Kenya is among few countries in Africa and across the world that now have legal framework to regulate and license virtual assets such as cryptocurrencies which have gained traction over the last few years.
The Virtual Asset Service Providers Act 2025 which became law upon presidential assent on October 15, 2025 defines virtual assets as, “..a digital representation of value that can be digitally traded or transferred and can be used for payment and investment purposes and does not include digital representation of fiat currencies, securities and other financial assets.”
According to Parliamentary Affairs Principal Secretary Dr. Aurelia Rono, the law will help Kenya to safeguard the integrity of it’s financial system as well as promote innovation.
“The new amendment law also upholds the country’s commitments to take legislative steps to regulate areas
identified as likely conduits for money-laundering and terrorism financing including virtual assets such as cryptocurrencies,” she stated.
Kenya is among the top countries with fastest growing cryptocurrency markets in the world and according to Statista, industry revenue is projected to reach Ksh 13 billion by end of this year and number of users growing to 1.35 million by end of next year.
Dr Rono said the law which now regulates virtual asset service providers and virtual asset activities in and from Kenya will be key in removing Kenya from the grey list of the Financial Action Task Force (FATF).
Kenya had been placed in the grey list by FATF for having gaps in for countering money laundering, terrorist financing, and proliferation financing.
Licensing
Under the new law, any person carrying out virtual asset services, whether Kenyan or foreigner must be licensed by the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA). Any person who operates the business without a license is liable to a fine not exceeding Ksh 3 million or a three year jail term or both. Companies operating unlicensed virtual asset services is also liable for a fine not exceeding Ksh 5 million.
In further fortifying anti-money laundering laws, license holder are also forbidden from transferring licenses without regulatory approvals. Provision of falls information to authorities can also lead to a fine of Ksh 7 million or three years jail term or both.
Data protection
Among other requirements for a license is the adherence to Computer Misuse and Cybercrimes Act, specified physical presence and data solutions for record keeping.
In granting of license by the regulators, operators must also have internal safeguards and data protection system.
Anti-money laundering
According to the new law, license holder are required to comply with anti-money laundering and counter terrorism financing preventative measures including targeted sanctions and obligations, have its annual financial statements audited by approved auditor with copy submitted to regulators and have sufficient measures to protect customers’ virtual assets.
In combating illicit financial flows, virtual asset service providers are also required to share information with the authorities on matters regarding money laundering and terrorism financing.
“From a public -policy perspective, the Act strengthens Kenya’s AML/CFT/CPF posture by integrating VASPs into existing reporting and supervisory networks and giving regulators direct powers to investigate and sanction non – compliance.
That enhanced oversight should improve cross -border cooperation, suspicious -transaction detection and consumer redress, but it will also require regulators to scale technical capabilities in blockchain forensics, custody supervision and cyber incident response to be effective,” said ALN Kenya.
