The Virtual Assets Service Providers Act, 2025 (VASPA), which came into force on 4 November 2025, marks a fresh start for both virtual asset service providers and investors.
By introducing a comprehensive regulatory framework for digital assets, VASPA addresses the risks and uncertainties that have long surrounded virtual asset investments.
VASPA provides regulatory certainty and is expected to encourage foreign investment, boost employment within the fintech sector, and encourage stronger partnerships with banks, investors, and local payment platforms.
In the past decade, the CBK’s regulatory position, combined with several high-profile fraud cases, made investing in virtual assets a risky and often unattractive option for Kenyan investors. Regulatory gaps hindered formal investment and left consumers exposed to significant risks. The enactment of VASPA represents a major policy shift, aiming to address these gaps and provide a structured framework for the industry.
It introduces comprehensive oversight across the crypto value chain, regulating service providers and enhancing market integrity. Below, we break down the key provisions of VASPA.
Key provisions
A virtual asset is defined as a digital representation of a value that can be digitally traded or transferred and used for payment or investment purposes. To qualify for licensing, VASPs must either be companies limited by shares registered under the Companies Act, Chapter 486 of the Laws of Kenya (Companies Act), or foreign companies limited by shares and registered in Kenya under the Companies Act.
Regulatory oversight
VASPA introduces a comprehensive licensing framework for VASPs in Kenya, defining the permitted activities to include custody, exchanges, issuance, tokenization and conversion. Instead of creating a new regulator, VASPA distributes oversight responsibilities among existing institutions as follows:
the CBK to oversee licensing for issuance of digital assets and custodial services; and
the CMA to oversee licensing for crypto exchanges and trading platforms.
In addition, the Cabinet Secretary of the National Treasury is empowered to involve additional government agencies and issue guidelines, to provide regulatory oversight for the virtual asset ecosystem.
Operational requirements
VASPA sets out requirements for service providers that are aimed at protecting investors and consumers, as well as promoting the responsible conduct of VASPs. These include:
Licensing: All VASPs, whether local or foreign, must obtain authorisation from the relevant Kenyan regulator.
Directors: To ensure credibility and competence, all directors and senior management must undergo the “fit and proper” assessment.
Approval of material changes: VASPs must obtain approval from the relevant regulator before making material changes to the business activity, including changes to the business plan and changes in share ownership.
Consumer protection: VASPA requires all licensed VASPs to conduct their business prudently and with integrity. They are required to maintain sufficient amounts of each type of virtual asset to meet customer obligations and must keep client assets separate from company assets to protect consumers if the business faces financial difficulties.
Data protection and confidentiality: VASPs are required to comply with provisions of the Data Protection Act, 2019 by ensuring that the recording, storing and transmission of data is secure and in accordance with the law and imposes confidentiality obligations on industry players.
Anti-money laundering (AML) and countering terrorism financing (CFT): VASPs must meet strict AML/CFT requirements, including vetting of all senior staff and establishing strong internal controls to detect, prevent and report suspicious financial activities.
Enforcement: Failure to comply may result in penalties including fines of up KES 20 million, up to five years’ imprisonment, formal warnings and corrective actions, prohibitions and restrictions, suspending or revoking licences, investigations, and imposing administrative penalties.
On 18 November 2025, the CBK and CMA issued a public notice stating that the Cabinet Secretary of National Treasury is developing regulations to provide further guidance on the implementation of VASPA. Licensing of VASPs will begin once these regulations are issued, but no timeline has been provided.
Conclusion
While VASPA introduces much-needed regulation, it has faced criticism for imposing heavy compliance demands on the crypto sector, which could potentially stifle innovation. Notably, it lacks modern regulatory tools such as sandboxes or tiered licensing for startups. The high compliance costs, covering independent IT audits, insurance, and advanced monitoring, increase operating expenses for service providers and customers alike.
In our view, however, VASPA marks a critical and strategic milestone for Kenya. By introducing a comprehensive regulatory framework for digital assets, it addresses the risks and uncertainties that have long surrounded virtual asset investments. VASPA provides regulatory certainty and is expected to encourage foreign investment, boost employment within the fintech sector and encourage stronger partnerships with banks, investors and local payment platforms like M-Pesa.
While VASPA does not answer every question about crypto’s role in Kenya’s economy, it provides a foundation and positions the country as an emerging hub for digital finance in Africa. For investors and industry players, this new regulatory environment signals an opportune moment to consider entry into the Kenyan and African markets.
The information and material published on this website is provided for general purposes only and does not constitute legal advice. We make every effort to ensure that the content is updated regularly and to offer the most current and accurate information. Please consult one of our lawyers on any specific legal problem or matter. We accept no responsibility for any loss or damage, whether direct or consequential, which may arise from reliance on the information contained in these pages. Please refer to our full terms and conditions. Copyright © 2026 Cliffe Dekker Hofmeyr. All rights reserved. For permission to reproduce an article or publication, please contact us cliffedekkerhofmeyr@cdhlegal.com.
Subscribe
We support our clients’ strategic and operational needs by offering innovative, integrated and high quality thought leadership. To stay up to date on the latest legal developments that may potentially impact your business, subscribe to our alerts, seminar and webinar invitations.