The Kenya VASP numbers you remember are probably the March draft
If you looked at Kenya earlier in 2026, priced the capital requirement, and concluded it did not work, there is a reasonable chance you were reading the National Treasury's March 2026 draft rather than the law. The draft is still downloadable from treasury.go.ke and is still being quoted in commentary. The gazetted regulations are different, and mostly cheaper.
The law is Legal Notice No. 134 of 2026, made on 3 July 2026 by John Mbadi Ngongo, Cabinet Secretary to the National Treasury, and published in Kenya Gazette Supplement No. 185 (Special Issue 4253), Legislative Supplement No. 103, on 22 July 2026. If the document in front of you does not carry that masthead, it is not the instrument.
What changed between the draft and the gazette
Minimum paid-up capital, draft figure to gazetted figure, in Kenyan shillings:
- Investment adviser: 2,500,000 to NIL
- Tokenisation provider: 200,000,000 to 10,000,000
- ICO provider: 200,000,000 to 20,000,000
- Token issuance platform: 200,000,000 to 20,000,000
- Virtual asset payment processor: 50,000,000 to 10,000,000
- Broker: 30,000,000 to 10,000,000
- Virtual asset manager: 30,000,000 to 20,000,000
- Exchange: 150,000,000 to 100,000,000
- Stablecoin issuer: 500,000,000 to 300,000,000
- Wallet provider: 150,000,000, unchanged
Seven of the ten categories fell, several by 80 to 95 per cent. A tokenisation business that walked away from Kenya on a KSh 200 million number was reading the draft correctly and the law not at all: the gazetted figure is KSh 10 million. The gazetted figures are in the Fifth Schedule to Legal Notice 134, which is titled “Capital and Liquidity Requirements” and is referenced by regulations 6(2)(h), 85(2)(a), 85(3) and 85(12).
The gazette also added things the draft did not have
The movement was not uniformly in firms' favour. Two changes make the compliance build larger:
- Regulation 6(2)(f) requires nine operational policies, not the four in the draft: risk management; AML/CFT/CPF; data protection and privacy; cybersecurity and information technology; complaints management; market conduct; consumer protection; conflict of interest; and business continuity and disaster recovery. The regulation says “including”, so the list is not exhaustive. The four-item list still circulating is the draft.
- The gazetted text requires a chief information security officer. That role does not appear in the March draft, and it is a hiring decision with a lead time.
The governance architecture also shifted: the draft's 13-member Coordination Committee became a 20-member Coordination Forum in the gazette.
Read the second column, not just the first
The Fifth Schedule has exactly two columns: paid-up capital and liquid capital. There is no fee column and no insurance column in it, which is worth knowing because both fees and insurance are dealt with elsewhere and are frequently misattributed to this schedule.
The liquid capital column is where the headline number stops telling the whole story. For most categories it is a floor or a percentage of liabilities, whichever is higher — for example a broker holds KSh 2,000,000 or 8 per cent of total liabilities, whichever is higher. For a category with a 2 million floor, the 8 per cent limb overtakes the floor at roughly KSh 25 million of total liabilities, so a business of any scale is sized by the percentage rather than by the floor it planned around. Wallet providers and stablecoin issuers face a different shape again: 100 per cent of current liabilities for at least 30 days, subject to a floor. The virtual asset payment processor line has no liquid-capital floor at all — only the 100 per cent of current liabilities for at least 30 days test.
Regulation 85(6): more than one activity is not additive, and not free
If you carry on more than one permissible activity, regulation 85(6) requires the paid-up capital of the highest-capital category plus fifty per cent of the paid-up capital for each additional activity. It is neither the sum of the categories nor the highest one alone. An exchange that also provides wallet services holds KSh 150,000,000 plus KSh 50,000,000, so KSh 200,000,000.
And regulation 85(7) lets the authority raise the requirement by reference to a licensee's risk profile. The Fifth Schedule is a floor, not a ceiling.
Where insurance actually lives
Insurance is regulation 88, not the Fifth Schedule. Regulation 88(1) requires cover commensurate with risk and scale without prescribing a sum; 88(3) requires a Kenya-licensed insurer, or a foreign insurer approved in consultation with the Insurance Regulatory Authority; 88(4) allows group policies only where the licensee is named as insured with a stated level of cover; and 88(5) requires cover for cyber, theft, loss of keys and operational failure. The only hard figure in the regulation is 88(6): professional indemnity of at least KSh 1,000,000 for an investment adviser. If a source gives you a prescribed insurance sum for any other category, it is not reading regulation 88.
What is still open
The application window has not opened, the application form is not published, and the regulations do not say whether an applicant with a filed but undetermined application may keep operating past 4 November 2026 — the deadline in section 47 of the Virtual Asset Service Providers Act 2025, which has no savings or transitional provision behind it. How regulation 85(7) uplifts will be applied in practice, and what counts as commensurate cover under 88(1), are also unanswered. Plan on the gazetted numbers; do not plan on the gaps closing in your favour.
The checklist behind this article
The Kenya VASP readiness checklist is built from the gazetted text of Legal Notice 134 rather than from the draft, with each item cited to a regulation number, each figure marked as instrument text or as reporting of it, and the open questions left marked open. USD 79, with updated editions free as the position develops.
If you are applying for a single activity, the checklist covers what you need. If you are combining activities and need the regulation 85(6) arithmetic and the regulator split worked through on your own facts, the 48-hour gap check is built for that case.