Law Commentaries

Virtual Asset Service Providers Bill, 2025

The Virtual Asset Service Providers (VASPs) Bill, 2025, gazetted on 17th March 2025, in Kenya, marks a transformative step toward establishing a comprehensive regulatory framework for virtual assets and their service providers. This commentary provides a detailed analysis of the Bill’s provisions, focusing on its objectives, key updates, and implications for businesses, regulators, and consumers. The Bill addresses long-standing regulatory gaps, aligns with international standards, and seeks to balance innovation with financial stability, consumer protection, and anti-money laundering (AML) and counter-terrorism financing (CFT) compliance. By comparing its provisions to prior regulatory approaches and global benchmarks, this commentary evaluates its potential to position Kenya as a competitive player in the global digital economy.

Background and Objectives

The Bill emerges in response to the growing prominence of virtual assets in Kenya, driven by increasing adoption of cryptocurrencies and blockchain-based technologies. Historically, Kenya’s regulatory approach to virtual assets relied on existing mandates of the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA), supplemented by public notices and guidelines. For instance, a 2015 CBK notice cautioned against virtual currencies like Bitcoin, citing their decentralized nature, risks of illicit use, and lack of consumer protections. A 2023 CBK discussion paper on Central Bank Digital Currencies (CBDCs) acknowledged the need for tailored regulation to address these risks while fostering innovation. The Bill builds on these foundations, aiming to provide a legislative framework for licensing and regulating VASPs, ensuring transparency, accountability, and market integrity while promoting innovation and consumer protection.

Institutional Clarity and Regulatory Oversight

A cornerstone of the Bill is its establishment of clear regulatory roles, addressing previous ambiguities in Kenya’s virtual asset policy framework. Section 6 designates the CBK, CMA, and other public bodies (as specified by the Cabinet Secretary) as regulatory authorities. The First Schedule categorizes virtual asset services, assigning specific functions to each regulator. The CBK oversees wallet services, including custodial wallets, aligning with its mandate over payment systems, while the CMA regulates exchanges, initial coin offerings (ICOs), and token issuance platforms, reflecting its expertise in investment and trading activities. Stablecoins fall under CBK oversight, recognizing their role as payment instruments, while token platforms for real asset issuance and secondary trading are CMA-regulated, supporting innovation in asset tokenization.

This structured division minimizes jurisdictional overlap, enhances regulatory efficiency, and provides clear guidance to market participants. The Bill’s guiding principles—financial stability, market integrity, innovation, and prevention of reputational damage—further align with global standards, such as those of the Financial Action Task Force (FATF). By fostering regulatory certainty, the Bill positions Kenya to attract virtual asset entrepreneurs and investors, mirroring successful frameworks like South Africa’s, where the Financial Sector Conduct Authority (FSCA) has licensed over 200 Crypto Asset Service Providers since 2023.

The clear delineation of roles reduces legal ambiguity, enabling VASPs to navigate compliance requirements with confidence. However, effective coordination between the CBK and CMA will be critical to avoid gaps or inconsistencies in enforcement.

Expanded Definitions and Prohibited Services

The Bill introduces critical definitions to address emerging risks in the virtual asset ecosystem. Terms like “anonymity-enhancing services,” “mixer or tumbler services,” “custodial wallet,” and “stablecoins” are defined to enhance regulatory precision. Anonymity-enhancing services, which conceal transaction details, and mixer or tumbler services, which obscure fund origins, are explicitly prohibited. These measures target the use of virtual assets in money laundering, terrorist financing, and other illicit activities, aligning with FATF recommendations to ensure transaction traceability.

The designation of stablecoins as CBK-regulated instruments reflects their growing role in digital payments, while CMA oversight of ICOs and token platforms supports innovation in capital-raising and asset-backed tokens. The Bill’s prohibition of anonymity-enhancing services promotes transparency, ensuring that virtual asset transactions are subject to the same scrutiny as traditional financial systems.

Businesses offering custodial wallets or stablecoins must comply with CBK regulations, while those involved in ICOs or token platforms face CMA scrutiny. The ban on anonymity-enhancing services may restrict certain blockchain-based offerings but strengthens Kenya’s AML/CFT framework, enhancing its global financial reputation.

Licensing Requirements and Governance Standards

The Bill imposes stringent licensing requirements to ensure only qualified entities operate in Kenya’s virtual asset market. No person or entity may provide virtual asset services without a license from the relevant regulatory authority. The application process requires formal submission, supporting documentation, and a prescribed fee. Regulators assess applications based on factors such as:

  • The applicant’s qualifications under Section 3(1).

  • The expertise and experience of personnel.

  • Financial stability, including capital reserves, solvency, and insurance.

  • AML/CFT procedures, data protection systems, and internal safeguards.

  • The service’s size, scope, complexity, and underlying technology.

  • Risks to clients, other licensees, or Kenya’s financial system.

  • The potential to promote innovation, competition, and consumer benefits.

  • The fitness and propriety of directors, senior officers, and beneficial owners.

  • No-objection from other regulators if the applicant operates in a regulated sector.

Successful applicants receive a license, published in the Kenya Gazette within 30 days, with or without conditions. Denied applicants receive written reasons, ensuring transparency. Additionally, the Bill mandates a physical office in Kenya, replacing the previous requirement of a registered address. This facilitates on-site inspections, enabling regulators to verify compliance, review systems, and ensure operational presence. The minimum board composition increases to three natural-person directors, up from two, with directors permitted to serve on up to two VASP boards, balancing governance rigor with sector flexibility.

The physical office requirement and enhanced governance standards strengthen regulatory oversight but may increase costs for VASPs, particularly startups. The flexible board membership rules support the sector’s growth by leveraging limited expertise, while the rigorous licensing criteria ensure only robust entities operate, enhancing market credibility.

Compliance and Consumer Protection Measures

The Bill introduces robust compliance obligations to protect consumers and maintain market integrity. VASPs must maintain accurate records, conduct customer due diligence (CDD), report suspicious transactions, and comply with data protection and consumer protection standards. These duties enable regulators to monitor operations, assess systemic risks, and enforce compliance, while fostering consumer trust through responsible operations.

A key provision allows regulators to suspend, vary, or revoke licenses for fraudulent or misleading marketing practices, protecting investors from deceptive promotions. Penalties for non-compliance are significant, with fines of Kshs. 3 million for individuals and Kshs. 10 million for companies. The Bill also mandates compliance with the Data Protection Act, 2019, addressing a critical pain point in digital finance. CEOs must promptly report material changes, such as shifts in banking arrangements or ownership, ensuring regulators can mitigate risks from operational or structural changes.

The requirement to segregate client assets from proprietary or non-client assets is a cornerstone of consumer protection. By maintaining distinct accounts or wallets, VASPs safeguard client assets against insolvency, fraud, or operational failures, enhancing accountability and facilitating asset recovery. The Bill’s alignment with the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) further strengthens its AML/CFT framework by defining VASPs, expanding the “reporting institution” definition to include them, and prohibiting anonymity-enhancing services.

VASPs must invest in compliance infrastructure, including data protection, asset segregation, and AML/CFT systems. The heightened penalties and reporting requirements deter non-compliance but increase operational burdens. Consumers benefit from enhanced protections, fostering trust in virtual asset services.

Enforcement Framework

The Bill establishes a tiered enforcement framework, balancing market discipline with sectoral growth. Regulatory authorities wield broad administrative powers, including issuing written notices, directing remedial actions, suspending or revoking licenses, and initiating investigations. Non-administrative penalties and criminal offenses, with penalties extending to company executives, ensure accountability at both organizational and individual levels. This approach deters misconduct while allowing regulators to tailor responses to the severity of breaches.

The flexible enforcement framework supports proportional responses, from corrective measures to punitive actions, fostering compliance without stifling innovation. Executive accountability enhances corporate governance, aligning with global best practices.

Transitional Provisions

Existing VASPs are granted a 12-month transitional period to comply with the Bill’s provisions, extending the previous six-month timeline. This leniency acknowledges the complexity of implementing physical offices, governance changes, and compliance systems, particularly for smaller operators.

The extended timeline reduces market disruptions, but VASPs must act promptly to meet the Bill’s standards, engaging legal and compliance experts to navigate the transition.

Global Context and Comparative Analysis

The Bill aligns Kenya with jurisdictions like South Africa, where structured licensing has attracted virtual asset businesses while protecting consumers. By addressing AML/CFT risks and promoting transparency, the Bill meets FATF standards, enhancing Kenya’s global financial reputation. However, the physical office requirement and high penalties may challenge smaller players, potentially favoring larger entities, as seen in jurisdictions with similar frameworks.

Kenya’s alignment with global standards positions it as a competitive hub for virtual asset businesses, but regulators must monitor the impact on smaller operators to ensure inclusivity.

Challenges and Future Considerations

While the Bill provides a robust framework, challenges remain. The physical office requirement may deter startups, and the high compliance costs could limit market entry. Coordination between the CBK and CMA will be critical to avoid regulatory gaps. As the Bill progresses through the National Assembly, further amendments may refine its provisions. The development of subsidiary legislation will be essential to clarify technical standards and operational guidelines, ensuring practical implementation.

VASPs should engage legal experts to navigate licensing, compliance, and governance requirements. Regulators should provide clear guidance during the transitional period and foster dialogue with industry stakeholders to address implementation challenges.

Conclusion

The Virtual Asset Service Providers Bill, 2025, establishes a forward-thinking regulatory framework that balances innovation, consumer protection, and financial integrity. Its clear institutional roles, stringent licensing and compliance requirements, and robust enforcement mechanisms position Kenya as a leader in virtual asset regulation in Africa. While challenges like compliance costs and coordination remain, the Bill’s alignment with global standards and focus on transparency and accountability pave the way for a trustworthy and dynamic virtual asset ecosystem. As the sector evolves, ongoing stakeholder engagement and adaptive regulation will be key to realizing the Bill’s full potential.