The Virtual Asset Service Providers (VASP) Act, 2025: What You Need to Know
Overview
The Virtual Asset Service Providers (VASP) Act, 2025, was signed into law on 15th October 2025, marking a major step in Kenya’s regulation of digital assets. Before this legislation, virtual assets such as cryptocurrencies and tokens operated in a largely unregulated space. The new Act now establishes clear rules governing how virtual assets can be used, traded, and managed. Anyone offering services such as crypto exchanges, digital wallets, or token sales must now be licensed and comply with the Act’s requirements.
Defining Virtual Assets and Services
Virtual Asset
Section 2 of the Act defines a virtual asset as a digital representation of value that can be digitally traded, transferred, or used for payment or investment purposes. It excludes digital representations of fiat currencies, securities, or other financial assets.
Virtual Asset Services
The First Schedule of the Act lists several categories of virtual asset services, including:
- Virtual Asset Wallet Providers: Third parties that securely hold and manage private keys on behalf of users, ensuring proof of ownership and smooth transactions.
- Virtual Asset Exchanges: Platforms that enable users to trade, convert, transfer, and settle virtual assets , including exchanges between virtual and fiat currencies or between different virtual assets.
- Virtual Asset Payment Processors: Entities that facilitate transactions between virtual and fiat currencies, commonly used in merchant payments or remittances.
- Virtual Asset Brokers: Professionals or firms that assist clients in buying, selling, or exchanging virtual assets.
- Virtual Asset Investment Advisors: Providers of investment advice related to virtual assets, such as Initial Virtual Asset Offerings (IVAOs) or Non-Fungible Tokens ()
- Custodial Services: Safekeeping and administration of virtual assets on behalf of clients.
- Transfer Services: Sending or receiving virtual assets between parties, including peer-to-peer and cross-border transfers.
- Issuance and Sale of Virtual Assets: Offering new virtual assets to the public through token generation events or IVAOs.
Purpose of the Act
The Act seeks to:
- Establish a legal and regulatory framework for virtual asset service providers (VASPs).
- Promote transparency, consumer protection, and financial integrity.
- Align Kenya with global standards on anti–money laundering (AML) and the fight against terrorism financing, in line with the Financial Action Task Force (FATF) recommendations.
- Mitigate risks associated with cybercrime and fraud in digital asset markets.
Licensing Requirements
Under Section 11 of the Act, all VASPs operating in Kenya must be licensed. Licenses are issued annually and come with strict compliance obligations. The Act also defines the range of permitted activities, including trading, issuance, and custodial services.
Licensing criteria include, among others:
- Size, scope, and complexity of the virtual asset service.
- Knowledge, expertise, and experience of the applicant.
- Robust cybersecurity and data protection measures.
- Strong anti–money laundering (AML) safeguards.
- Proof of financial soundness and capacity to meet obligations.
- Fit-and-proper standards for directors and senior management.
Regulatory Oversight
The Act designates two key regulators:
- Capital Markets Authority (CMA): Oversees the issuance, trading, and investment-related virtual asset activities.
- Central Bank of Kenya (CBK): Focuses on payment systems and financial stability.While their mandates differ, both authorities collaborate on areas such as consumer protection, cybersecurity, and AML enforcement.
Data Protection Obligations
VASPs must comply with the Data Protection Act, 2019, by ensuring:
- Secure handling of personal data.
- Transparent and lawful data processing practices.
- Prompt reporting of data breaches.
- Protection of user privacy in line with statutory requirements.
Non-Compliance and Penalties
The Act imposes significant penalties for breaches, including:
- Operating without a license: Unlicensed virtual asset operations constitute a criminal offense, attracting fines, imprisonment, or both.
- Failure to maintain compliance: Licensed VASPs that violate governance, reporting, or cybersecurity standards risk suspension or revocation of their licenses.
- Fraud or misrepresentation: Providing false information during the licensing process or operations may lead to prosecution.
- Data protection breaches: Mishandling user data attracts additional penalties under both the VASP Act and the Data Protection Act.The CMA and CBK are empowered to investigate, audit, and enforce compliance, issue administrative sanctions, and refer serious violations for criminal prosecution.
Conclusion
The VASP Act, 2025 represents a crucial milestone in Kenya’s digital finance landscape. By regulating virtual assets, the law enhances market integrity, boosts investor confidence, and protects consumers from misuse or fraud. For businesses and investors, compliance is not just a legal requirement—it’s a strategic necessity for operating in Kenya’s evolving digital economy.
