From Regulation to Reality: What Kenya’s Virtual Asset Act Means for the Future of Digital Finance

Image by pvproductions on Freepik

The process of digitally regulating assets in Kenya has hit a breaking point. Since the recent enactment of the Virtual Asset Service Providers Act 2025 (the Act), the discussion regarding what the Act suggests has shifted to what it will actually entail.

This legislation is not a technical measure; it is a declaration of purpose concerning the future of finance in Kenya. Having a legal framework concerning the licensing and regulation of parties involved in the virtual asset trade makes Kenya a regional pioneer in legitimising the blockchain-based business. However, as it is always the case with many innovative laws, the boundary between innovation and its suppression will be put to test during enforcement.

1. A New Architecture for Legitimacy

   
   

   For the first time, virtual asset service providers (VASPs) in Kenya will operate under a formal licensing regime. Under Section 11, no person may carry on or hold themselves out as conducting virtual asset services without a licence from the relevant regulatory authority, defined under section 6 to include the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA).

   
   

   It is a dual recognition, which is an indication of a new era of legitimacy. The law grounds the operations of digital assets in the same corporate responsibility principles that apply to the activities of financial and capital market participants by limiting the business of VASPs to incorporated persons and outlawing the business of natural persons. Practically, it would draw in institutional investors, institutionalise current crypto activities, and allow conventional financial institutions to work with the industry in a very transparent environment.

2. The Promise and the Paradox of Dual Oversight

   
   

   The dual regulatory nature of the framework, however, brings in some complexity. The Act provides the CBK and the CMA jurisdiction according to whether a virtual asset is executed as a payment tool or as an investment tool.

   This plan, although logical on paper, is prone to cause jurisdictional overlap. An example can be a stable coin that is pegged to the shilling and therefore is the work of the CBK since it is a payment tool; however, the same asset may also be subject to the regulations of the CMA when it is traded in the investment market.

   The Act gives both regulators wide responsibilities, to license, oversee, ensure compliance and give directions. In the absence of proper inter-agency coordination, VASPs may experience overlapping compliance requirements or be delayed in time to obtain approval. The success of the law will be determined by the possibility of the CBK and the CMA to operationalise harmonised guidelines as opposed to parallel regimes.

3. Compliance and the Cost of Credibility

The compliance architecture of the Act is no doubt a strong one. VASP applicants should not only be financially sound, but also demonstrate governance integrity vide the fit-and-proper evaluations of directors and senior officers.

The regulatory checklist is further to the cybersecurity standards, anti-money laundering (AML) standards, and the elaborate capital, solvency, and insurance requirements. Although these protection initiatives enhance the integrity of the market, they also increase the entry point to the market for small innovators.

A single licensing scheme may cause unintended network effects of entrenching and forcing new

startups to work under the informal system, which is the risk that the Act is intended to contain. The regulators in Kenya might thus require to implement tier licensing or regulatory sandboxes, providing relative regulation of smaller organisations without jeopardising consumer welfare.

4. Data, Surveillance, and Consumer Protection

   
   

   The Act is rather aggressive in its approach towards transparency and supervision. Regulators have the authority to gain online or automatic real-time read-only access to the records of the clients and licensee transactions. This is a powerful improvement to AML enforcement and is in line with the overall data-driven compliance trend in Kenya, especially in the context of the Data Protection Act.

   
   

Nevertheless, it creates critical privacy and data governance concerns. The possibility of constant access control, even in its read-only form, puts the interests of authorized government control and the right to privacy against each other. With Kenya being in line with international standards of digital finance, it should also make sure that the accessibility of regulations does not transform into unrestrained monitoring.

Fairness, integrity and transparency are other obligations that promote consumer protection covered under Sections 21-22. Such provisions ensure that the licensees have their offices registered in Kenya and have sufficient accounting systems with which they are held accountable even in the case of international crypto exchanges that are willing to enter the Kenyan market.

5. Kenya in the Global Digital Economy

   
   

   The Kenyan legislative initiative resembles an international trend towards regimes of codified digital assets. Licensing of crypto asset service providers has also been proposed by South Africa’s Financial Sector Conduct Authority (FSCA), while the Markets in Crypto-Assets (MiCA) Regulation of the European Union will come into force in 2025.

   
   

   Through the adoption of a holistic domestic framework, Kenya is placed in these new jurisdictions, which regulate, and not restrain, virtual assets. The provisions of the Act on the Initial Virtual Asset Offering have also brought Kenya to the international standards on issuing tokens, that is, it must be pre-approved to prevent fraud and unregulated fundraising.

6. Transitional Challenges and Institutional Readiness

   
   

   Any existing VASP has six months to make an application to be licensed upon commencement. Although this gives a reasonable time frame of compliance, it also challenges the institutional preparedness of the CBK and the CMA. Both regulators will be required to develop licensing forms, vetting processes and oversight technology within a short period, almost instantly. The implementation might overburden the regulators with insufficient infrastructure and training, and dishearten the markets without proper training.

7. A Defining Moment for Digital Finance

The Act is a historic document. It puts Kenya on a list of a limited yet increasingly active African countries taking digital finance policy formulation into their own hands. It is rooted in corporate governance, transparency, and risk management, which is the developing attitude of the country toward regulating fintech.

But, like any ambitious law, the genius will not be in the writing, but in the performance. The question now is how to turn legislative goodwill into sensible, innovatively-friendly regulation, which serves to safeguard the consumer without strangling advancement.

This law can make the Kenyan crypto scene, which is diverse and active but not yet a digital economy, a regulated, trusted, and globally competitive industry, implemented prudently. However, when it is overdone, it could become promise paralysis. In any case, Kenya has taken a step, and the community of the fintech sector on the continent will be observing keenly.

Written by Paul Nyaosi and Crisphus Borura

Please note that this is not legal advice and is intended primarily for information purposes. If you require tailored advice or further information, please contact us on info@mckayadvocates.com.