Kenya’s crypto scene now regulated after President Ruto signs VASP bill (2025) into law

In a landmark move for Kenya’s burgeoning digital economy, President William Ruto has today signed the Virtual Asset Service Providers (VASP) Bill, 2025 into law. The signing, which took place amidst a period of national mourning following the recent passing of former Prime Minister Raila Odinga, was part of a package of eight bills assented to by the head of state. The new law, now officially the Virtual Asset Service Providers Act, 2025, effectively ends the “wild west” era for cryptocurrency in the country, ushering in a new age of regulation.

For years, crypto traders and investors in Kenya have operated in a grey area. While platforms like Binance have flourished, they did so without a formal regulatory framework. This new Act changes everything, aiming to provide a legal structure to license and regulate crypto activities, enhance user protection, and curb illicit financial flows.

As we reported earlier this year when the National Treasury first tabled the draft bill, this legislation has been in the pipeline for some time. Now that it is law, here’s a breakdown of what it means for crypto platforms and, more importantly, for you, the user.

CMA and CBK take charge

Under the new law, the primary regulatory bodies overseeing the crypto space will be the Capital Markets Authority (CMA) and the Central Bank of Kenya (CBK). The Act assigns specific crypto activities to each regulator, creating a clear division of responsibility.

• The Capital Markets Authority (CMA) will be responsible for licensing and supervising activities related to investment. This includes Virtual Asset Exchanges, Virtual Asset Brokers, Virtual Asset Managers, and those conducting Initial Coin Offerings (ICOs).
• The Central Bank of Kenya (CBK) will oversee services related to payments and custody. This covers Virtual Asset Custodial Wallet Providers, Virtual Asset Payment Gateways, and the issuance of stablecoins.

The Cabinet Secretary for the National Treasury also has the power to designate other public bodies as regulatory authorities in the future.

What changes for crypto platforms?

Any person or company wanting to offer crypto services in or from Kenya must now obtain a license from the relevant regulatory authority. Operating without one is now illegal. To get and maintain this license, VASPs must adhere to a strict set of obligations:

• Company directors and senior officers must pass a “fit and proper” assessment, ensuring they are credible and competent.
• Platforms have a legal duty to protect customer assets, including maintaining sufficient funds of each crypto type to meet their obligations to customers. They must also segregate client assets from their own holdings.
• VASPs must meet prescribed capital, solvency, and insurance requirements to ensure they are financially sound.
• All licensed VASPs are required to maintain a registered physical office in Kenya.
• They must implement and maintain robust cybersecurity measures as prescribed under the Computer Misuse and Cybercrimes Act.
• A major thrust of the Act is combating money laundering and terrorism financing. VASPs must now comply with the Proceeds of Crime and Anti-Money Laundering Act, which includes conducting customer due diligence (KYC) and reporting suspicious transactions.

What this means for the everyday crypto user

While the law primarily targets service providers, it has direct implications for users. For instance:

1. With mandatory licensing and rules on protecting customer funds, the risk of losing your crypto to a fraudulent or mismanaged platform is significantly reduced. This regulation brings a much-needed layer of legitimacy to the local market.
2. The requirement for company directors to be vetted should help weed out bad actors and blatant scams that have previously preyed on unsuspecting Kenyans.
3. Be prepared for more stringent identity verification processes. To comply with anti-money laundering laws, exchanges will require you to provide more personal information, similar to opening a bank account. Anonymity will be a thing of the past on licensed platforms.
4. The Act defines a “virtual asset” as a digital representation of value used for payment or investment. It explicitly excludes digital representations of fiat currencies, securities, and certain Non-Fungible Tokens (NFTs) that are not used for payment or investment purposes.

The government is not taking this new framework lightly. The Act lays out severe penalties for violations. For instance, an individual who commits an offense under certain sections could face a fine of up to KES 20 million or imprisonment for up to seven years, or both. A company could face a fine not exceeding KES 20 million.

The Virtual Asset Service Providers Act, 2025 marks a pivotal moment. While some may criticize the end of the unregulated freedom that defined the early crypto space, this move is a critical step towards mainstream adoption. It provides a framework for innovation to happen within the bounds of the law, protects consumers, and integrates Kenya into the global standard for financial regulation. The crypto industry in Kenya is finally growing up.