Kenya's travel rule is already live for VASPs, and did not wait for Legal Notice 134
Most Kenyan commentary describes the travel rule as something coming. One widely read law-firm note puts it as the Act anticipating "the implementation of transaction transparency requirements, including the sharing of originator and beneficiary information for virtual asset transfers". That framing is a year out of date. The obligation is not anticipated. It has been in force since 4 November 2025, and it arrived through the anti-money-laundering statute rather than through the virtual assets regulations.
How VASPs were brought inside the AML statute
The Schedule to the Virtual Asset Service Providers Act 2025 (Act No. 20 of 2025) amended the Proceeds of Crime and Anti-Money Laundering Act (Cap 59A) by inserting "or a virtual asset service provider" into the section 2 definition of a reporting institution, with effect from 4 November 2025. The consolidated POCAMLA text published by Kenya Law carries that amendment.
That single insertion is the whole mechanism. Once a VASP is a reporting institution, every obligation POCAMLA and its regulations impose on reporting institutions applies to it — without waiting for Legal Notice No. 134 of 22 July 2026, without waiting for the licensing window to open, and without any need for a virtual-asset-specific travel rule provision to be written.
What regulation 32 actually requires
The operative provision is regulation 32 of the Proceeds of Crime and Anti-Money Laundering Regulations, 2023 (Legal Notice No. 153 of 2023). Read directly, it requires the information accompanying a wire transfer to include originator details — "the name of the originator; the originator account number where such an account is used to process the transaction or; in the absence of an account number, a unique transaction reference number" — and beneficiary details on the same pattern.
- Domestic transfers are in scope too. Regulation 32 requires the ordering institution to include originator information "as indicated for cross-border wire transfers, unless this information can be made available to the beneficiary financial institution and appropriate authorities by other means".
- Intermediaries keep records for seven years. Where technical constraints prevent information travelling with the transfer, the intermediary reporting institution "shall keep a record, for at least seven years, of all the information received from the ordering institution or another intermediary reporting institution".
- Regulation 32(8) is a hard prohibition. Transfers to and from persons or entities designated under UN Security Council Resolutions 1267 (1999), 1373 and other terrorism-financing resolutions are prohibited outright.
- The regulation also sets risk-based rules on when a transfer with missing data must be executed, rejected or suspended.
We do not state a de minimis threshold for virtual asset transfers, because we have not verified one in the text of regulation 32. If your policy needs a threshold, read it out of the regulation itself rather than out of a FATF Recommendation 16 summary. Note separately that the USD 15,000 figure circulating in Kenyan AML material is the cash transaction reporting trigger under POCAMLA section 44(6) and the Fourth Schedule — a different obligation, not a travel rule threshold.
The obligations that came with it
A firm that has been operating in Kenya since November 2025 has been carrying the full reporting-institution load, whether or not it knew:
- Suspicious transaction reports to the Financial Reporting Centre within two days after the suspicion arose (POCAMLA s.44(2)), including attempted transactions (s.44(3)).
- Follow-up requests from the FRC answered not later than 30 days (s.44(9)); the FRC may direct a hold of up to five working days (s.44A).
- Registration with the FRC, with changes in particulars notified within 90 days (s.47A).
- Records kept at least seven years from completion of the transaction or termination of the relationship (s.46(4)).
- A money laundering reporting officer who, under regulation 12, "shall be of management level and shall have relevant and necessary competence, authority and independence" and reports "forthwith" to the Centre. The MLRO cannot be the internal auditor or the chief executive, and appointment or removal must be notified to the FRC and the supervisory body within 14 days.
- An annual compliance report to the FRC by 31 January (regulation 44), and a documented, board-approved ML/TF/PF risk assessment kept current (regulation 7), with a fresh assessment before launching any new product, practice, delivery mechanism or technology (regulation 8).
Why the licence file and the AML file are the same file
The retention picture illustrates the point. Legal Notice 134 imposes seven-year retention in several separate places — regulation 22(1)(b) for transaction records, regulation 26 for a securely stored audit trail, regulation 110(4) for complaints records — sitting on top of section 44(2) of the VASP Act, which requires records at the principal place of business for not less than seven years, and section 44(1), which requires online or automated real-time read-only access on demand. A retention schedule that cites one of these and omits the access obligation is under-drafted for the file.
We have not verified whether LN 134 contains its own dedicated travel rule regulation, or its number, from the gazette text; the substantive obligation does not depend on it. What matters for planning is that a firm intending to apply before the 4 November 2026 deadline under section 47 of the VASP Act is not starting from a clean slate. It has an AML compliance history from November 2025 onwards that a CBK or CMA reviewer can ask about.
That reviewer is also working against a scorecard. The FATF statement of 19 June 2026 keeps Kenya under increased monitoring, with an action plan that includes "improving risk-based AML/CFT supervision of FIs and DNFBPs" and "bringing the TFS framework in compliance with R.6 and ensure its effective implementation". Virtual assets are not named in Kenya's own action plan items — but sanctions screening and supervisory quality are, and those are exactly the two things regulation 32 tests.
The checklist behind this article
The Kenya VASP readiness checklist maps the application pack requirement by requirement, including the POCAMLA and POCAML Regulations obligations that already apply and the retention and access duties across LN 134 and the VASP Act. Every item is cited to its section, regulation or schedule, every figure is marked as instrument text or as reporting of it, and the open questions — the application window, the form, the treatment of a filed-but-undetermined applicant — are left marked open. USD 79, with updated editions free as the position develops.
If you are a single-category applicant with domestic-only transfers and an MLRO already appointed, the checklist covers the ground and you will not need anything further from us. If you have been operating since before November 2025, move value cross-border, or are working out how regulation 32 applies to transfers between your own hosted wallets, the 48-hour gap check takes your actual flows.