Self-custodial wallet / non-custodial software in Kenya
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Kenya without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
Key Restrictions
- The publisher does not hold, control, or have access to user funds — this falls outside the VASP definition under the VASP Act 2025, which targets providers who 'hold, transfer, or exchange' virtual assets on behalf of customers.
- No licensing requirement under the VASP Act 2025 for pure software publishing without custody or intermediary services.
- The developer must ensure the software does not itself constitute a 'payment system' or 'money remittance service' under CBK oversight, or interface with fiat on behalf of users.
Key Risks
- Regulatory ambiguity: Kenya's VASP framework (VASP Act 2025, Draft Regulations 2026) is newly enacted and untested — definitions of 'virtual asset service' could be interpreted expansively by regulators (CMA, CBK).
- Enforcement precedent: The Tools for Humanity/Worldcoin enforcement shows aggressive data protection enforcement — if the wallet app collects biometric or personal data, the Data Protection Act (ODPC oversight) applies strictly.
- Tax risk: The Kenya Revenue Authority (KRA) treats crypto income as taxable; developers generating revenue (e.g., fees, token sales) may face tax obligations even if AML/VASP licensing does not apply.
- Reputational risk: DCI Crypto Fraud Unit has made arrests and handled 500+ crypto cases; association with crypto may invite scrutiny even if legal compliance is sound.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Virtual Asset Service Providers Act, 2025: Enacted November 15, 2025 (presidential assent); establishes legal framework for VASPs. Draft regulations operationalize it.
Draft Virtual Asset Service Providers Regulations, 2026: Public participation completed (deadline ~April 10-15, 2026); next steps include review for finalization. Requires licensing, AML/CFT compliance, asset segregation (e.g., 30% customer funds in Kenyan banks for stablecoins), physical offices, fees, and bans on anonymous transactions.
Capital Markets Authority (CMA): Regulates securities-like crypto assets, token offerings, and develops VASP policy. Website: cma.or.ke.
Central Bank of Kenya (CBK): Oversees payment systems, wallets, exchanges, and stablecoins interfacing with fiat. Website: centralbank.go.ke.
Entity targeted: Tools for Humanity (parent company), Worldcoin Foundation, World Assets Limited, Platinum De Plus Limited. Violation type: Unauthorized collection, processing, and transfer of biometric data (iris scans) without proper registration as data controllers/processors; misrepresentation in registration; potential public safety risks. Penalty amount: No monetary fine specified; potential fines up to KES 3 million (~USD 20,000) or 10 years imprisonment for registration violations; possible equipment forfeiture.
Entity targeted: Bitpesa (operating through Lipsha Consortium Limited). Violation type: Operating money remittance business via Bitcoin without CBK authorization; AML/KYC non-compliance due to cryptocurrency anonymity. Penalty amount: None specified (service termination, not direct fine).
Kenya Revenue Authority (KRA): Handles taxation on crypto income and participates in framework development.
Directorate of Criminal Investigations (DCI) Crypto Fraud Unit: Handled over 500 crypto-related cases in past three years; dozens of arrests in 2024. High-profile busts in Nairobi and Nakuru targeted scams worth $119,000, $100,000, and $30,000 (no named entities or penalties detailed). Losses totaled $43.3 million in 2024 scams.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — publishing non-custodial wallet software in Kenya does not trigger VASP licensing or AML obligations because the publisher never holds customer funds, but developers must ensure no fiat payment-system integration (CBK oversight) and must comply with data protection laws (ODPC) if collecting personal data, plus face KRA tax obligations on revenue.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?