VASP gap analysis: what a readiness assessment actually checks
What a readiness assessment is for
A gap analysis is a comparison, and it is worth being precise about what is on each side of it. On one side is what a firm has: a corporate structure, a category it believes it falls into, a capital figure, a set of policies, an audit history. On the other is what the instrument requires, cited to the regulation or article that requires it. The output is the difference, ranked by how long each gap takes to close. That is all it is — but the discipline is in citing both sides, because most of the expensive mistakes come from comparing a file against a summary of the law rather than the law.
Kenya: the category sets the number, then one regulation resets it
Kenya's capital figures live in the Fifth Schedule to Legal Notice No. 134 of 2026, referenced at regs. 6(2)(h), 85(2)(a), 85(3) and 85(12), in two columns: paid-up capital and liquid capital. A readiness check that stops at reading your category's row is incomplete, for two reasons. Reg. 85(6) provides that a licensee undertaking more than one permissible activity holds the paid-up capital of the highest category plus fifty per cent of the paid-up capital for each additional activity — not the sum, and not the highest alone. And reg. 85(7) allows the authority to raise the requirement by risk profile, so the schedule is a floor rather than a ceiling.
Two other Kenyan items are routinely mis-scoped. Reg. 6(2)(f) requires nine operational policies, not four; the four-item list still circulating comes from the National Treasury draft of March 2026, not from the gazetted law, and the regulation says "including", so the list is not even exhaustive. Insurance is reg. 88, not the Fifth Schedule, and it contains exactly one hard figure — professional indemnity of at least KSh 1,000,000 for an investment adviser. Everything else in reg. 88 is cover commensurate with risk and scale. The compliance deadline is 4 November 2026 under s.47 of the VASP Act 2025, with no transitional provision.
Brazil: the question is which phase, not which document
Categories under Resolução BCB 520 art. 4 — intermediary, custodian, or broker where both are done together — are determined by function, not by how a firm describes itself. A firm that matches orders and holds client keys is a broker whatever its website says.
The sequencing question is where Brazilian files go wrong. IN BCB 704 art. 9 sets the Phase 1 set for providers already operating, due 30 October 2026, items I to VIII, ending with three years of financial statements audited by an auditor registered with the CVM. Phase 2 under art. 10 follows within 60 days of a favourable Phase 1 decision, extendable by up to 60 more at the BCB's discretion on a justified request. IN BCB 739 made exactly four changes to that structure and did not touch art. 9: the reasonable assurance report it introduced sits in Phase 2, at art. 10 X, and in the new-entrant route at art. 5 XV. Published commentary that binds the assurance report to the 30 October filing exists, and it is wrong — an avoidable few hundred thousand reais of audit work pulled forward by a month. Capital must also be subscribed and paid up in cash; a commitment letter or a parent guarantee is not capital.
United Kingdom: the perimeter, and then the exclusions
The UK check starts with whether you are in scope at all. Chapter 2B of the Regulated Activities Order as inserted by SI 2026/102 runs to 25 articles, of which seven specify activities and eighteen are exclusions — the merchant exclusion at 9Z10, the incidental-to-a-profession exclusion at 9Z11, the staking technical services exclusion at 9Z9 covering the operation of a validator node, and others. They are largely undiscussed in published commentary and they do real work. The heads also do not simply stack: articles 9V(2), 9X(2) and 9Z5(2) carve activities out of the dealing and arranging heads.
On capital, the permanent minimum requirement varies by activity and the highest applicable figure applies, not the sum, with own funds set at the higher of the permanent minimum, the fixed overheads requirement and the K-factor requirement. And a firm currently on the FCA's cryptoasset register should check reg. 48: registration is replaced by a notification duty with its own short clocks, and authorised firms come off that register entirely.
The four ways files actually go wrong
- The category is wrong, so every downstream figure is wrong.
- The figures are right but stale — taken from a draft, or from commentary written before an amendment.
- A document with a long lead time is missing: audited accounts, an assurance report, an insurance placement.
- Work is done in the wrong phase, early or late, against the sequencing the instrument sets.
None of those need a consultant to find. They need someone to read the instrument next to the file, and to write down which is which.
The checklists behind this article
We publish one readiness checklist per regime, each item cited to its rule, regulation or article number, each figure marked as instrument text or as reporting of it, and each genuinely open question marked open rather than guessed: Kenya, USD 79, Brazil, USD 79 and United Kingdom, USD 149. Updated editions are free as each position develops.
For a single entity, one category, one regulator, the checklist for that regime is the whole exercise and you can run it yourself. The 48-hour gap check is there for the situations the checklist cannot resolve on its own — multi-activity capital stacking, a group spanning two regulators, or a category call that is genuinely arguable.