New law will strengthen virtual assets providers' framework

President Williiam Ruto during lthe signing of seven parliamentary Bills that will accelerate the achievement of our Bottom-Up Economic Transformation Agenda.[PSCU]

The enactment of Kenya’s Virtual Assets Service Providers (VASPs) Act marks a significant milestone in Kenya’s financial services regulatory framework. For the first time, virtual assets and VASPs have been defined in law and brought within a structured supervisory regime. In doing so, Kenya joins a growing number of jurisdictions seeking to harness digital innovation while safeguarding financial stability.

The Act adopts a functional, twin-peak regulatory model, in which the Central Bank of Kenya (CBK) is mandated to supervise VASPs engaged in payment and settlement activities. At the same time, the Capital Markets Authority (CMA) oversees VASPs involved in the trading of tokenised securities and investment products. In principle, this approach reflects global best practice: Regulation aligned with activity rather than technology.

However, architecture also introduces a critical implementation challenge. Many virtual asset business models do not operate neatly within regulatory silos. A single platform may facilitate payments, custody, token issuance, and secondary trading. Without clear coordination mechanisms between the CBK and CMA, dual licensing requirements and overlapping supervisory expectations may create uncertainty, increase compliance costs, and slow innovation. The success of the framework will depend less on the statutory allocation of mandates and more on how coherently those mandates are carried out.

Beyond the twin peaks, the VASPs ecosystem inevitably draws in additional regulatory actors. The Office of the Data Protection Commissioner (ODPC) will play a central role given the volume and sensitivity of personal and transactional data processed by digital asset platforms. Meanwhile, in the context of Kenya’s recent grey listing by the Financial Action Task Force (FATF), robust anti-money laundering and counterterrorism (AML/CFT) oversight will remain paramount. 

Blockchain intelligence tools will play an increasingly important role in advancing transaction monitoring and on-chain analytics to enhance supervisory oversight, strengthen AML/CFT compliance, and provide visibility into risk patterns without imposing stringent restrictions on innovation. Integrating such tools into supervisory frameworks would allow Kenya to meet international integrity standards while supporting the responsible growth of the sector.

The result is not over-regulation; it is multi-layered regulation. However, without deliberate alignment, fragmentation becomes a real risk. As subsidiary regulations are developed, clarity on licensing and compliance expectations will be critical to providing market certainty. Legal recognition without operational clarity can inadvertently create regulatory uncertainty, precisely at a time when clarity is most needed.

This is not a theoretical concern; Kenya is one of Africa’s most active digital asset markets. A significant number of Kenyans, particularly youth, freelancers, cross-border traders, and diaspora-linked households, already interact with crypto-based platforms for payments, remittances, and investment. The ecosystem represents a meaningful opportunity to deepen financial inclusion, lower transaction costs, and integrate informal economic activity into more transparent channels.

Opportunity must, however, be matched with safeguards; Virtual assets introduce real risks, volatility, consumer harm, cyber threats, and potential misuse for illicit financial flows. 

Ms. Mbaja is a governance and compliance expert