By Theophilas Matundura
The Virtual Asset Regulation Series
The fifteen Parts and six Schedules of Legal Notice No. 134 of 2026 — what each Part does, what every licensee must have, and what each licence category must hold in capital.
PRIMARY PROVISIONS
The Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), made under section 49 of the Virtual Asset Service Providers Act, No. 20 of 2025
Monday 10 August 2026
| At a glance The Regulations comprise 151 regulations across fifteen Parts, with six Schedules. They were made on 3 July 2026 and gazetted on 22 July 2026 as Legal Notice No. 134.Minimum paid-up capital ranges from nil for an investment adviser to KSh 300 million for a stablecoin issuer, with liquid capital required in addition.Capital stacks: a licensee carrying on more than one activity holds the highest category plus fifty per cent for each additional activity.Every licensee — whatever its category — must have nine board-approved policies, four officers, a board with one-third independent directors, a Kenyan office, a Kenyan bank account and insurance.Reporting runs monthly, quarterly and in some cases daily. Two audits and a recurring penetration testing cycle apply throughout the life of the licence. |
1. What the Regulations are
The Virtual Asset Service Providers Act, No. 20 of 2025 created the licensing requirement but left the operative detail to be prescribed. Section 49 empowered the Cabinet Secretary for the National Treasury, on the advice of the relevant regulatory authorities, to make regulations, and listed eighteen matters those regulations might address.
The Virtual Asset Service Providers Regulations, 2026 discharge that power. They were made on 3 July 2026 by the Cabinet Secretary to the National Treasury and published as Legal Notice No. 134 in Kenya Gazette Supplement No. 185 (Legislative Supplement No. 103) on 22 July 2026.
Regulation 3 states their object: to provide a framework for licensing and regulating persons offering virtual asset services in Kenya; to regulate advertisements and promotions of virtual assets by licensed persons; to set the financial and capital requirements for the various types of provider; and to provide for the implementation of freezing and seizure orders.
This article walks through all fifteen Parts, then examines in detail the two matters most businesses ask about first — what capital is required, and what every licensee must have in place regardless of category.
2. The fifteen Parts at a glance
| Part | Regulations | Subject |
| I | 1–5 | Preliminary — citation, interpretation, objects, application and fees payable |
| II | 6–16 | Licensing and authorisation — application, determination, renewal, transfer, and CBK authorisation for currency conversion |
| III | 17–40 | Ongoing requirements — conduct, resources, markets, business rules, disclosure, records, due diligence, allocation, compliance officer and risk management |
| IV | 41–45 | Corporate governance — governance arrangements, the board, the chief executive officer, finance officers and internal auditors |
| V | 46–48 | Intervention in management and statutory management |
| VI | 49–60 | Initial coin offerings and listings for virtual asset exchanges |
| VII | 61–65 | Tokenisation of real-world assets |
| VIII | 66–84 | Virtual asset wallet providers and issuers of stablecoin |
| IX | 85–95 | Capital and financial requirements |
| X | 96–100 | Cybersecurity measures, systems and control |
| XI | 101–107 | Safekeeping and management of consumer assets |
| XII | 108–122 | Market conduct and related offences |
| XIII | 123–133 | Advertisements and promotions of virtual assets and products |
| XIV | 134–141 | Freezing and seizure orders |
| XV | 142–151 | Enforcement actions and general provisions |
2.1 The six Schedules
| Schedule | Contents |
| First | Fees payable — application, licence, renewal, approval and other fees |
| Second | The prescribed application form for a virtual asset service provider licence |
| Third | Contents of a business plan — twelve headings from executive summary to implementation plan |
| Fourth | The fit and proper assessment form |
| Fifth | Capital and liquidity requirements by licence category |
| Sixth | Membership of the Virtual Assets Services Coordination Forum |
3. Getting licensed — Part II
An application is made in the form set out in the Second Schedule and must be accompanied by twenty-one categories of supporting material listed in regulation 6(2). These include the personal details and qualifications of directors, senior officers, significant shareholders and beneficial owners; a business plan prepared under the Third Schedule; a completed fit and proper assessment; proof of source of funds; a description of systems and controls; nine operational policies; audited financial statements for three years; an independent information systems audit including vulnerability assessment and penetration testing; evidence of paid-up and liquid capital; full disclosure of cross-border operations and regulatory status elsewhere; and the certificate of incorporation, register of beneficial owners and proof of payment of the application fee.
The regulator may require the applicant to attend an interview. Under regulation 6(4) it then has thirty days from receipt of all required documents and completion of its due diligence to determine the application.
3.1 The Third Schedule business plan
The business plan is a substantial document in its own right. The Third Schedule prescribes twelve headings, to be addressed in sequence: executive summary; corporate governance structure; operational plan; description of the services to be offered; technology and security infrastructure, including network architecture and data flow diagrams and hot and cold wallet storage; risk management framework with a risk register; compliance and internal controls; financial projections over three to five years; market analysis; fees and charges structure; consumer asset safeguarding arrangements; and an implementation plan projecting consumer numbers, value and volume for each of the first three years.
3.2 After the licence
- Commence within twelve months of the grant of the licence (regulation 8).
- Renew annually, with the application lodged at least two months before expiry (regulation 11).
- Notify within two days of any alteration to application information or any material event (regulation 9).
- Hold the licence thirty-six months from commencement of business before any transfer or assignment may be considered (regulation 13(2)(b)).
3.3 A second authorisation for currency conversion
Regulation 14 requires any person seeking to transact the business of converting virtual assets to or from foreign currency to obtain a separate authorisation from the Central Bank of Kenya before commencing that business. The Central Bank notifies its decision within ten days. The authorisation expires on 31 December of the year of issue and is renewable annually.
4. Capital and financial requirements — Part IX
Part IX is the Part that determines whether a business can enter the market at all. Regulation 85(1) states the governing principle: a licensee must at all times have capital and other financial requirements of a nature and amount commensurate with its scale, risk and complexity.
4.1 The Fifth Schedule thresholds
| Licence category | Paid-up capital | Liquid capital |
| Virtual asset offering provider — stablecoin issuance | KSh 300,000,000 | KSh 60,000,000 or 100% of current liabilities for at least 30 days, whichever is higher |
| Virtual asset wallet provider | KSh 150,000,000 | KSh 30,000,000 or 100% of current liabilities for at least 30 days, whichever is higher |
| Virtual assets exchange | KSh 100,000,000 | KSh 20,000,000 or 8% of total liabilities, whichever is higher |
| Virtual asset manager | KSh 20,000,000 | KSh 4,000,000 or 8% of total liabilities, whichever is higher |
| Virtual asset offering provider — initial coin offering | KSh 20,000,000 | KSh 4,000,000 or 8% of total liabilities, whichever is higher |
| Virtual asset offering provider — token issuance platform | KSh 20,000,000 | KSh 4,000,000 or 8% of total liabilities, whichever is higher |
| Virtual asset payment processor | KSh 10,000,000 | 100% of current liabilities for at least 30 days |
| Virtual asset broker | KSh 10,000,000 | KSh 2,000,000 or 8% of total liabilities, whichever is higher |
| Virtual asset offering provider — virtual asset tokenisation | KSh 10,000,000 | KSh 2,000,000 or 8% of total liabilities, whichever is higher |
| Virtual asset investment advisor | Nil | Nil |
Source: Fifth Schedule to the Virtual Asset Service Providers Regulations, 2026, referenced by regulations 6(2)(h), 85(2)(a), 85(3) and 85(12).
4.2 Four distinct tests
Regulation 85 does not impose one capital requirement but four, and each must be satisfied independently.
- Paid-up capital at the Fifth Schedule level. Regulation 2 defines this as issued and fully paid-up ordinary shares paid by shareholders.
- Core capital of not less than that paid-up figure, maintained at the time of licensing and at all times afterwards (regulation 85(3)). Regulation 2 defines core capital as issued and fully paid-up ordinary share capital together with disclosed reserves.
- Liquid capital at the Fifth Schedule level, maintained at all times (regulation 85(12)). Regulation 2 defines liquid capital as the amount by which a licensee’s liquid assets exceed its liabilities.
- Shareholders’ funds not falling below the prescribed minimum paid-up capital at all times (regulation 85(11)). Regulation 2 defines shareholders’ funds as net worth — total assets less total liabilities.
4.3 What does not count as paid-up capital
Regulation 85(4) treats issued share capital as paid up only where the consideration has been received in cash, or in other consideration approved by the regulator that is capable of objective valuation and immediate realisation. Regulation 85(5) then excludes four things expressly:
- unpaid, partly paid or contingent capital commitments;
- shareholder loans or advances;
- capital raised through borrowed funds, whether directly or indirectly; and
- revaluation reserves or internally generated intangible assets.
4.4 Capital must remain unencumbered
Under regulation 85(8), core capital must not be pledged, charged or otherwise subjected to any form of security; must not be subject to any contractual or legal restriction impairing its availability to absorb loss; and must not be repayable, redeemable or callable at the initiative of any shareholder or third party. The regulator may require evidence that the capital is free of encumbrance.
Where core capital falls, or is likely to fall, below the prescribed minimum, regulation 85(13) requires the licensee to notify the regulator immediately in writing and to submit a remedial capital restoration plan for approval.
4.5 Stacking across activities
| Where a licensee intends to or has been authorised to carry out more than one permissible activity, the licensee shall hold the amount of paid-up capital applicable to the highest-capital category and fifty percent of the paid-up capital for each additional activity to be undertaken.— Regulation 85(6) | |
| Worked exampleA platform licensed for custodial wallet services, exchange and brokerage holds: KSh 150,000,000 (wallet, being the highest category) + KSh 50,000,000 (fifty per cent of exchange) + KSh 5,000,000 (fifty per cent of broker) = KSh 205,000,000.Regulation 85(7) additionally permits the regulator to require an increase in paid-up capital depending on the risk profile of the provider. | |
4.6 Insurance and professional indemnity
Regulation 88 requires every licensee to hold insurance covering consumer virtual assets, commensurate with the level of risk and the scale of the service, and specifically against cybersecurity risks, theft, loss of keys and operational failure. Policies must be held with an insurer licensed in Kenya, or one outside Kenya approved by the regulator in consultation with the Insurance Regulatory Authority. A group policy is permitted provided it names the licensee as an insured party and states the level of cover. Where cover cannot be obtained, the licensee must submit an alternative proposal for approval. A licensed virtual asset investment adviser must hold professional indemnity cover of at least KSh 1 million.
4.7 Virtual asset managers — additional requirements
Regulation 87 imposes three further obligations on virtual asset managers: they must maintain risk-based capital covering operational and technology risk; a manager handling consumer funds must appoint a custodian licensed in Kenya; and investment in or through a related company may not exceed ten per cent of the total value of virtual assets under management without regulatory approval.
5. What every licensee must have
Certain requirements apply to every licensee, whatever its category and whichever authority supervises it.
5.1 Nine policies
Regulation 6(2)(f) requires the operational policies guiding the applicant’s activities to include: risk management; AML/CFT/CPF; data protection and privacy; cybersecurity and information technology; complaints management; market conduct; consumer protection; conflict of interest; and a business continuity and disaster recovery plan.
5.2 A board, and four officers
Regulation 41 requires effective, transparent and adequate governance arrangements, including a documented organisational structure, segregation of duties and internal controls, and — significantly — the separation of the virtual asset business into a separate business unit with its own management structure and books of account.
Regulation 42 then prescribes the composition of the board:
- at least three members, of whom one-third must be independent directors;
- not more than one-third of the directors may be related to any director; and
- the chairperson or a director may not be appointed chief executive officer.
Regulation 42(4) defines an independent director by reference to six disqualifying relationships, each tested over a five-year look-back — executive employment, association with an adviser or consultant or with senior management, association with a significant consumer or supplier, a contract of service, close relation to an adviser or to senior management, and any of those relationships with an affiliate.
| Officer | Requirement | Source |
| Chief executive officer | Approved by the regulator; fit and proper under section 18 of the Act; professionally competent in virtual assets or a relevant field; and domiciled in Kenya. | s.30 Act; r.44 |
| Compliance officer | Appointed or designated by the board; must monitor regulatory compliance and must not be involved in any function that is itself the subject of compliance. | r.39 |
| Finance officer | Member in good standing of ICPAK, or of an equivalent international body recognised by ICPAK. | r.45 |
| Internal auditor | Same professional standing requirement. | r.45 |
5.3 Resources, markets and business rules
- Human and technology resources — fit and proper and appropriately trained staff, a management team with adequate experience, and secure technology maintaining data confidentiality (regulation 18).
- Proper markets — every provider must establish and operate markets conducive to the economic good of the country and which do not cause or promote financial instability (regulation 19).
- Business and default rules — a licensee dealing in virtual asset exchange must have clear, fair rules that are legally enforceable by consumers and freely published, approved by the regulator, and supported by compliance procedures covering enforcement, complaints, discipline and market abuse detection (regulation 20).
5.4 Records, reports and audits
| Obligation | Frequency or period | Source |
| Capital adequacy or liquidity reports | Monthly | r.92(b) |
| Financial statements | Quarterly, by the tenth day of the following month | r.92(a) |
| Audited annual financial statements | Within three months of financial year end | r.92(c) |
| Exchange and token issuance platform returns, including daily trading reports | Monthly, by the tenth day | r.93 |
| Assets under management reports | Quarterly, within fifteen days of quarter end | r.94 |
| Stablecoin reserve and circulation reports | Monthly, by the tenth day | r.84(1) |
| Stablecoin reconciliation reports | Daily | r.84(2) |
| Vulnerability assessment and penetration testing | Bi-annually in year one, then at least annually | r.97(4)(a) |
| Cybersecurity incident notification | Within 24 hours; detailed report within 5 working days | r.99 |
| Accounting records retained in original digital form | At least seven years | r.89(4) |
The external auditor must be a member in good standing of the Institute of Certified Public Accountants of Kenya, approved by the regulator, appointed annually and serving a maximum of four consecutive financial years (regulation 90). Where the auditor’s report is qualified on the completeness or accuracy of the accounting records, the auditor must report that to the regulator and the licensee within seven days (regulation 91). The financial year of every licensee ends on 31 December (regulation 95).
6. The product-specific Parts
- Part VI (regulations 49–60) governs initial coin offerings — application, determination, approval of the promoter and of trading platforms, validity of approval, the white paper and its modification, the advertising window, extension of issuance, change of promoter, the CMA register, and listing requirements.
- Part VII (regulations 61–65) governs tokenisation of real-world assets — the licence, issuance requirements, the white paper and its modification, and listing.
- Part VIII (regulations 66–84) governs wallet providers and stablecoin issuers. For stablecoins it addresses licensing, the white paper and issuer liability, public offers, issuance and redeemability, the prohibition on granting interest, reserve assets and their custody, investment of funds received, ongoing information to holders, conflicts, redemption, marketing, audits and reporting, and delisting or halting of issuance.
7. The protective Parts
- Part X (regulations 96–100) — a cybersecurity strategy, systems and controls including audit trail requirements, the testing cycle, incident reporting within twenty-four hours, and the cybersecurity audit report.
- Part XI (regulations 101–107) — safeguarding of consumer assets on a distributed ledger platform, consumer protection, the consumer service agreement, management and safekeeping of consumer funds and assets, systems and controls, protection from third-party claims, and records and accounts.
- Part XII (regulations 108–122) — standards of conduct, consumer understanding of risk, complaints, the consumer care system, deterrence of market abuse, outsourcing, and nine market conduct offences including insider dealing, market manipulation, false trading, fraudulent inducement, front-running, churning and cold calling.
- Part XIII (regulations 123–133) — the advertising code: general requirements, content, performance information, fees and commissions, risk warnings, duties of advertisers and third parties, internet advertising, prohibited online practices and record keeping.
8. Enforcement and coordination
Part XIV (regulations 134–141) establishes the machinery for freezing and seizure of virtual assets — the obligations of a licensee served with an order, preservation of value, custody of seized assets, protection of uninvolved consumers, and the offence of non-compliance.
Part XV (regulations 142–151) provides the sanctions. Administrative fines under regulation 142 reach KSh 3 million for an individual and KSh 5 million for a company, alongside suspension, revocation or a direction to remedy. Criminal sanctions under regulation 143 reach KSh 5 million or five years’ imprisonment for an individual and KSh 8 million for a company. Penalties are recoverable summarily as a civil debt.
Regulation 145 establishes the Virtual Assets Services Coordination Forum, chaired by the National Treasury. The Sixth Schedule names nineteen member agencies, including the Central Bank of Kenya, the Capital Markets Authority, the Asset Recovery Agency, the Ethics and Anti-Corruption Commission, the Financial Reporting Centre, the Directorate of Criminal Investigation, the National Intelligence Service, the Nairobi International Financial Centre Authority, the Office of the Data Protection Commissioner, the Office of the Director of Public Prosecutions, the Kenya Revenue Authority and the Communications Authority — with power for the Cabinet Secretary to designate others. The Forum meets at least quarterly and reports annually to the Cabinet Secretary. Regulation 148 permits the two regulators to undertake supervisory and licensing activity jointly.
Regulations 149 and 150 govern voluntary and involuntary liquidation of a licensee, and regulation 151 preserves the right of appeal under section 43 of the Act.
9. In summary
The Regulations are comprehensive by design. They govern entry, conduct, governance, capital, technology, custody, market behaviour, advertising, asset recovery and exit. For a business assessing what participation requires, three points do most of the work.
- Identify the category correctly. It determines the regulator, the capital, the fees and several category-specific obligations, and stacking under regulation 85(6) makes multi-activity licensing materially more expensive.
- Treat capital as four tests, not one. Paid-up, core, liquid and shareholders’ funds must each be satisfied, continuously, in unencumbered form.
- Build the standing obligations before applying, not after. The nine policies, the board with independent directors, the four officers, the information systems audit and the Third Schedule business plan are all application requirements with long lead times.
Later volumes in this series examine each Part in detail, with a dedicated article on the capital, liquidity, fee and insurance position of every licence category.
| This article is published by T.M.M & Partners Advocates for general information. It explains provisions of the Virtual Asset Service Providers Act, No. 20 of 2025 and the Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026) as at 10 August 2026 and does not take account of any subsequent amendment. It is not legal advice and no advocate–client relationship arises from reading it. Any person affected by these provisions should obtain advice on their specific circumstances. © T.M.M & Partners Advocates. All rights reserved. |
CONTACT US
Speak to our team
For advice on the Virtual Asset Service Providers Act, 2025 and the Regulations, 2026 — licensing, capital and governance requirements, AML/CFT compliance, or engagement with the Capital Markets Authority and the Central Bank of Kenya — please contact us at info@tmmadvocates.ke, robert@tmmadvocates.ke, theo@tmmadvocates.ke.
The Virtual Asset Regulation Series
A series of articles examining of the Virtual Asset Service Providers Act, No. 20 of 2025 and the Virtual Asset Service Providers Regulations, 2026.
Published by T.M.M & Partners Advocates.
www.tmmadvocates.ke · info@tmmadvocates.ke