On-shore VASP in Kenya
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is conditionally permitted in Kenya with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD: Verify customer identities, maintain beneficial ownership (UBO) records, and apply enhanced due diligence for high-risk relationships (e.g., cross-border VA activities) per POCAMLA and draft VASP Regulations.
- STR: Report suspicious activities to the Financial Reporting Centre (FRC) promptly.
- Record-keeping: Retain transaction records, customer data, and verification documents for at least 7 years (per POCAMLA standards applied to VASPs).
- AML/CFT compliance program required under the draft Virtual Asset Service Providers Regulations, 2026 and the VASP Act, 2025.
Key Restrictions
- Must hold a license under the Virtual Asset Service Providers Act, 2025 and comply with draft VASP Regulations, 2026.
- Must maintain a physical office in Kenya (per draft VASP Regulations).
- Asset segregation requirement: 30% of customer funds must be held in Kenyan banks for stablecoin-related activities.
- Must comply with multiple regulators: CMA (securities-like crypto assets), CBK (payment systems/stablecoins/fiat interfaces), FRC (AML/CFT), and KRA (taxation).
- CBK has historically warned against virtual currencies in formal banking — payment/stablecoin activities face heightened scrutiny.
- The VASP Act was enacted Nov 2025; draft regulations are in finalization (public participation completed April 2026) — regulatory framework is still developing.
Key Risks
- Regulatory ambiguity: Draft VASP Regulations are not yet final — requirements may shift during finalization.
- Enforcement precedent: CBK has suspended services for unauthorized crypto money remittance (Bitpesa/Lipisha case); Worldcoin banned for data protection violations — demonstrating aggressive enforcement posture.
- Criminal enforcement: DCI Crypto Fraud Unit handles hundreds of cases; scam-related arrests create reputational risk for licensed VASPs.
- Multi-regulator oversight (CMA, CBK, FRC, KRA, ODPC) creates compliance fragmentation and coordination risk.
- Tax treatment of crypto income is still being operationalized by KRA — reporting obligations may evolve.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Virtual Asset Service Providers Act, 2025: Enacted November 15, 2025 (presidential assent); establishes legal framework for VASPs. Draft regulations operationalize it.
Draft Virtual Asset Service Providers Regulations, 2026: Public participation completed (deadline ~April 10-15, 2026); next steps include review for finalization. Requires licensing, AML/CFT compliance, asset segregation (e.g., 30% customer funds in Kenyan banks for stablecoins), physical offices, fees, and bans on anonymous transactions.
Capital Markets Authority (CMA): Regulates securities-like crypto assets, token offerings, and develops VASP policy. Website: cma.or.ke.
Central Bank of Kenya (CBK): Oversees payment systems, wallets, exchanges, and stablecoins interfacing with fiat. Website: centralbank.go.ke.
Financial Reporting Centre (FRC): Primary AML/CFT authority; receives/analyzes STRs. Website: frc.go.ke.
Customer Due Diligence (CDD): Verify customer identities, maintain beneficial ownership (UBO) records, and apply enhanced due diligence for high-risk relationships (e.g., cross-border VA activities).
Suspicious Transaction Reporting (STR): Report suspicious activities, including those involving virtual assets, to the Financial Reporting Centre (FRC) promptly.
Record-Keeping Obligations: Retain transaction records, customer data, and verification documents for at least 7 years (per POCAMLA standards applied to VASPs).
Kenya Revenue Authority (KRA): Handles taxation on crypto income and participates in framework development.
Draft National Policy on VAs and VASPs: https://newsite.treasury.go.ke/sites/default/files/Notices/DRAFT-NATIONAL-POLICY-ON-VAs-AND-VASPs.pdf
Virtual Asset Service Providers Bill 2025: https://www.afriwise.com/blog/kenya-now-has-a-crypto-law-virtual-asset-service-providers-vasp-bill-2025
Capital Markets Authority (CMA): Oversees exchanges, brokers, tokenization platforms, and securities-like crypto assets; leading draft regulations.
Coordination involves a committee including National Intelligence Service and National Counterterrorism Center for oversight.
Entity targeted: Bitpesa (operating through Lipsha Consortium Limited). Violation type: Operating money remittance business via Bitcoin without CBK authorization; AML/KYC non-compliance due to cryptocurrency anonymity. Penalty amount: None specified (service termination, not direct fine).
Entity targeted: Tools for Humanity (parent company), Worldcoin Foundation, World Assets Limited, Platinum De Plus Limited. Violation type: Unauthorized collection, processing, and transfer of biometric data (iris scans) without proper registration as data controllers/processors; misrepresentation in registration; potential public safety risks. Penalty amount: No monetary fine specified; potential fines up to KES 3 million (~USD 20,000) or 10 years imprisonment for registration violations; possible equipment forfeiture.
Directorate of Criminal Investigations (DCI) Crypto Fraud Unit: Handled over 500 crypto-related cases in past three years; dozens of arrests in 2024. High-profile busts in Nairobi and Nakuru targeted scams worth $119,000, $100,000, and $30,000 (no named entities or penalties detailed). Losses totaled $43.3 million in 2024 scams.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — on-shore VASPs are permitted under Kenya's new VASP Act (2025) and draft VASP Regulations (2026), but must obtain a CMA-led license, maintain a physical Kenyan office, comply with comprehensive AML/CFT obligations (CDD, STR, 7-year record-keeping, asset segregation of 30% for stablecoins), and navigate a still-evolving multi-regulator framework with active enforcement precedent.
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?