Self-custodial wallet / non-custodial software in Kenya

Kenya's Virtual Asset Service Providers Act, 2025 is Act No. 20 of 2025; it received presidential assent on 15 October 2025, was published in Kenya Gazette Supplement No. 173 (Acts No. 20) on 21 October 2025 and commenced on 4 November 2025, and its implementing regulations were gazetted as Legal Notice No. 134 of 2026 on 22 July 2026.

The Virtual Asset Service Providers Regulations, 2026 stopped being a draft on 22 July 2026, when they were gazetted as Legal Notice No. 134 of 2026 in Kenya Gazette Supplement No. 185; they run to 151 regulations in fifteen parts and six schedules and impose licensing, capital, AML/CFT/CPF, cybersecurity, custody, market-conduct and stablecoin reserve duties that are now in force.

The Capital Markets Authority licenses and supervises virtual asset exchanges, virtual asset brokers, virtual asset investment advisers, virtual asset managers, virtual asset offering providers conducting initial coin offerings, tokenisation providers and token issuance platforms under the First Schedule to the Virtual Asset Service Providers Act, 2025, and section 11(3)(fb) of the Capital Markets Act now requires it to regulate virtual asset service providers.

The Central Bank of Kenya licenses virtual asset wallet providers, virtual asset payment processors and stablecoin issuance under the First Schedule to the Virtual Asset Service Providers Act, 2025, and section 4A(1)(dc) of the Central Bank of Kenya Act now empowers it to license and supervise virtual asset service providers; virtual asset exchanges are licensed by the Capital Markets Authority and fall outside the Central Bank's perimeter.

The Office of the Data Protection Commissioner issued suo motu determination ODPC/COMP/1394/2023 on 6 September 2023 against Worldcoin Foundation, Tools for Humanity and Tools for Humanity GmbH over biometric iris data collected in Kenya; the general penalty in section 73 of the Data Protection Act, No. 24 of 2019 is a fine not exceeding three million shillings or imprisonment not exceeding ten years or both, while the Data Commissioner's administrative penalty notice under sections 62 and 63 is capped at five million shillings or one per cent of an undertaking's preceding annual turnover, whichever is lower.

Entity targeted: Bitpesa (operating through Lipsha Consortium Limited). Violation type: Operating money remittance business via Bitcoin without CBK authorization; AML/KYC non-compliance due to cryptocurrency anonymity. Penalty amount: None specified (service termination, not direct fine).

Kenya's 3 per cent digital asset tax under section 12F of the Income Tax Act, introduced by section 10 of the Finance Act 2023 from 1 September 2023, was repealed and replaced from 1 July 2025 by excise duty at 10 per cent of the excisable value of fees charged on virtual asset transactions, which the provider collects and remits to the Commissioner on or before the twentieth day of the following month; the Virtual Asset Service Providers Act, 2025 made no tax amendment.

Directorate of Criminal Investigations (DCI) Crypto Fraud Unit: Handled over 500 crypto-related cases in past three years; dozens of arrests in 2024. High-profile busts in Nairobi and Nakuru targeted scams worth $119,000, $100,000, and $30,000 (no named entities or penalties detailed). Losses totaled $43.3 million in 2024 scams.