DeFi protocol frontend in Kenya
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Kenya with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Customer Due Diligence (CDD): Verify customer identities, maintain beneficial ownership (UBO) records, and apply enhanced due diligence for high-risk relationships (e.g., cross-border VA activities) — per ke.licensing.customer-due-diligence-cdd-verify
- Suspicious Transaction Reporting (STR): Report suspicious activities, including those involving virtual assets, to the Financial Reporting Centre (FRC) promptly — per ke.licensing.suspicious-transaction-reporting-str-report
- Record-Keeping Obligations: Retain transaction records, customer data, and verification documents for at least 7 years (per POCAMLA standards applied to VASPs) — per ke.licensing.record-keeping-obligations-retain-transaction-records
- AML/CFT compliance program required as part of VASP licensing under the VASP Act 2025 and draft Regulations 2026 — per ke.licensing.draft-virtual-asset-service-providers
- Asset segregation: e.g., 30% of customer funds in Kenyan banks for stablecoin-related activities — per ke.licensing.draft-virtual-asset-service-providers
Key Restrictions
- DeFi frontend operators are likely captured as VASPs under the Virtual Asset Service Providers Act 2025 if they facilitate exchanges, transfers, or custody of virtual assets for Kenyan residents — requiring a VASP license
- Physical office requirement in Kenya under draft VASP Regulations 2026 — per ke.licensing.draft-virtual-asset-service-providers
- Geofencing/KYC screening of Kenyan residents is necessary; operating without a license and without customer screening risks CBK enforcement (Bitpesa precedent — services terminated for facilitating crypto without authorization) — per ke.enforcement.entity-targeted-bitpesa-operating-through
- Fee-taking (e.g., frontend fees, swap fees) strengthens the case that the operator is a VASP providing financial services for reward, making licensing unavoidable
- Coordination with multiple regulators (CMA, CBK, FRC, KRA) required — single-window licensing not yet fully implemented
Key Risks
- CBK enforcement precedent: Bitpesa's crypto-to-fiat service was terminated and upheld by courts for operating without authorization — similar logic could apply to a fee-collecting DeFi frontend targeting Kenyan users — per ke.enforcement.entity-targeted-bitpesa-operating-through
- DCI Crypto Fraud Unit has handled 500+ crypto-related cases; aggressive enforcement against unlicensed crypto operators — per ke.enforcement.directorate-of-criminal-investigations-dci
- Regulatory framework is in flux (VASP Act just enacted Nov 2025, draft regulations still being finalized 2026) — high ambiguity on how DeFi-specific models will be classified
- Worldcoin enforcement (biometric data collection banned, operations halted) shows regulators take a strict approach to novel crypto-adjacent models that lack compliance frameworks — per ke.enforcement.entity-targeted-tools-for-humanity
- Tax obligations through KRA: crypto income is taxable, and failure to register/report could trigger KRA and DCI action — per ke.licensing.kenya-revenue-authority-kra-handles
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Kenya's Virtual Asset Service Providers Act, 2025 is Act No. 20 of 2025; it received presidential assent on 15 October 2025, was published in Kenya Gazette Supplement No. 173 (Acts No. 20) on 21 October 2025 and commenced on 4 November 2025, and its implementing regulations were gazetted as Legal Notice No. 134 of 2026 on 22 July 2026.
The Virtual Asset Service Providers Regulations, 2026 stopped being a draft on 22 July 2026, when they were gazetted as Legal Notice No. 134 of 2026 in Kenya Gazette Supplement No. 185; they run to 151 regulations in fifteen parts and six schedules and impose licensing, capital, AML/CFT/CPF, cybersecurity, custody, market-conduct and stablecoin reserve duties that are now in force.
Virtual Asset Service Providers Bill 2025: https://www.afriwise.com/blog/kenya-now-has-a-crypto-law-virtual-asset-service-providers-vasp-bill-2025
Virtual asset service providers licensed in Kenya must perform customer due diligence before onboarding a client under regulation 32 of the Virtual Asset Service Providers Regulations, 2026, carried out in accordance with the Proceeds of Crime and Anti-Money Laundering Act, and the Second Schedule to the Virtual Asset Service Providers Act, 2025 makes every virtual asset service provider a reporting institution under that Act.
The Second Schedule to Kenya's Virtual Asset Service Providers Act, 2025 amends the Proceeds of Crime and Anti-Money Laundering Act so that the definition of reporting institution expressly includes a virtual asset service provider, which places Kenyan virtual asset service providers under the suspicious transaction reporting duty owed to the Financial Reporting Centre with effect from the Act's commencement on 4 November 2025.
Kenyan virtual asset service providers must keep a record of both client and own transactions for not less than seven years from the date of the transaction under section 44(2) of the Virtual Asset Service Providers Act, 2025, repeated at regulations 22(1)(b) and 26(3) of Legal Notice No. 134 of 2026, and must give the regulator online read-only real-time access to those records under section 44(1).
Kenya's financial intelligence unit is the Financial Reporting Centre, established under the Proceeds of Crime and Anti-Money Laundering Act, which receives and analyses suspicious transaction reports; AML/CFT/CPF supervision and enforcement for virtual asset service providers is carried out by the Central Bank of Kenya and the Capital Markets Authority under section 32 of the Virtual Asset Service Providers Act, 2025.
The Capital Markets Authority licenses and supervises virtual asset exchanges, virtual asset brokers, virtual asset investment advisers, virtual asset managers, virtual asset offering providers conducting initial coin offerings, tokenisation providers and token issuance platforms under the First Schedule to the Virtual Asset Service Providers Act, 2025, and section 11(3)(fb) of the Capital Markets Act now requires it to regulate virtual asset service providers.
The Central Bank of Kenya licenses virtual asset wallet providers, virtual asset payment processors and stablecoin issuance under the First Schedule to the Virtual Asset Service Providers Act, 2025, and section 4A(1)(dc) of the Central Bank of Kenya Act now empowers it to license and supervise virtual asset service providers; virtual asset exchanges are licensed by the Capital Markets Authority and fall outside the Central Bank's perimeter.
The Capital Markets Authority licenses virtual asset exchanges, brokers, investment advisers, managers, initial-coin-offering providers, tokenisation providers and token issuance platforms under the First Schedule to the Virtual Asset Service Providers Act, 2025; the implementing rules stopped being drafts on 22 July 2026, when the Virtual Asset Service Providers Regulations, 2026 were gazetted as Legal Notice No. 134 of 2026 in Kenya Gazette Supplement No. 185.
Kenya's 3 per cent digital asset tax under section 12F of the Income Tax Act, introduced by section 10 of the Finance Act 2023 from 1 September 2023, was repealed and replaced from 1 July 2025 by excise duty at 10 per cent of the excisable value of fees charged on virtual asset transactions, which the provider collects and remits to the Commissioner on or before the twentieth day of the following month; the Virtual Asset Service Providers Act, 2025 made no tax amendment.
Entity targeted: Bitpesa (operating through Lipsha Consortium Limited). Violation type: Operating money remittance business via Bitcoin without CBK authorization; AML/KYC non-compliance due to cryptocurrency anonymity. Penalty amount: None specified (service termination, not direct fine).
Directorate of Criminal Investigations (DCI) Crypto Fraud Unit: Handled over 500 crypto-related cases in past three years; dozens of arrests in 2024. High-profile busts in Nairobi and Nakuru targeted scams worth $119,000, $100,000, and $30,000 (no named entities or penalties detailed). Losses totaled $43.3 million in 2024 scams.
The Office of the Data Protection Commissioner issued suo motu determination ODPC/COMP/1394/2023 on 6 September 2023 against Worldcoin Foundation, Tools for Humanity and Tools for Humanity GmbH over biometric iris data collected in Kenya; the general penalty in section 73 of the Data Protection Act, No. 24 of 2019 is a fine not exceeding three million shillings or imprisonment not exceeding ten years or both, while the Data Commissioner's administrative penalty notice under sections 62 and 63 is capped at five million shillings or one per cent of an undertaking's preceding annual turnover, whichever is lower.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a DeFi protocol frontend serving Kenyan residents is likely to be classified as a VASP under the VASP Act 2025, requiring a high-burden license, local entity incorporation, physical office, full AML/CFT compliance (CDD, STR, 7-year record-keeping), geofencing/KYC of users, and asset segregation; fee-taking virtually guarantees regulated status, and enforcement risks are significant given the Bitpesa and DCI precedents.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?