Crypto Regulation in Kenya: Is Crypto Legal and Who Licenses It?

Crypto is legal in Kenya. You can buy USDT on P2P, hold Bitcoin in your own wallet and sell it back to M-Pesa without breaking any law. What changed is the rulebook for the companies in the middle: since the Virtual Asset Service Providers Act 2025 came into force, any business offering crypto services in or from Kenya needs a licence from the Central Bank of KenyaCBKCentral Bank of Kenya. Under the VASP Act it licenses crypto wallet providers, payment processors and stablecoin issuers. Glossary or the Capital Markets AuthorityCMACapital Markets Authority. Under the VASP Act it licenses crypto exchanges, brokers and investment advisers. Glossary.

This guide is general information, not legal advice. We read the Act and the gazetted Regulations ourselves and link every primary document at the bottom of the page.

Is crypto legal in Kenya?

Yes — with an asterisk that is about protection, not legality. In December 2015 the CBK told the public that Bitcoin is “not legal tender” and that “no protection exists” if a platform holding your coins fails. It urged people to “desist from transacting” in Bitcoin, but it never made owning crypto a crime. That notice was a warning, not a ban.

The VASP Act keeps that position. It does not prohibit individuals from holding cryptocurrencyCryptocurrencyDigital money that lives on a blockchain instead of in a bank or M-Pesa account. Glossary; it regulates the businesses that hold it, exchange it or move it for other people. Section 8 says no person shall carry on, or hold itself out as carrying on, virtual asset services “in or from Kenya” without a licence — and only a company limited by shares can apply.

So the practical answer for most readers is simple: you are allowed to own crypto, but the platform you use should eventually be licensed, and until it is, you carry the platform risk yourself.

From the first CBK warning to the VASP Act

Kenya’s crypto rules arrived slowly, then all at once. Here are the dated milestones we could confirm from primary documents.

• December 2015CBK cautions the public on BitcoinPublic notice: virtual currencies are not legal tender and are unregulated. Banking Circular No. 14 of 2015 (18 Dec 2015) tells banks not to open accounts for people dealing in them.
• 25 August 2020Joint warning on unlicensed schemesCMA, CBK and other financial regulators warn about online pyramid schemes and unlicensed online forex brokers.
• 1 September 2023Digital Asset Tax startsThe Finance Act 2023 introduces a 3% tax on the value of crypto transfers, collected by platforms.
• February 2024Kenya added to FATF grey listThe Financial Action Task Force places Kenya under increased monitoring over anti-money-laundering gaps.
• 1 July 2025DAT replaced by excise dutyThe Finance Act 2025 repeals the 3% DAT and charges 10% excise duty on fees charged by virtual asset service providers.
• 15 October 2025VASP Act signed into lawThe Virtual Asset Service Providers Act, 2025 receives presidential assent. It is published in the Kenya Gazette on 21 October 2025.
• 4 November 2025The Act commencesCBK and CMA confirm on 18 November 2025 that no provider has been licensed yet; licensing waits for Regulations.
• March 2026Draft Regulations publishedCBK invites public comments on the draft VASP Regulations 2026.
• 22 July 2026Regulations gazettedLegal Notice 134 of 2026, Kenya Gazette Supplement No. 185, made by the Cabinet Secretary for the National Treasury.
• 4 November 2026Transition window closesSection 47 gave existing providers one year from commencement to comply with the Act.
• 13 November 2026Regulators call for applicationsJoint CBK–CMA notice: anyone providing virtual asset services must apply; licensed VASPs will be listed on the regulators' websites.

Alongside these steps, the CMA has run a regulatory sandboxA controlled test environment where a regulator lets a fintech try a new product with real customers under close supervision, before full licensing rules apply. for fintech pilots, and the CBK has its own innovation channels. Neither sandbox was a licence to run a public crypto exchange.

Who licenses what: CBK vs CMA

The Act splits crypto businesses by what they do, not by what coin they touch. The First Schedule lists every activity and names the responsible regulator. One provider may need several licences — and, under the Regulations, separate paid-up capital for each licensed activity.

Two details matter for Kenyans. First, the Regulations say a foreign platform is operating “in or from Kenya” if it actively solicits or targets Kenyan consumers, or earns income from Kenya, whether or not it has an office here. Second, anyone converting crypto to or from foreign currency as a business must get separate authorisation from the CBK.

Wallet providers must also keep customers’ coins on separate on-chain addresses from their own, maintain separate internal ledgers and reconcile holdings every month. That is the kind of protection the CBK said was missing in 2015.

Treasury rules: capital limits and fees

When people search for “Kenya Treasury crypto exchange rules” or “capital limits”, they mean the VASP Regulations 2026. The Act lets the Cabinet Secretary for the National Treasury make Regulations on the advice of the CBK and CMA, and the Fifth Schedule sets minimum capital for each licence.

Where the liquid-capital column gives two figures, the higher one applies. These are the gazetted numbers. Be careful with older articles: the draft published for comment in March 2026 proposed much higher figures — KSh 150 million for an exchange, KSh 200 million for coin offerings and KSh 500 million for a stablecoin issuer. Some blogs still quote the draft. We checked the final Legal Notice 134 of 2026 and the table above reflects it.

Application fee (each activity)

KSh 100,000Exchange, wallet, broker, processor

Exchange licence fee

KSh 1,000,000Renewal: KSh 500,000 or 0.5% of gross revenue

Stablecoin licence fee

KSh 2,000,000Highest of all categories

Other rules worth knowing: a licensee must start business within twelve months of getting its licence, adverts must explain the risks and warn that prices quoted in foreign currency move with exchange rates, and the Act’s penalties are serious. Running an unlicensed crypto business is an offence under section 8; on conviction an individual faces a fine of up to KSh 10 million, up to five years in prison, or both, and a company a fine of up to KSh 25 million.

What the law means for ordinary users

If you buy a little USDT every month and cash out to M-Pesa, the Act changes less for you than the headlines suggest. You do not need a licence, you do not register your wallet, and no section makes holding coins in your own wallet unlawful.

What does change is the standard you can expect from platforms. A licensed provider must keep your coins segregated, reconcile monthly, publish fees honestly and handle complaints. An unlicensed one owes you none of that under Kenyan law.

How to check whether a platform is licensed

The joint notice of 13 November 2026 says each regulator will publish its own list of licensed VASPs. At the time of our last check, neither site showed one, and the CMA’s licensee register had no virtual asset category yet. Here is how to check for yourself:

• Look for a VASP list on centralbank.go.ke (wallets, payment processors, stablecoins) and licensees.cma.or.ke (exchanges, brokers, advisers).
• Match the exact company name on the licence with the company in the app's terms of use — big brands use different entities per country.
• Ask support for the licence number in writing. A real licensee can give it; a vague answer is a red flag.
• If in doubt, email the regulators: vaspapplications@centralbank.go.ke or virtualassets@cma.or.ke.
• Be extra careful with anyone claiming to be 'CMA approved' for crypto profits — that is a classic line in crypto scams in Kenya.

P2P trading and M-Pesa

P2P trading sits in an awkward spot. The marketplace operator is plainly a service provider. A Kenyan who sells a few hundred dollars of USDT a month for school fees is plainly not. In between are full-time merchants moving millions of shillings, and the Act does not draw a clear line for them. If that is you, keep impeccable records and take legal advice before regulators draw the line for you.

Tax is a separate rulebook

The VASP Act does not set crypto taxes; the Finance Acts and KRA do. The short history: a 3% Digital Asset Tax on transfer values from 1 September 2023, repealed by the Finance Act 2025 and replaced from 1 July 2025 by a 10% excise dutyExcise duty on VASP feesSince 1 July 2025, a 10% excise duty applies to fees that crypto service providers charge — not to the value of the crypto you trade. Glossary on the fees platforms charge. Whether your personal gains are taxable income is a separate question. Our crypto tax guide walks through it with KES examples.

FATF grey list: why Kenya moved now

The FATF grey listFATF grey listA list of countries under increased monitoring for money-laundering controls. Kenya is on it, which is one reason for tighter checks on crypto and P2P. Glossary is the main reason the law came together quickly. Kenya was placed under increased monitoring in February 2024, partly because virtual asset service providers were unregulated. Grey listing makes cross-border banking slower and costlier for everyone, from importers in Mombasa to families receiving remittances.

The VASP Act gives Kenya a licensing regime with anti-money-launderingAMLAnti-money-laundering rules. They are why exchanges ask where your money comes from and may freeze suspicious accounts. Glossary duties: KYC, transaction monitoring and reporting suspicious activity to the Financial Reporting Centre. Press reports after the June 2026 FATF plenary said Kenya remained on the list. Expect banks and exchanges to keep asking detailed questions about the source of funds, even for modest amounts.

What to do now

1. Keep using platforms carefully, not blindly. Licensing is starting, not finished. Keep only what you trade with on any exchange and move longer-term savings to a wallet you control.
2. Keep records. M-Pesa SMS, order numbers and exchange statements help you with both KRA and any account review.
3. Watch the regulators’ websites. When the first licences are published, prefer licensed providers for anything beyond small amounts.
4. Learn the basics first. If you are new, start with our beginner’s guide and the glossary.