VASP licensing compared: Kenya, Brazil and the UK in 2026
Three crypto-licensing regimes reach a decision point within five months of each other: Brazil on 30 October 2026, Kenya on 4 November 2026, and the United Kingdom on 28 February 2027. Firms tend to treat these as three versions of the same event. They are not. Each date does something legally different, and what happens to a firm that misses one differs in each market.
Kenya: a statutory date with nothing behind it
Kenya's date comes from section 47 of the Virtual Asset Service Providers Act 2025 (Act No. 20 of 2025): 4 November 2026. The implementing rules are Legal Notice No. 134 of 2026, made on 3 July 2026 by the Cabinet Secretary to the National Treasury and published in Kenya Gazette Supplement No. 185 (Legislative Supplement No. 103) on 22 July 2026 — 116 pages, 151 regulations, six schedules.
Read end to end, those 151 regulations contain no transitional provision, no savings clause and no deemed-licensing regulation. There is no equivalent of the UK's regulation 53 saving and no equivalent of Brazil's phased filing. That makes Kenya the hardest of the three dates: a firm that is unlicensed on 5 November 2026 has no statutory position to point at.
One caveat worth stating plainly. As at the date of this article the application window had not opened, and whether an applicant with a filed but undetermined application may keep operating is not answered anywhere in the notice. Confirm that with the regulator rather than assuming it.
Brazil: a filing deadline enforced by a duty to stop
The Brazilian framework came into force on 2 February 2026 (Resolução BCB 519, art. 28). A provider already operating on that date must file the Phase 1 authorisation set by 30 October 2026 — Instrução Normativa BCB 704, art. 9 caput. This is a filing deadline, not a licensing deadline: Phase 2 (art. 10) follows within 60 days of a favourable Phase 1 decision, extendable by up to 60 further days at the BCB's discretion on a justified request.
What gives 30 October its bite is the consequence. A provider that does not file must cease activity within 30 days, notify its clients and transfer their assets to other authorised institutions. Separately, BCB-supervised institutions are prohibited from facilitating virtual asset operations with unauthorised providers, which removes domestic banking rails from a non-filer whatever it decides to do about the ceasing obligation.
The heaviest single Phase 1 item sits at the end of art. 9: three years of financial statements audited by an independent auditor registered with the Comissão de Valores Mobiliários. That is a lead-time problem, not a drafting problem, and it is the item most likely to decide whether 30 October is reachable at all.
The United Kingdom: nothing closes on 28 February 2027
This is the one most often stated wrongly. The dates — 9:00am on 30 September 2026 to 11:59pm on 28 February 2027 — do not appear in the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102) at all. They come from an FCA direction under regulation 52, published on 20 February 2026.
Regulation 52(5) says a direction does not prevent applications for a relevant cryptoasset permission being made outside the relevant application period, and the FCA says the same on its own gateway page, adding that it will not expedite its assessment of a late application to compensate for late submission. So the gateway does not close. What closes is eligibility for the regulation 53 saving — and that saving is the thing worth having, being materially better than the regulation 56 pre-existing-contract exemption a late or refused firm falls back on.
Full commencement is 25 October 2027 (reg. 1(2)). Both savings run for two years beginning with that day (regs. 53(3) and 55(9)). Because “beginning with” includes 25 October 2027, they cease at the end of 24 October 2029 — not on 25 October 2029, as several widely-read published notes state. It is a one-day point, but it is a date firms diarise.
Who regulates you, and whether an existing registration helps
- Kenya splits supervision by activity in the VASP Act First Schedule. The Central Bank of Kenya takes wallet providers, virtual asset payment processors and stablecoin issuers. The Capital Markets Authority takes exchanges, brokers, investment advisers, virtual asset managers, ICO providers, tokenisation providers and token issuance platforms. A group doing both is read by both.
- Brazil is single-regulator: the Banco Central do Brasil. Categories are set by function rather than branding under Resolução BCB 520, art. 4 — intermediário, custodiante, or corretora where a firm does both.
- The United Kingdom is the FCA, and an existing MLR registration does not carry over. Regulation 48 substitutes MLR 2017 reg. 54(1A) so that authorised cryptoasset firms come off the FCA cryptoasset register entirely, replaced by a notification duty in new MLR reg. 56B. The FCA states there is no automatic conversion.
What is not settled
In the UK, the application fee is still unpublished; PS26/14 defers it to a Handbook Notice. A draft HM Treasury instrument amending SI 2026/102, published on 21 April 2026 with feedback closing 22 May 2026, had not been made when this was written; it would take transfers and exchanges of UK-issued qualifying stablecoins out of the dealing and arranging perimeter, so anyone advising on stablecoin distribution off SI 2026/102 alone is advising off a perimeter the Treasury has already proposed to move. In Kenya, the application window and form are outstanding. In Brazil, the capital figure is an output of a formula in the annexes to Resolução Conjunta 14/2025 read with Resolução BCB 517/2025, not a price list — assume you must compute it.
The checklists behind this article
We keep one readiness checklist per regime. Each item is cited to a rule, article or section number, every figure is marked as instrument text or as reporting of it, and open questions are left marked open rather than guessed. Kenya, USD 79, Brazil, USD 79, United Kingdom, USD 149. Updated editions are free as the position develops.
If you already know which market and which category you are in, the checklist is the whole of what you need. If your structure straddles two of these regimes, or you cannot yet tell which category you fall into, the 48-hour gap check answers that specific question first.