Do crypto off-ramps need a Kenyan licence? Usually more than one
An off-ramp sounds like a single product: a user sends a virtual asset and receives shillings in a bank account or a mobile wallet. Under the Virtual Asset Service Providers Regulations 2026 — Legal Notice No. 134, made on 3 July 2026 and published in Kenya Gazette Supplement No. 185, Legislative Supplement No. 103, of 22 July 2026 — that single product is usually three regulated activities, supervised by two different regulators, with a capital number that is not the sum and not the highest of the three.
The deadline behind all of this is 4 November 2026, set by s.47 of the VASP Act 2025 (Act No. 20 of 2025). There is no transitional provision, no savings clause and no deemed-licensing regulation anywhere in the 151 regulations.
Decompose the product before you cost it
Take a typical off-ramp. It holds customer keys while a transaction settles. It converts a virtual asset into fiat. It pays fiat out. Those map to three distinct licensable activities — wallet provider, exchange, and virtual asset payment processor — and the regulator is different depending on which one you are looking at.
The split is set by the "Responsible Relevant Regulatory Authority" column of the First Schedule to the VASP Act 2025. The Central Bank of Kenya supervises wallet providers, virtual asset payment processors and stablecoin issuers. The Capital Markets Authority supervises exchanges, brokers, investment advisers, virtual asset managers, ICO providers, tokenisation providers and token issuance platforms. An off-ramp built the ordinary way is therefore read by both.
Regulation 85(6) is the number that decides feasibility
The Fifth Schedule, headed "Capital and Liquidity Requirements" and cross-referenced at rr. 6(2)(h), 85(2)(a), 85(3) and 85(12), sets paid-up capital by category. In shillings: wallet provider 150,000,000; exchange 100,000,000; virtual asset payment processor 10,000,000.
The instinct is to add those up, or to take the largest. Regulation 85(6) does neither. A licensee undertaking more than one permissible activity holds the paid-up capital of the highest-capital category, plus fifty per cent of the paid-up capital for each additional activity. For the three activities above:
- Highest category, wallet provider: KSh 150,000,000
- Plus 50% of the exchange requirement: KSh 50,000,000
- Plus 50% of the payment processor requirement: KSh 5,000,000
- Total paid-up capital: KSh 205,000,000
Drop the wallet function and hold no customer keys, and the same business computes as 100,000,000 plus 5,000,000, or KSh 105,000,000. The custody decision is worth a hundred million shillings on the capital line alone. That is a product decision that ought to be made by people who have seen this arithmetic, and it usually is not.
Regulation 85(7) then allows the authority to raise the requirement by reference to risk profile. The Fifth Schedule is a floor, not a ceiling.
The liquid capital column, which is where payment processors get caught
The Fifth Schedule has two columns only — paid-up and liquid capital. There is no fee column and no insurance column in it. On the liquid side: a wallet provider holds KSh 30,000,000 or 100% of current liabilities for at least 30 days, whichever is higher; an exchange holds KSh 20,000,000 or 8% of total liabilities, whichever is higher; and a virtual asset payment processor holds 100% of current liabilities for at least 30 days with no floor at all.
No floor cuts both ways. A small processor has a small number. A processor with large float has a liquid capital requirement driven entirely by its own balance sheet, and it moves as the balance sheet moves. Note also what the regulations do not say on the anchor text available: reg. 85(6) is expressed in terms of paid-up capital, and the treatment of the liquid capital limbs for a multi-activity licensee is not resolved on its face. Confirm that against the gazetted text before you model it.
Fees, and a caution about the March draft
First Schedule fees, cross-referenced at rr. 5(1), 6(2)(u), 7, 11(3)(b), 13(1), 29(2), 49(2)(g), 61(2)(c) and 62(2)(h), are in shillings, application then licence: wallet 100,000 then 500,000; exchange 100,000 then 1,000,000; payment processor 100,000 then 200,000. Because reg. 85(6) contemplates one licensee holding more than one activity, check how the First Schedule and reg. 7 treat fees for a multi-activity applicant before you budget — do not assume they simply add.
One more warning. The National Treasury's March 2026 draft is still downloadable and still being quoted. It is not the law. Seven of the ten capital categories fell between draft and gazette, several by 80 to 95 per cent: the payment processor requirement went from 50,000,000 to 10,000,000, and the exchange from 150,000,000 to 100,000,000. A firm that shelved a Kenyan off-ramp on the March numbers was reading the draft correctly and the law not at all. Reprice it.
As at its public notice of 18 November 2025, the Central Bank had licensed no VASPs under the Act, and stated that licensing would commence upon issuance of the regulations. The published contact points are vasp@centralbank.go.ke at the CBK and virtualassets@cma.or.ke at the CMA. The application window itself had not opened at the time of writing.
The checklist behind this article
The Kenya VASP checklist is the readiness document for Legal Notice 134: every item cited to a regulation or schedule, every figure marked as gazette text or as reporting of it, and the genuinely open questions — the application window, the form, how the reg. 85(7) uplift is applied — left marked as open. USD 79, with the updated edition free as the position develops.
If you are applying in one category and the arithmetic above does not touch you, the checklist is all you need. If you are multi-activity, split across the CBK and the CMA, or holding customer keys inside a payments product, there is a 48-hour gap check.