How to Register as a Virtual Asset Service Provider in Kenya
What CBK and CMA will expect and how to get licence ready fast
Kenya’s Virtual Asset Service Providers Act became law on 7 October 2025.For the first time, crypto exchanges, wallet providers, custodians and token issuers must be licensed to operate.
This is a market shift.You can prepare now and move confidently, or wait and risk delays once enforcement begins. At Cavendrys we work with CBK, CMA and the ODPC on fintech, banking and data matters every day. We understand how reviewers think and what moves applications forward.
Step 1: Build the right structure
Start with a clean legal base.Register a Kenyan company under the Companies Act or obtain a certificate of compliance if you are a foreign entity. Set up a registered office, open a local bank account and appoint Kenyan directors or authorised representatives. File beneficial ownership details and keep statutory records current. Regulators look for real presence and accountable leadership in Kenya.
Step 2: Governance and oversight
Good governance builds trust.CBK expects standards similar to banks and payment service providers. Have a fit and proper board with independent members, working audit and risk committees, and clear separation between management, risk and compliance. Appoint a Compliance Officer, a Money Laundering Reporting Officer and a Data Protection Officer. Document decision making, approvals and monitoring. Reviewers pay close attention to tone at the top.
Step 3: CBK’s priorities
Stability and consumer confidence come first.If your model involves fiat to crypto conversion, custody or stablecoins, CBK will examine capital strength, liquidity, reconciliations and risk controls. Be ready on cybersecurity, business continuity and confidential handling of customer data. If operations could disrupt the financial system or erode trust, approval will pause. Show control before you are asked.
Step 4: CMA’s lens
Market integrity and disclosure matter.For trading venues and token issuance, expect focus on accurate white papers, fair execution, surveillance against manipulation, conflict management and full segregation of client assets. Record keeping and transparent pricing are essential. The approach will align with international practice such as the EU framework for crypto assets.
Step 5: AML and transaction monitoring
Compliance is a core feature.Prepare detailed AML and counter terrorism financing policies, automated monitoring and clear procedures for suspicious transaction reporting. Implement customer identification, beneficial ownership checks and sanctions screening. Appoint an MLRO and keep evidence of investigations and outcomes. Other markets test AML readiness at the start. Expect Kenya to do the same.
Step 6: Data protection and privacy
Protect personal data with the same care as client assets.Comply with the Data Protection Act and the General Regulations. Register with the Office of the Data Protection Commissioner, publish a clear privacy notice and run Data Protection Impact Assessments where required. Use encryption, access controls, logging and response plans. Strong data governance signals maturity to both regulators and investors.
Step 7: Internal policies and systems
Bring a complete and authentic policy pack.Include risk and compliance frameworks, AML and KYC manuals, cybersecurity and ICT policies, data protection procedures, business continuity and incident response plans, consumer protection and complaints processes, and a code of ethics with conflict rules. Make sure each policy matches how you actually run the business. Reviewers can spot copy paste documents.
What to learn from other markets
Kenya is learning from proven systems.CBK and CMA will borrow good ideas and expect local application.
Mauritius
Real office presence, local management and full segregation of client assets. Fit and proper directors, board independence and regular compliance audits. Expect a similar focus on substance in Kenya.
Singapore
Strong AML with the Travel Rule, sanctions screening and technology driven monitoring. Incident reporting and vendor oversight are standard. Kenya will likely require similar proof of live analytics and audit trails.
Nigeria
Capital thresholds and an incubation program that supervises new entrants while they build full compliance. Kenya may use a phased path for existing operators.
European Union
Governance, own funds, insurance, cyber resilience and investor protection under the EU framework for crypto assets and the digital operational resilience regime. Kenya will align with the same spirit of accountability and resilience.
The takeaway.From Mauritius expect substance and segregation. From Singapore expect rigorous AML and technology readiness. From Nigeria expect a staged route to full licensing. From the EU expect high standards for governance and resilience. Benchmark yourself to these standards now.
Step 8: Are you VASP ready
A quick self check that tells the truth.
-
- Have you set up your Kenyan company and put real local oversight in place
- Are your AML, data protection and cyber policies at a level a reviewer would accept
- Could you host a CBK or CMA inspection tomorrow without major gaps
If any answer is uncertain, prepare now rather than react later.
Step 9: What we are seeing in the market
- Global exchanges are evaluating Nairobi as an East Africa hub
- Kenyan fintechs are partnering with custodians and banks in advance
- Regulators are benchmarking governance from payment service providers and digital credit providers
Early preparation sets the tone for credibility and faster progress when licensing windows open.
Global companies entering the Kenyan market
Already licensed elsewhereYou are a step ahead, yet Kenya still requires a local licence or formal recognition, and a clear plan for local substance.
- Regulatory equivalence and local adaptation. Use your global controls, then show how they map to Kenyan law. Convert group policies into local manuals and evidence that matches CBK and CMA expectations.
- Partnering for presence. Joint ventures and local partnerships can speed learning and execution. We help design shareholder and service agreements and align them with foreign ownership and local company rules.
- Technical localisation. Kenya has a unique payments and mobile money ecosystem. We guide integration with banks, MNOs and local APIs and support sandbox testing and pilot runs.
- Corporate, tax and immigration needs. We set up entities, manage tax registration, open bank accounts, prepare employment contracts and obtain work permits for foreign staff.
- Reputation and stakeholders. We support engagement with regulators and industry bodies so that your entry shows a genuine commitment to Kenya’s digital economy.
Global authorisation is valuable. Local alignment is essential. We bridge both.
How Cavendrys can help
We support the full journey from readiness to licence to ongoing compliance.
- Feasibility studies to test the model and local opportunity
- Independent testing of apps and software solutions before review
- Pre licensing packs for governance, AML, cybersecurity and data protection
- Market entry and settlement in country including employment contracts and local HR set up
- Bank account opening and support with know your business reviews
- Review of office leases and virtual office contracts
- Immigration work permit applications and executive relocation support
- Contracting support from negotiations to execution
- Integration support with mobile network operators and local payment rails
- Ongoing reporting, inspections and change control advice after licence approval
Book a confidential consultation
Speak with our regulatory team about your VASP plans. We will map your readiness, highlight priority gaps and outline what CBK and CMA will expect in the first round of applications.
