Custodial wallet / SaaS in Kenya
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Kenya with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD/EDD: Verify customer identities and UBOs; apply enhanced due diligence for high-risk relationships (cross-border VA activities) — per POCAMLA standards applied to VASPs.
- Suspicious Transaction Reporting (STR): Report suspicious activities involving virtual assets to the Financial Reporting Centre (FRC) promptly.
- Record-keeping: Retain transaction records, customer data, and verification documents for at least 7 years (per POCAMLA).
- AML/CFT compliance program required under the VASP Act 2025 and Draft VASP Regulations 2026.
- The SaaS operator (custodian) bears primary AML obligations as the VASP; white-label clients' AML obligations depend on whether they are themselves regulated entities or end users.
Key Restrictions
- Must obtain a VASP license under the Virtual Asset Service Providers Act, 2025 and comply with Draft VASP Regulations 2026.
- Must maintain asset segregation (e.g., 30% of customer stablecoin funds in Kenyan banks).
- Must have a physical office in Kenya (local entity required).
- Must comply with CBK oversight if the wallet interfaces with fiat/payment systems.
- CMA may assert jurisdiction if custodial services involve securities-like crypto assets or tokenized securities.
- Worldcoin/Tools for Humanity enforcement precedent shows severe penalties (HM) for unauthorized biometric data processing — relevant to any custodial model involving identity verification.
Key Risks
- Regulatory framework is nascent — VASP Act passed Nov 2025, Draft Regulations still being finalized (2026). Uncertainty around implementation timelines and supervisory interpretation.
- CBK has a hostile stance toward virtual currencies in formal banking (historical warnings); custodial models interfacing with fiat face bank access risk.
- DCI Crypto Fraud Unit is actively pursuing enforcement — over 500 cases in 3 years; high-profile arrests create reputational and legal risk for custodians.
- BitPesa precedent (service termination by Safaricom/M-PESA) demonstrates practical risk of payment-rail access being cut off for crypto-related activity.
- Tax treatment by KRA on crypto income/custody fees is not fully clarified in the still-evolving regulatory framework.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Virtual Asset Service Providers Act, 2025: Enacted November 15, 2025 (presidential assent); establishes legal framework for VASPs. Draft regulations operationalize it.
Draft Virtual Asset Service Providers Regulations, 2026: Public participation completed (deadline ~April 10-15, 2026); next steps include review for finalization. Requires licensing, AML/CFT compliance, asset segregation (e.g., 30% customer funds in Kenyan banks for stablecoins), physical offices, fees, and bans on anonymous transactions.
Virtual Asset Service Providers Bill 2025: https://www.afriwise.com/blog/kenya-now-has-a-crypto-law-virtual-asset-service-providers-vasp-bill-2025
Draft National Policy on VAs and VASPs: https://newsite.treasury.go.ke/sites/default/files/Notices/DRAFT-NATIONAL-POLICY-ON-VAs-AND-VASPs.pdf
Customer Due Diligence (CDD): Verify customer identities, maintain beneficial ownership (UBO) records, and apply enhanced due diligence for high-risk relationships (e.g., cross-border VA activities).
Suspicious Transaction Reporting (STR): Report suspicious activities, including those involving virtual assets, to the Financial Reporting Centre (FRC) promptly.
Record-Keeping Obligations: Retain transaction records, customer data, and verification documents for at least 7 years (per POCAMLA standards applied to VASPs).
Financial Reporting Centre (FRC): Primary AML/CFT authority; receives/analyzes STRs. Website: frc.go.ke.
Capital Markets Authority (CMA): Regulates securities-like crypto assets, token offerings, and develops VASP policy. Website: cma.or.ke.
Central Bank of Kenya (CBK): Oversees payment systems, wallets, exchanges, and stablecoins interfacing with fiat. Website: centralbank.go.ke.
Capital Markets Authority (CMA): Oversees exchanges, brokers, tokenization platforms, and securities-like crypto assets; leading draft regulations.
Central Bank of Kenya (CBK): Oversees payment systems, wallets, exchanges, and stablecoins interfacing with fiat. Website: centralbank.go.ke.
Kenya Revenue Authority (KRA): Handles taxation on crypto income and participates in framework development.
Entity targeted: Tools for Humanity (parent company), Worldcoin Foundation, World Assets Limited, Platinum De Plus Limited. Violation type: Unauthorized collection, processing, and transfer of biometric data (iris scans) without proper registration as data controllers/processors; misrepresentation in registration; potential public safety risks. Penalty amount: No monetary fine specified; potential fines up to KES 3 million (~USD 20,000) or 10 years imprisonment for registration violations; possible equipment forfeiture.
Entity targeted: Bitpesa (operating through Lipsha Consortium Limited). Violation type: Operating money remittance business via Bitcoin without CBK authorization; AML/KYC non-compliance due to cryptocurrency anonymity. Penalty amount: None specified (service termination, not direct fine).
Directorate of Criminal Investigations (DCI) Crypto Fraud Unit: Handled over 500 crypto-related cases in past three years; dozens of arrests in 2024. High-profile busts in Nairobi and Nakuru targeted scams worth $119,000, $100,000, and $30,000 (no named entities or penalties detailed). Losses totaled $43.3 million in 2024 scams.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet/SaaS providers are permitted under the new VASP Act 2025, but require a VASP license, a local physical office, AML/CFT compliance (CDD, STR, 7-year record-keeping), asset segregation (e.g., 30% stablecoin reserves in Kenyan banks), and must navigate CBK oversight on fiat interfaces and a fledgling regulatory framework still being finalized via 2026 draft regulations.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?