NAIROBI, Kenya, May 19 – When the Financial Action Task Force placed Kenya on its grey list in February 2024, it sent an uncomfortable signal to Nairobi’s financial establishment.
The designation, reserved for countries with strategic deficiencies in anti-money laundering and counter-terrorism financing controls, raised due diligence costs on Kenyan institutions, strained correspondent banking relationships, and invited the kind of international scrutiny that repels institutional capital. Nowhere was the vulnerability more apparent than in the country’s booming but largely ungoverned crypto sector.
Two years later, Kenya has mounted a legislative response that analysts say is the most consequential pivot in the country’s digital asset history. The Virtual Asset Service Providers A⁸ct, signed into law by President William Ruto on October 15, 2025 and in force from November 4, marks a shift from what legal firm Njaga and Co Advocates described as a “grey regulatory zone” toward a jurisdiction with a structured licensing regime, AML obligations, and consumer protection standards that align with FATF’s Recommendation 15.
In March 2026, the National Treasury published a draft implementing regulations for public consultation, filling in the operational detail that the Act had left to secondary legislation. Kenya is aiming to secure removal from the FATF grey list by May 2026.
The legislation has been a long time coming. Since 2015, the Central Bank of Kenya had repeatedly warned citizens against digital assets, asserting that cryptocurrencies were not legal tender and that risks of fraud and financial instability lay ahead. Yet Kenyans kept buying. By 2024, over 6.1 million Kenyans held digital assets, equivalent to roughly 10.7 percent of the population. Stablecoin transactions processed through Kenyan networks totalled approximately $3.3 billion in the twelve months to June 2024.
Bybit’s 2025 World Crypto Rankings placed Kenya fifth globally by transaction volume. The regulatory gap between what Kenyans were doing and what the law permitted had become untenable.
“The Act marks a significant shift for Kenya’s digital economy. It brings virtual asset businesses into the formal regulatory framework through licensing, governance standards, and alignment with Kenya’s AML regime,”says the Bowmans law firm.
The VASP Act establishes a dual oversight structure. The CBK supervises stablecoin issuers and custody-related activities, while the Capital Markets Authority regulates trading platforms, brokers, and market operators. Both regulators are tasked with implementing AML and counter-terrorism financing controls consistent with POCAMLA, Kenya’s proceeds of crime legislation.
Major global crypto exchanges, including Binance, say they process law enforcement requests through formal verification channels when engaging with authorities in Kenya and other jurisdictions. These requests are required to be legally authorised and properly documented, and typically relate to investigations involving fraud, cybercrime, money laundering, or sanctions-related activity.
According to the company, it handled over 71,000 law enforcement requests in 2025, supporting authorities in the recovery or seizure of more than $130 million in illicit funds. This reflects continued collaboration between digital asset platforms and public sector agencies in addressing financial crime.
“At Binance, protecting our users is at the core of everything we do. We continue to strengthen our compliance and security systems to help create a safer trading environment, while working closely with regulators and law enforcement to support trust and long-term growth of the digital asset ecosystem in Kenya,” said Larry Cooke, Africa Head of Legal at Binance.
Such cooperation between exchanges and law enforcement has become increasingly central to efforts to combat financial crime in digital asset markets.
Binance said its framework is built on proactive risk detection designed to help safeguard users and maintain market integrity, including transaction monitoring tools, behavioural analytics and real-time detection mechanisms that identify potentially suspicious activity.
In the first half of 2024, the company reported identifying and helping prevent more than $2.4 billion in potential user losses through early intervention measures, including the detection of suspicious transactions, high-risk wallet activity and indicators of account compromise.
Under the new law, licensed VASPs are required to conduct know-your-customer checks, monitor transactions, report suspicious activity to the Financial Reporting Centre, segregate client funds from operational accounts, and submit to regular audits. Operating without a licence attracts fines of up to KSh 10 million and up to ten years in prison for individuals, with corporate fines reaching KSh 20 million.
The March 2026 draft regulations introduced stringent capital requirements that have generated notable industry pushback. Capital thresholds range from KSh 30 million for brokers to KSh 500 million for stablecoin issuers. A 0.05 percent transaction levy is proposed on exchanges and token platforms. Only locally incorporated companies qualify for full licences, effectively requiring many foreign platforms that have long served Kenyan users without formal authorisation to consider establishing a local entity or potentially exiting the market. A compliance certificate pathway exists for international firms, but it carries a narrower set of permissions than a full domestic licence.
Industry players have welcomed the regulatory clarity while questioning whether the capital and compliance burden will crowd out smaller participants. The Virtual Asset Association of Kenya, formed by over 50 crypto firms in December 2025, has been coordinating regulatory engagement through the public consultation process. Chebet Kipingor, business operations manager at Busha Kenya, said at the time of the bill’s parliamentary passage that it signalled Africa’s most innovative economy was “ready to balance innovation with consumer protection.”
But others worry that the thresholds import rigidity from traditional finance into a sector that competes globally for talent and capital. If the rules are set too high, some startups may relocate to more accommodating regional jurisdictions.
Nairobi-based financial analyst Aly-Khan Satchu has been more sanguine. He has argued that aligning with FATF standards would strengthen oversight and improve investor confidence. “The direction is correct,” he said in April 2026. “Compliance with FATF requirements is critical if Kenya is to attract international capital and deepen its financial markets.”
Bowmans also assessed the framework positively but cautioned that its effectiveness would depend on implementation capacity, raising questions about whether the CBK and CMA have the technical expertise and resources to supervise a complex and fast-evolving sector.
The law’s geopolitical timing matters as much as its content. Kenya’s grey-listing arrived the same month that South Africa exited the FATF watchlist after licensing 59 crypto exchanges under its Financial Advisory and Intermediary Services Act. Nigeria enacted the Investment and Securities Act 2025, granting its Securities and Exchange Commission explicit authority over digital assets.
Both countries moved faster than Kenya to formalise their frameworks, and their exits from increased monitoring underscored the competitive cost of delay. The IMF, which provided technical assistance to Kenya’s Capital Markets Authority in 2024 and 2025, had consistently urged alignment with global standards as the path to reducing financial crime risk and restoring correspondent banking confidence.
The VASP Act also reflects the breadth of Kenya’s crypto economy rather than just its speculative dimension. The country’s digital asset market is deeply integrated with everyday financial needs: stablecoins denominated in dollars are used for cross-border remittances and merchant payments, peer-to-peer platforms mediate transactions via M-Pesa, and blockchain infrastructure companies are building identity and supply chain solutions for the broader region.
Kotani Pay’s USSD-based blockchain payments serve unbanked populations. AZA Finance, formerly BitPesa, processes cross-border settlements. Regulating this ecosystem carries risks of over-reach as much as under-reach.
The draft regulations’ public consultation window, which closed on April 10, 2026 after a series of nationwide stakeholder forums, represented Kenya’s most inclusive regulatory engagement with the crypto sector to date. The final rules, expected to be gazetted in the coming weeks, will determine what the market looks like in practice: how many platforms survive the licensing process, whether capital thresholds are adjusted, and how the CBK and CMA divide oversight responsibilities across an increasingly complex product landscape that spans stablecoins, tokenised securities, and decentralised finance.
What is increasingly clear is that Kenya’s direction of travel is irreversible. The government’s investment in building the regulatory architecture, including an IMF-backed technical assistance programme, a multi-agency taskforce, the Directorate of Criminal Investigations’ new crypto crime unit, and a dedicated blockchain forensics training module co-funded by the European Union, signals that Nairobi views digital assets not as a threat to be suppressed but as a sector to be governed.
The question now is not whether Kenya will regulate crypto, but whether it can do so in a way that is credible enough to satisfy FATF, rigorous enough to protect consumers, and flexible enough to let one of Africa’s most dynamic financial ecosystems continue to grow.
