Kenya’s November 4 VASP Deadline Passes With No License Granted: What Happens Next?

TL;DR

• Kenya’s one-year transition period for VASPs ended on November 4, 2026.
• Section 47 of the Act, which commenced on November 4, 2025, gave existing VASPs one year to comply with the Act’s provisions.
• Section 8 of the Act mandates firms operating in Kenya or firms targeting the Kenyan market to obtain a license. 
• Non-compliance carries penalties of up to KSh25 million for corporate bodies and KSh10 million for individual executives. 
• As of 9 November, neither the CMA nor the CBK has published an official public VASP register. 

Kenya’s VASP Act took effect on November 4, 2025. Regulators gave virtual asset service providers (VASPs) a one-year statutory transition period to comply with the Act’s provisions. That one-year period officially ended on Wednesday, November 4, 2026.

For the Kenyan market, this marks a shift from market preparation to active compliance. However, public VASP tracker data shows that there were no public registers of approved licenses gazetted as of November 9. Crypto exchanges, custodial wallet providers, and fintech operators serving Kenyan users now face significant regulatory exposure.

Kenya’s Crypto Licensing Transition Period Has Ended

Under Section 47 of the Act, VASPs already operating in the Kenyan Market before the Act’s commencement got a one-year transition period to comply with the framework. Section 47 was not designed as a mere application-submission cutoff.

The law required existing service providers to achieve full operational compliance with the Act, including securing formal licensing, by the 4 November 2026 deadline. After that date, any business operating in or from Kenya without a granted licence is subject to the Act’s enforcement provisions.

Statutory Requirements for Virtual Asset Businesses

Section 8 of the VASP Act requires VASPs in Kenya to obtain a licence before operating in Kenya or targeting Kenyan consumers. Oversight is divided between two primary regulators based on the functional nature of the financial service:

• Central Bank of Kenya (CBK): Regulates activities linked to store-of-value, payments, and issuance, including custodial wallet providers, virtual asset payment processors, and stablecoin issuers.
• Capital Markets Authority (CMA): Oversees investment- and trading-focused activities, including virtual asset exchanges, brokerage platforms, investment advisers, fund managers, initial coin offering (ICO) platforms, and real-world asset (RWA) tokenisation projects.

The implementing VASP Regulations (gazetted on 22 July 2026 under Legal Notice No. 134) define “operating in or from Kenya” broadly. Foreign platforms that actively market to Kenyan users, derive economic benefit from the Kenyan market, or utilise local payment rails like M-Pesa fall within the regulatory perimeter, regardless of whether they hold a physical office in Nairobi.

Status of Pending Applications

The challenge for the market is the status of operators whose licence applications remain pending.

The VASP Regulations specify that regulators have 30 days to decide on an application. However, that 30-day clock only begins after the authority receives all required documentation and completes its internal background checks and due diligence.

Because the final VASP Regulations were gazetted on 22 July 2026, existing market participants had only ~105 days to digest complex capital requirements, adjust governance structures, structure reserve custody accounts, and submit complete files.

Neither the VASP Act nor its implementing Regulations explicitly include an automatic statutory grace period allowing applicants to continue public operations after the deadline while their applications are pending. As noted by the regulatory monitoring platform VASP Tracker in its 9 November update, neither the CBK nor the CMA had published an official public VASP licence register or gazetted initial licence grants.

This legal position, that operating without a final granted licence after the deadline lacks express statutory protection, reflects a strict reading of the published text rather than an official enforcement action or judicial ruling.

Potential Penalties and Regulatory Exposure

Entities operating without an active licence after 4 November face significant legal liability. The statutory penalties under the VASP Act distinguish between corporate bodies and individual directors:

• A company convicted may face a fine of up to KSh25 million.
• An individual may face a fine of up to KSh10 million, imprisonment of up to five years, or both.
• Directors, partners and senior officers may also be liable where they knowingly authorised, permitted or aided the offence.

These criminal penalties exist alongside administrative sanctions under the Regulations, which empower the CBK and CMA to issue stop-and-desist directions, freeze localised assets, or bar key personnel from financial sector management.

What Happens Next for Kenya’s Crypto Market?

The transition’s close establishes a new, complex regulatory environment for retail users, local fintechs, and international platforms:

• Operational Assessments: Unlicensed or pending operators must evaluate whether to pause active marketing, restrict local onboarding, or adjust transaction capabilities to limit enforcement risk while awaiting approval.
• Offshore Platform Impact: Global platforms targeting East Africa can no longer rely on jurisdictional distance. Local banking partners and payment gateways face increased scrutiny regarding transaction processing for unverified entities.
• Market Verification: Institutional partners and retail consumers await official CBK and CMA VASP registers to confirm which operators hold full statutory approval.

Kenya’s transition from an unregulated environment to a dual-regulated framework represents a significant step forward for financial clarity in Africa. However, until regulators clarify the status of pending applications and publish approved registers, market participants must manage their regulatory exposure carefully.