Digital asset regulation and tokenization in Kenya

In Kenya, the virtual asset framework distinguishes the service performed and the authority supervising it. Stablecoin issuance, an exchange and a tokenized asset offering require examination of different categories. The 2025 Act and regulations published in 2026 need to be read together when preparing market entry.

A business representing property or a financial right must also explain the connection between token and asset. This guide separates provider licensing, offering approval and enforceable holder rights. It also distinguishes existing operators’ transition from access for new applicants.

What the Act and final regulations establish

The Virtual Asset Service Providers Act 20 of 2025 commenced on 4 November 2025. Legal Notice 134 of 2026, published in the 22 July Gazette, develops licensing, capital, conduct, custody and specific services. The framework should no longer be described solely as an Act awaiting the draft consulted on in March.

Regulation 4 covers services in or from Kenya and operators actively soliciting or targeting local consumers, or deriving economic benefit or income from Kenya, regardless of physical presence. That territorial connection requires assessment. The Act also excludes certain closed ecosystems; not every internal blockchain use constitutes VASP activity.

Which activities CBK and CMA supervise

The Act's First Schedule assigns custodial wallets, payment processing and stablecoin issuance to the Central Bank of Kenya, CBK. The Capital Markets Authority, CMA, handles exchanges, brokerage, advice, management, offerings and tokenization functions. Responsibility follows the activity, rather than a platform's commercial name.

The Financial Reporting Centre participates in the anti-money laundering framework, while data processing must comply with separate data-protection legislation. These responsibilities sit alongside sectoral permission. An exchange adding payments, issuance or custody must check relevant categories and conditions before expanding operations.

How to prepare an application and assess transition

The final regulations published by CMA require information on directors and beneficial owners, the business, resources, source of funds, controls and systems auditing. Regulation 6(4) provides for a decision within thirty days after all information is received and applicant due diligence completed. This is neither a guaranteed period from initial submission nor automatic approval.

Section 47 of the Act requires providers operating at commencement to comply within one year from 4 November 2025. It does not grant an equivalent extension to every new business. Permission and scope must be checked in official registers and decisions; this research establishes the statutory route but does not certify that an individual entity holds a licence.

What a tokenized asset offering requires

Regulations 61 and 62 distinguish a tokenization licence from approval of a tokenized asset offering. Requirements include clear rights, independent valuation, asset existence and condition, absence of encumbrances and custody arrangements. Documentation must explain who holds title to the underlying asset and how ownership can be established.

Regulation 63 requires disclosure of whether direct or fractional ownership exists and how it is structured, alongside transfer restrictions and redemption on asset disposal or insolvency. Requiring an explanation of that legal connection does not turn every token into a title document. Documentation and applicable asset formalities remain decisive for enforceable holder rights.

Which obligations affect custody and stablecoins

The regulations address safeguarding customer assets, market controls, disclosure, complaints, continuity and cybersecurity. The Act adds AML obligations and prohibits mixer, tumbler and anonymity-enhancing services within section 21. Specific functions need assessment: cryptography alone does not make all software a prohibited service.

For stablecoins, regulations 67–72 require CBK authorisation and approved documentation, establish redemption rights and prohibit remuneration connected with holding periods. Reserve and safeguarding rules complement that regime. Neither an exchange permission nor a tokenization licence replaces requirements applying to stablecoin issuance or admission.

What to define before applying in Kenya

Prepare an activity-and-authority matrix with shareholders, beneficial owners and capital sources. If relying on transition, document that the activity existed when the Act commenced. A statutory procedure does not establish that a particular business is already authorised; check its decision and register entry.

For tokenization, assemble underlying title, valuation, encumbrances, custody and transfer or redemption rights. Separate offering approval from the entity’s licence. Decision deadlines depend on a complete application and completed due diligence; permission conditions and practical implementation need checking before a commercial date is fixed.

To understand how this framework applies to your project, discuss your case with our team.