Kenya VASP application: a 34-point readiness checklist

Kenya Published 2026-08-16

What you are working to

The Kenyan deadline is 4 November 2026, set by section 47 of the Virtual Asset Service Providers Act 2025 (Act No. 20 of 2025). The operating rules are Legal Notice No. 134 of 2026, made on 3 July 2026 by the Cabinet Secretary to the National Treasury and published in Kenya Gazette Supplement No. 185, Legislative Supplement No. 103, on 22 July 2026 — 116 pages, 151 regulations, six schedules. Cite both supplement numbers; Kenyan sources quote one or the other.

There is no transitional provision, no savings clause and no deemed-licensing regulation anywhere in those 151 regulations. As at mid-August 2026 the application window had not been announced: reporting on 7 August 2026 had firms waiting on a formal announcement before filing.

Scope, supervisor and capital

• 1. Fix your activity category — the VASP Act First Schedule assigns each of the ten to a named regulator.
• 2. CBK supervises wallet provision, virtual asset payment processing and stablecoin issuance.
• 3. CMA supervises exchanges, brokers, investment advisers, virtual asset managers, ICO providers, tokenisation providers and token issuance platforms.
• 4. If you carry on more than one, apply reg. 85(6): the highest paid-up figure, plus 50% of the paid-up figure for each additional activity. Exchange plus wallet is KSh 200,000,000 — not 250,000,000, and not 150,000,000.
• 5. Take the figure from the Fifth Schedule of the gazetted notice, not the Treasury's March 2026 draft; seven of the ten categories fell between the two, several by 80% or more.
• 6. Compute both limbs of the liquid capital column and hold the higher — for a broker, KSh 2,000,000 or 8% of total liabilities.
• 7. Note that the payment processor line carries no liquid floor at all: 100% of current liabilities for at least 30 days.
• 8. Treat the Fifth Schedule as a floor — reg. 85(7) allows the authority to raise the requirement by risk profile.
• 9. Budget the First Schedule application fee: KSh 100,000 for most categories, 50,000 for a manager, 10,000 for an adviser.
• 10. Budget the First Schedule licence fee on grant: KSh 2,000,000 stablecoin, 1,000,000 exchange, 500,000 wallet/ICO/tokenisation/token issuance platform, 200,000 payment processor and manager, 100,000 broker, 50,000 adviser.

The nine written policies under reg. 6(2)(f)

The four-policy list still circulating in commentary comes from the March 2026 draft. The gazetted regulation lists nine, and the word it uses is "including", so the list is not closed:

• 11. Risk management
• 12. AML/CFT/CPF
• 13. Data protection and privacy
• 14. Cybersecurity and information technology
• 15. Complaints management
• 16. Market conduct
• 17. Consumer protection
• 18. Conflict of interest
• 19. Business continuity and disaster recovery

What the schedules ask for beyond the nine

• 20. An outsourcing policy — the Second Schedule application form asks for it separately, which makes it a tenth policy in practice.
• 21. A written operational controls policy (Second Schedule).
• 22. Written audit, internal controls and risk management policies (Second Schedule, item 27).
• 23. A named risk register — the Third Schedule business plan asks for the register itself, not an undertaking to build one later.
• 24. Board-approved AML policies, per r.7(3) of the POCAML Regulations 2023 (LN 153/2023).

People

• 25. A chief information security officer — in the gazetted text, and absent from the March draft.
• 26. An MLRO at management level and independent, who cannot be the internal auditor or the CEO (POCAML Regulations 2023, r.12).
• 27. Notify the Financial Reporting Centre and your supervisory body of an MLRO appointment or removal within 14 days (r.12).
• 28. Register with the FRC and notify changes in particulars within 90 days (POCAMLA, Cap 59A, s.47A).
• 29. A named Kenyan owner against each entry on the risk register — a group framework with no local owner is the commonest weakness.

Records and reporting

• 30. Seven-year retention: VASP Act s.44(2), repeated in LN 134 for transaction records (reg. 22(1)(b)), audit trails (reg. 26) and complaints records (reg. 110(4)).
• 31. Online or automated real-time read-only access to records on demand (VASP Act s.44(1)) — a retention schedule that omits this is under-drafted.
• 32. Suspicious transaction reports to the FRC within two days of the suspicion arising, attempted transactions included (POCAMLA s.44(2) and (3)).
• 33. Cash transaction reports above USD 15,000 or equivalent (POCAMLA s.44(6) and the Fourth Schedule).
• 34. An annual compliance report by 31 January (POCAML Regulations 2023, r.44).

Why the citations matter more here than elsewhere

Kenya remained on the FATF list of jurisdictions under increased monitoring at the June 2026 plenary, with risk-based supervision still on the action plan. CBK and CMA reviewers are measured against those same items. A file citing the regulation behind each requirement reads as one written against Kenyan law. One that cites nothing reads as a group template with the country name changed.

The checklist behind this article

Our Kenya VASP readiness checklist is the long form of the list above: each item cited to its regulation, section or schedule, each figure marked as gazette text or as reporting of it, and the questions LN 134 leaves open — whether a filed-but-undetermined applicant may keep operating, how the reg. 85(7) uplift is applied — marked open rather than answered. USD 79, with updated editions free as the position develops.

If you are applying in one category, the checklist covers you end to end. If you are applying in more than one, so that reg. 85(6) and the CBK/CMA split both bite, the 48-hour gap check works through your combination.