Kenya crypto regulation: separating the asset from the activity
The guide to African crypto platforms points out that a provider’s legal status matters just as much as its interface. Regulation may cover trading, custody or payments without granting blanket authorization to every company using the word blockchain.
The first step is to map the service. Does the operator hold customers’ private keys? Does it execute their orders? Does it arrange currency conversions? Does it offer investment products? These activities may fall into different categories even when they are bundled into a single application.
For individuals, this mapping makes it possible to request the right evidence. Authorization covering one specific service should not, by assumption, be extended to a different offering. The same principle applies when an international group operates through several subsidiaries and uses different contracts depending on the customer’s country of residence.
The 2025 law and the 2026 regulations
The Virtual Asset Service Providers Act, 2025 is Act No. 20 of 2025. It came into force on November 4, 2025. The legislation addresses, among other matters, the relevant authorities, activity categories, licensing and provider obligations.
The Virtual Asset Service Providers Regulations, 2026 appear in an official publication dated July 22, 2026, under Legal Notice 134. This version should be distinguished from consultation documents circulated earlier. An article describing only a draft from March 2026 does not necessarily reflect the current stage of the framework.
Sound monitoring requires keeping the title, version and date of each document. Reusing an old screenshot without checking its scope can lead to an incorrect conclusion. The timeline matters as much as the content when a framework passes through several stages of preparation and adoption.
CBK and CMA: focus on the service category
The law allocates responsibilities according to the activities involved. Its schedule notably assigns custodial wallet services and payment processors to the Central Bank of Kenya, while exchange platforms fall under the Capital Markets Authority.
This division should not be read as an implicit authorization. It indicates which authority and category should guide the verification process. A company performing several functions must assess its entire business model rather than select only the classification most favorable to it.
For users, asking “who supervises you?” is therefore not always enough. Adding “for which service and under which entity?” produces a more useful answer. The license number, any restrictions and the conditions applicable to the account must correspond to the service actually being used.
License, application and transition: three distinct concepts
An operator may announce that it has begun the compliance process before receiving a decision. Filing an application proves neither its acceptance nor the scope of any future authorization. Transitional arrangements likewise do not amount to permanent approval of every product.
Section 47 of the law provides a one-year period from its commencement for individuals providing virtual asset services to comply. Applying this provision to a specific company nevertheless requires an assessment of its circumstances and the relevant guidance, rather than an isolated calculation presented as universal permission.
Customers should demand clear wording: license granted, application filed, specific status or merely a company statement. The words used affect the scope of the information. Avoiding the conversion of an administrative step into a safety label helps protect readers from a false impression that the process is complete.
The operational obligations behind the form
The regulatory framework includes requirements relating to governance, controls, cybersecurity and the protection of customer assets. Serious compliance therefore concerns the internal organization, not merely the collection of an identity document during onboarding.
From the customer’s perspective, seeking clear information about custody and incidents helps assess how the system operates. Where are the assets held? Under what conditions can they be withdrawn? How does the service handle complaints? A vague policy warrants additional questions before making a significant deposit.
Supervision does not make every incident impossible. Its main purpose should be to clarify obligations and avenues for redress. Market risks, fund concentration and user error continue to exist. A license does not replace a careful reading of the product’s terms.
KYC, source of funds and personal data
A provider may request information about identity or the source of funds as part of its controls. Preparing consistent documents reduces delays, particularly when making a significant withdrawal or conducting regular professional activity.
The guide to KYC checks in Africa explains which questions to ask about data collection and available remedies. Identity verification does not remove the obligation to protect personal data. An operator should be able to explain the channel being used, the purposes of the processing and the appropriate points of contact.
A request received by private message does not automatically become legitimate because it cites a law. Starting the procedure independently through the official channel makes it possible to verify its authenticity. Never provide a seed phrase or authorization code on the pretext of a regulatory check: these elements provide access to funds rather than proving identity.
Advertising and advice: distinguishing information from sales
The regulations include provisions on market conduct and promotional communications. For readers, this means identifying the commercial interests behind a recommendation and asking about risks with as much attention as benefits.
An educational video may contain an affiliate link. A comparison may favor a partner. These situations should be distinguished from independent analysis. Transparency about compensation does not eliminate every bias, but it enables the public to interpret the message correctly.
For creators and companies, checking the applicable rules before launching a campaign helps prevent performance promises from being presented as mere opinions. A vague phrase such as “guaranteed results” may carry greater implications than a technical tutorial. Documenting claims and avoiding invented official status are basic principles.
Taxation: separate from licensing
A regulatory authorization concerns a service and its obligations. Tax law examines income, transactions and the categories defined in tax legislation. Holding a license does not automatically resolve all of a company’s filing obligations, and using a supervised provider does not relieve the customer of their own obligations.
Tax announcements should specify the tax base: capital traded, fees charged, income or another basis. Confusion on this point produces incorrect calculations even when the cited rate appears accurate. Keeping invoices and statements makes it possible to distinguish the amounts rather than approximately reconstructing a year of activity.
Crypto fees and the total cost of a purchase provide an operational framework for tracking. For the filing itself, consult current information from the KRA and a local professional when the situation requires it. This guide does not offer a universal personal tax rate.
How to verify a provider in practice
Start by noting the legal name in the account terms, then identify the services you intend to use. Next, look for official evidence matching that entity and those activities. If public information remains insufficient, request a reference that can be confirmed with the relevant authority.
Keep a record of the date of the check and the response received. A license may change, and an offering may switch to a different contracting subsidiary. Reviewing new terms during a migration or product change helps prevent reliance on a verification that is no longer appropriate.
An operator that is reluctant to clarify its status should not automatically receive the benefit of the doubt. Caution does not mean declaring every company fraudulent; it means limiting one’s commitment while the necessary information is missing. Uncertainty should be stated clearly in a comparison rather than hidden behind an overall rating.
Keep a record of the verification
A check carried out today should remain traceable. Recording the source, date, entity and service helps ensure that what was actually confirmed is not forgotten. A screenshot may supplement the file, but it does not replace the official document or its context. When the company changes its contract or announces a new activity, repeat the verification for those specific elements. The previous conclusion should not automatically be applied to a product that was never examined.
Building a monitoring process that can withstand change
For a media outlet or company, a tracking table can bring together the texts, authorities, services concerned and dates of the last verification. Each update should state what has actually changed, rather than artificially refreshing an article simply to make it appear current.
Separating confirmed facts from interpretations makes corrections easier. An official publication proves its own content; it does not prove the commercial conditions of every platform. A company announcement describes its position; it does not replace independent confirmation of its status.
Kenya’s crypto regulation now requires a structured reading based on current versions and actual activities. The framework provides tools for improving market oversight. The quality of a decision still depends on the ability to verify an entity, understand a product and retain usable evidence.
