The 4 November licensing deadline: what it actually requires

The Virtual Asset Service Providers Act came into force on 4 November 2025. The Regulations that give it operational shape were gazetted in August 2026. Between those two dates a lot of Kenyan virtual asset businesses waited, reasonably enough, because there was little point applying against rules that had not been finalised.

That waiting period is over. The transitional window closes on 4 November 2026, and from that point operating without a valid licence is a criminal offence rather than a regulatory irregularity. The distinction matters enormously, and in our experience it is the single most under-appreciated fact about this regime.

Two regulators, not one

Kenya did not create a single virtual asset supervisor. Oversight is split between the Capital Markets Authority and the Central Bank of Kenya, broadly along the line between investment activity and payment activity. Exchanges, custodians, brokers, dealers, transfer service providers and token offering platforms sit on the CMA side. Stablecoin issuance and payment token services sit with the CBK.

There are ten licence categories in total. We would caution against assuming you can read your category off a summary article, including this one. Published commentary from reputable firms has not been entirely consistent on where certain categories land, particularly wallet providers, and the consequence of applying to the wrong regulator is lost months you do not currently have. Confirm your category with counsel against the gazetted text, not against a blog post.

If your business spans both payment and investment activity, you may need more than one licence and you will deal with both regulators. The capital treatment for that is not cumulative: the Regulations use a stacking formula where you hold the highest applicable requirement plus fifty per cent of each additional one.

The jurisdictional trigger is wider than most people assume

This is the provision we find businesses have most often missed, and it is the one most likely to catch firms who believe the regime does not apply to them.

A person is treated as operating in or from Kenya if they actively solicit or target Kenyan consumers, or if they derive economic benefit or income from Kenya. That test applies regardless of whether the business has any physical presence in the country, and regardless of where it is incorporated.

An offshore exchange with no Kenyan office, no Kenyan staff and no Kenyan bank account can still fall squarely inside the licensing perimeter if it markets to Kenyans and earns fees from them.

We have spoken to more than one operator who assumed that incorporation in a lighter-touch jurisdiction placed them outside the Act. It does not. If you have Kenyan users generating revenue, you should be taking advice now rather than in October.

Capital is real money, and it is paid up

The Fifth Schedule sets minimum paid-up and liquid capital by category. The figures were reduced from the draft versions, which was a sensible piece of policymaking, but they remain substantial for an early-stage business:

• Virtual asset exchange: KES 100 million paid up, KES 20 million liquid
• Wallet provider: KES 150 million paid up, KES 30 million liquid
• Stablecoin issuer: KES 300 million paid up, KES 60 million liquid

Paid up is the operative phrase. This is not a balance sheet exercise or a commitment letter. If your capital plan depends on a raise that has not closed, your licensing timeline depends on that raise too, and you should be modelling the two together.

Governance requirements will surprise founder-led businesses

The board composition rules are conventional financial services governance, which is precisely why they cause difficulty for companies built as tech startups. You need a minimum of three directors with at least a third independent. No more than a third may be related to any single director. The chairperson cannot also be the chief executive. The chief executive must be domiciled in Kenya and must demonstrate professional competence in virtual assets. Finance and audit officers need ICPAK membership or a recognised equivalent.

Recruiting a genuinely independent director who understands this sector, and who is willing to take on the associated personal exposure, is not a two week task. If you have not started, start this week.

What the compliance obligations actually look like day to day

Customer due diligence must happen before onboarding, anchored in the Proceeds of Crime and Anti-Money Laundering Act. The record keeping duty is the one that catches technical teams off guard: all platform activity must be retained for at least seven years, including metadata such as wallet addresses and chain identifiers, and it must be producible to a competent authority on request.

Seven years of transaction-level data with full chain metadata, retrievable in a form an investigator can work with, is an engineering commitment. It is not something you retrofit in the fortnight before an inspection. If your current logging would not let you reconstruct a specific user's full on-chain activity from three years ago, that is a gap to close now.

Listing and delisting decisions are notified to the Authority by the tenth of the following month, and the Authority retains the power to order a delisting on stability or consumer protection grounds. Cyber incidents carry a 24 hour reporting obligation with a fuller follow-up within five working days. Consumer assets must be segregated, reconciled monthly, reported quarterly, and never lent or pledged.

If you will not make the date

Some businesses will not be licensed by 4 November. That is a commercial reality and pretending otherwise helps nobody. What we would say is that the options available to a firm that has taken advice, documented its position and engaged early are materially better than those available to a firm that simply carries on and hopes.

Ceasing to solicit Kenyan customers, restricting the service, or pausing while an application completes are all decisions with consequences. They are still better decisions than becoming a test case for the criminal provision.

A closing caution

This article is a practitioner's summary written to help you frame the right questions. It is not legal advice, and NuruTrace does not provide legal advice. The gazetted Regulations are the authority, and your advocate is the person who should read them against your specific business model.

What we can help with is the operational half: whether your monitoring, record keeping, screening and investigation capability would actually satisfy a supervisor who came looking. That is a different question from whether your application file is complete, and in our experience it is the question firms answer last.