CBK vs CMA: which regulator licenses your Kenyan crypto business?
Kenya now has two crypto regulators, not one. Which of them licenses you is not an administrative detail. It decides your minimum capital, your fee schedule and who you answer to for the life of the licence.
One Act, two supervisors
The Virtual Assets Service Providers Act, 2025 (Act No. 20 of 2025) was gazetted on 21 October 2025 and took effect on 4 November 2025. It names both the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) as the authorities responsible for licensing and supervising VASPs, each according to the services listed in the First Schedule to the Act.
Section 47 requires providers already operating in Kenya to comply within one year of commencement — that is 4 November 2026. There is no transitional relief on the face of the Act, so the working assumption should be that an existing provider needs to be licensed by that date, not merely in the queue. If your timetable assumes a soft landing, test that assumption against the Act rather than against market commentary.
What the CBK supervises
- Virtual asset wallet providers
- Payment processors handling virtual assets
- Stablecoin issuers
The common thread is money movement and stored value. If your product behaves like payments, or like custody of value that is used to pay, you are on the CBK side of the line.
What the CMA supervises
- Exchanges
- Brokers
- Investment advisers
- Virtual asset managers
- Initial coin offerings
- Tokenisation providers
- Token issuance platforms
Here the thread is investment and market activity. Trading venues, intermediation, advice and issuance sit with the capital markets regulator, which is consistent with how the CMA already treats securities intermediaries.
Why the split sets your capital figure
The Virtual Asset Service Providers Regulations, gazetted as Legal Notice No. 134, attach a paid-up capital figure to each licensed activity. As gazetted, the figures reported are:
- Stablecoin issuer — KES 300 million
- Virtual asset wallet provider — KES 150 million
- Exchange — KES 100 million
- Initial coin offering, token issuance platform and virtual asset manager — KES 20 million each
- Tokenisation provider, payment processor and broker — KES 10 million each
- Investment adviser — no paid-up capital requirement
Stablecoin issuers carry an additional liquidity test: liquid capital of KES 60 million or 100 per cent of current liabilities for at least 30 days, whichever is higher.
Notice what this does to the CBK and CMA line. The two heaviest capital requirements, stablecoin issuance and wallet provision, both sit with the CBK. The CMA supervises a wider spread of activities, but only one of them — the exchange licence — carries a nine-figure number. A firm that describes itself loosely as a crypto platform can land anywhere between KES 10 million and KES 300 million depending on how its activities are characterised.
Fees follow the same logic
Fee levels differ sharply by category. Reporting on the gazetted schedule puts an exchange licence at KES 1 million on top of a KES 100,000 application fee, with renewal at KES 500,000 or 0.5 per cent of the previous year gross revenue, whichever is higher. An investment adviser pays KES 10,000 to apply and KES 50,000 for the licence. Payment processors are charged on a sliding scale tied to transaction volume. Confirm the exact figures for your own category against Legal Notice No. 134 before you budget against them.
Getting the characterisation right
- Map every function your product performs to the service descriptions in the First Schedule, not to how you market it.
- Expect to need more than one licence if you both hold customer assets and match orders. Combined models rarely fall in a single box.
- Where an activity could plausibly sit with either regulator, raise it early rather than filing and hoping. Being redirected costs weeks you may not have before 4 November 2026.
- Check the non-capital conditions too. Governance frameworks, customer due diligence, seven-year record retention, regulatory reporting and cybersecurity obligations apply across categories.
- If you advise rather than hold assets, confirm what insurance or indemnity cover the Regulations require in place of paid-up capital. Exemption from capital is not exemption from everything.
One further point on scope: the framework reaches foreign providers that target Kenyan customers or derive economic benefit from Kenya. A non-resident structure does not automatically place you outside it, and the November date applies to you as much as to a locally incorporated competitor.
The checklist behind this article
Everything above is drawn from the same working document I use when I read a file: an 11-page readiness checklist for VASP licensing in Kenya, covering the CBK/CMA split by activity, the full paid-up capital table from the Fifth Schedule to Legal Notice 134, the stablecoin liquid-capital test, the evidence trail that has to exist before you file, the fee schedule, and the points that are still genuinely open. Every figure is marked with whether it comes from the instrument or from reporting of it — because planning against a secondary figure is sensible and capitalising against one is not. It is USD 79, and buyers get the updated edition free when the application window opens.
If your situation is straightforward, the checklist is genuinely enough and you will not need to speak to me. If it is not, the 48-hour gap check reads what you have and returns a written list of what is missing, in the order it should be fixed.