reporting (STR): Report all suspicious activities to the Financial Reporting Centre (FRC) promptly (ke.licensing.suspicious-transaction-reporting-str-report).
- Record-keeping: Retain transaction records, customer data, and verification documents for at least 7 years (ke.licensing.record-keeping-obligations-retain-transaction-records).
- Cash-transaction reporting thresholds are not explicitly stated in provided facts; however, high-cash operations (ATM/kiosk) would face enhanced scrutiny under the CBK's stance against unauthorized crypto-fiat conduits (ke.enforcement.entity-targeted-bitpesa-operating-through).
- Asset segregation requirement: At least 30% of customer funds must be held in Kenyan banks for stablecoin-related activities; analogous capital-preservation obligations likely apply to cash-in/cash-out kiosk operators (ke.licensing.draft-virtual-asset-service-providers).
Key Restrictions
- Must obtain a VASP license under the Virtual Asset Service Providers Act, 2025 and comply with Draft VASP Regulations, 2026 (ke.licensing.virtual-asset-service-providers-act).
- Physical office in Kenya required (ke.licensing.draft-virtual-asset-service-providers).
- CBK oversight applies to any cash/crypto-fiat interface — kiosk operators exchanging cash for crypto likely fall under CBK's payment-system/remittance jurisdiction (ke.licensing.central-bank-of-kenya-cbk).
- CMA may regulate any kiosk offering cryptoassets that qualify as securities-like instruments (ke.licensing.capital-markets-authority-cma-regulates).
- CBK has historically treated unlicensed crypto-fiat exchange as illegal money remittance, creating precedent risk (ke.enforcement.entity-targeted-bitpesa-operating-through).
- Worldcoin enforcement shows aggressive data-protection scrutiny for biometric/cash-in operations collecting personal data (ke.enforcement.entity-targeted-tools-for-humanity).
Key Risks
- Draft VASP Regulations, 2026 are not yet finalized — regulatory requirements may shift significantly (ke.licensing.draft-virtual-asset-service-providers).
- CBK's established hostility to crypto-fiat channels (Bitpesa precedent) creates enforcement risk even under new VASP law (ke.enforcement.entity-targeted-bitpesa-operating-through).
- DCI Crypto Fraud Unit actively prosecutes crypto-related schemes; high-cash kiosks attract heightened fraud-scrutiny risk (ke.enforcement.directorate-of-criminal-investigations-dci).
- Data protection compliance risk: Operating a kiosk that collects customer biometrics or ID data may trigger ODPC enforcement similar to the Worldcoin ban (ke.enforcement.entity-targeted-tools-for-humanity).
- Tax reporting from KRA on crypto income is developing — uncertain reporting obligations for cash-in/cash-out flows (ke.licensing.kenya-revenue-authority-kra-handles).
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Virtual Asset Service Providers Act, 2025: Enacted November 15, 2025 (presidential assent); establishes legal framework for VASPs. Draft regulations operationalize it.
Draft Virtual Asset Service Providers Regulations, 2026: Public participation completed (deadline ~April 10-15, 2026); next steps include review for finalization. Requires licensing, AML/CFT compliance, asset segregation (e.g., 30% customer funds in Kenyan banks for stablecoins), physical offices, fees, and bans on anonymous transactions.
Virtual Asset Service Providers Bill 2025: https://www.afriwise.com/blog/kenya-now-has-a-crypto-law-virtual-asset-service-providers-vasp-bill-2025
Customer Due Diligence (CDD): Verify customer identities, maintain beneficial ownership (UBO) records, and apply enhanced due diligence for high-risk relationships (e.g., cross-border VA activities).
Suspicious Transaction Reporting (STR): Report suspicious activities, including those involving virtual assets, to the Financial Reporting Centre (FRC) promptly.
Record-Keeping Obligations: Retain transaction records, customer data, and verification documents for at least 7 years (per POCAMLA standards applied to VASPs).
Financial Reporting Centre (FRC): Primary AML/CFT authority; receives/analyzes STRs. Website: frc.go.ke.
Central Bank of Kenya (CBK): Oversees payment systems, wallets, exchanges, and stablecoins interfacing with fiat. Website: centralbank.go.ke.
Capital Markets Authority (CMA): Regulates securities-like crypto assets, token offerings, and develops VASP policy. Website: cma.or.ke.
Entity targeted: Bitpesa (operating through Lipsha Consortium Limited). Violation type: Operating money remittance business via Bitcoin without CBK authorization; AML/KYC non-compliance due to cryptocurrency anonymity. Penalty amount: None specified (service termination, not direct fine).
Entity targeted: Tools for Humanity (parent company), Worldcoin Foundation, World Assets Limited, Platinum De Plus Limited. Violation type: Unauthorized collection, processing, and transfer of biometric data (iris scans) without proper registration as data controllers/processors; misrepresentation in registration; potential public safety risks. Penalty amount: No monetary fine specified; potential fines up to KES 3 million (~USD 20,000) or 10 years imprisonment for registration violations; possible equipment forfeiture.
Directorate of Criminal Investigations (DCI) Crypto Fraud Unit: Handled over 500 crypto-related cases in past three years; dozens of arrests in 2024. High-profile busts in Nairobi and Nakuru targeted scams worth $119,000, $100,000, and $30,000 (no named entities or penalties detailed). Losses totaled $43.3 million in 2024 scams.
Kenya Revenue Authority (KRA): Handles taxation on crypto income and participates in framework development.
Draft National Policy on VAs and VASPs: https://newsite.treasury.go.ke/sites/default/files/Notices/DRAFT-NATIONAL-POLICY-ON-VAs-AND-VASPs.pdf
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators are permitted in Kenya only after obtaining a VASP license under the Virtual Asset Service Providers Act, 2025 (and forthcoming regulations), maintaining a local physical office, complying with CBK oversight for fiat-cash interfaces, and meeting full AML/CFT obligations including CDD, STR reporting to the FRC, and 7-year record-keeping; however, the draft regulations are not yet finalized and CBK enforcement precedent against unauthorized crypto-fiat channels creates material execution risk.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?