Centralized exchange in Kenya
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in Kenya with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Customer Due Diligence (CDD): Verify customer identities, maintain UBO records, apply EDD for high-risk relationships (e.g., cross-border VA activities) per POCAMLA standards applied to VASPs.
- Suspicious Transaction Reporting (STR): Report suspicious activities involving virtual assets to the Financial Reporting Centre (FRC) promptly.
- Record-Keeping: Retain transaction records, customer data, and verification documents for at least 7 years.
- Travel Rule obligations are expected to apply under the VASP Act 2025 and Draft Regulations (2026); specific thresholds not yet finalized.
- Licensing from CMA under the Virtual Asset Service Providers Act, 2025 and Draft VASP Regulations, 2026, which impose full AML/CFT compliance programs.
Key Restrictions
- Must obtain a license under the Virtual Asset Service Providers Act, 2025 and comply with Draft VASP Regulations, 2026.
- Must maintain a physical office in Kenya (local entity incorporation required).
- Asset segregation required — e.g., 30% of customer stablecoin funds must be held in Kenyan banks.
- Exchanges offering securities-like crypto assets fall under CMA oversight under the Capital Markets Act.
- CBK regulates payment-system interfaces and stablecoins; any fiat on/off-ramp ties require CBK compliance.
- Geofencing / blocking of US persons may be required depending on token listings and securities classification.
Key Risks
- Enforcement precedent: CBK has successfully forced termination of crypto-related money remittance services (Bitpesa/Lipisha) for operating without authorization.
- Criminal enforcement: DCI Crypto Fraud Unit has handled 500+ cases and made dozens of arrests (2024), indicating active law enforcement scrutiny.
- Regulatory ambiguity: Draft VASP Regulations (2026) are not yet finalized; requirements may shift before finalization.
- Tax exposure: KRA actively taxes crypto income; unclear capital gains vs. income tax treatment may create reporting risk.
- Worldcoin enforcement shows regulators are willing to use data protection laws aggressively against crypto operators collecting biometric data.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Virtual Asset Service Providers Act, 2025: Enacted November 15, 2025 (presidential assent); establishes legal framework for VASPs. Draft regulations operationalize it.
Draft Virtual Asset Service Providers Regulations, 2026: Public participation completed (deadline ~April 10-15, 2026); next steps include review for finalization. Requires licensing, AML/CFT compliance, asset segregation (e.g., 30% customer funds in Kenyan banks for stablecoins), physical offices, fees, and bans on anonymous transactions.
Capital Markets Authority (CMA): Regulates securities-like crypto assets, token offerings, and develops VASP policy. Website: cma.or.ke.
Capital Markets Authority (CMA): Oversees exchanges, brokers, tokenization platforms, and securities-like crypto assets; leading draft regulations.
Capital Markets Authority (CMA): Administers the Capital Markets Act (CMA); leads draft regulations and oversees securities-related VASPs.
Central Bank of Kenya (CBK): Oversees payment systems, wallets, exchanges, and stablecoins interfacing with fiat. Website: centralbank.go.ke.
Financial Reporting Centre (FRC): Primary AML/CFT authority; receives/analyzes STRs. Website: frc.go.ke.
Customer Due Diligence (CDD): Verify customer identities, maintain beneficial ownership (UBO) records, and apply enhanced due diligence for high-risk relationships (e.g., cross-border VA activities).
Suspicious Transaction Reporting (STR): Report suspicious activities, including those involving virtual assets, to the Financial Reporting Centre (FRC) promptly.
Record-Keeping Obligations: Retain transaction records, customer data, and verification documents for at least 7 years (per POCAMLA standards applied to VASPs).
Kenya Revenue Authority (KRA): Handles taxation on crypto income and participates in framework development.
National Treasury and Economic Planning: Chairs inter-agency Technical Working Group, provides policy direction, and finalizes regulations.
Entity targeted: Bitpesa (operating through Lipsha Consortium Limited). Violation type: Operating money remittance business via Bitcoin without CBK authorization; AML/KYC non-compliance due to cryptocurrency anonymity. Penalty amount: None specified (service termination, not direct fine).
Directorate of Criminal Investigations (DCI) Crypto Fraud Unit: Handled over 500 crypto-related cases in past three years; dozens of arrests in 2024. High-profile busts in Nairobi and Nakuru targeted scams worth $119,000, $100,000, and $30,000 (no named entities or penalties detailed). Losses totaled $43.3 million in 2024 scams.
Entity targeted: Tools for Humanity (parent company), Worldcoin Foundation, World Assets Limited, Platinum De Plus Limited. Violation type: Unauthorized collection, processing, and transfer of biometric data (iris scans) without proper registration as data controllers/processors; misrepresentation in registration; potential public safety risks. Penalty amount: No monetary fine specified; potential fines up to KES 3 million (~USD 20,000) or 10 years imprisonment for registration violations; possible equipment forfeiture.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a centralized exchange may operate in Kenya by obtaining a VASP license under the Virtual Asset Service Providers Act, 2025 (with Draft Regulations, 2026), incorporating locally, maintaining a physical office, segregating customer assets (e.g., 30% stablecoin reserves in Kenyan banks), and complying with CMA/CBK oversight and full AML/CFT obligations including CDD, STR, and record-keeping, but the regime is still being finalized via draft regulations.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?