VASP Licence Kenya — Complete Guide to Virtual Asset Service Provider Licensing

What Is a VASP Licence in Kenya?

A Virtual Asset Service Provider (VASP) licence authorises a company to provide cryptocurrency and virtual asset services in Kenya. The Capital Markets Authority (CMA) introduced VASP licensing under the Capital Markets (Amendment) Act, 2022, bringing crypto businesses under formal regulation.

If your platform facilitates the exchange, transfer, safekeeping, or administration of virtual assets, you need a VASP licence. This includes cryptocurrency exchanges, crypto custody services, OTC desks, and platforms enabling crypto payments.

VASP Activities the CMA Regulates

The CMA's VASP framework covers several categories of virtual asset services.

• Exchange Between Virtual Assets and Fiat Currency — Operating platforms that convert crypto to Kenyan Shillings or other fiat currencies.
• Exchange Between Different Virtual Assets — Crypto-to-crypto trading platforms and swap services.
• Transfer of Virtual Assets — Services that facilitate the movement of crypto between wallets or users.
• Safekeeping and Administration of Virtual Assets — Custody services that hold crypto assets on behalf of clients.
• Issuance of Virtual Assets — Launching new tokens, coins, or digital assets through ICOs, IEOs, or similar mechanisms.
• Participation in Financial Services Related to Virtual Assets — DeFi protocols, staking services, and yield-generating products.

CMA VASP Licensing Requirements

The CMA has established comprehensive requirements for VASP licensing. Applicants must demonstrate they meet standards for corporate governance, financial capacity, technology security, AML compliance, and customer protection.

Key requirements include local incorporation, adequate minimum capital, fit and proper directors and senior management, comprehensive compliance policies, secure technology infrastructure, and a detailed business plan demonstrating sustainable operations.

Minimum Capital Requirements

The CMA sets minimum capital requirements for VASPs based on the type and scale of operations. These requirements ensure licensed providers have adequate financial resources to operate safely and protect customer assets.

Capital requirements vary depending on whether you operate an exchange, custody service, or other VASP activity. The CMA may also require professional indemnity insurance and security bonds as additional protection for client assets.

AML and Travel Rule Compliance

VASPs face strict anti-money laundering requirements. The CMA requires comprehensive AML policies, customer due diligence procedures, transaction monitoring systems, and suspicious activity reporting mechanisms.

Kenya has adopted the FATF Travel Rule, which requires VASPs to collect and share sender and recipient information for crypto transfers above a certain threshold. Your platform must implement technical solutions for Travel Rule compliance before licensing.

Technology and Security Standards

The CMA expects VASPs to demonstrate robust technology infrastructure. Key requirements include cold storage for customer assets, multi-signature wallets, encryption standards, penetration testing, and comprehensive audit trails.

Your platform must demonstrate secure key management procedures, disaster recovery capabilities, and incident response plans. The CMA may require independent security audits by accredited firms as part of the licensing process.

The VASP Application Process

The CMA VASP application process follows these stages.

• Pre-Application — Engage the CMA to discuss your business model and confirm VASP categorisation.
• Incorporation — Establish your Kenyan company with required share capital.
• Documentation — Prepare business plan, compliance manual, technology specifications, security audit reports, and governance framework.
• Submission — Submit your formal application with all supporting documents and fees.
• CMA Review — The Authority conducts detailed review of your application.
• Technology Assessment — The CMA may engage external experts to assess your platform security.
• Approval — Upon satisfaction, the CMA issues your VASP licence.
• Ongoing Compliance — Maintain compliance and submit required periodic reports.

Custody of Client Assets

If your VASP holds customer virtual assets, you must demonstrate secure custody arrangements. The CMA requires segregation of customer assets from company assets, regular proof-of-reserves attestations, and clear redemption procedures.

Custody policies must address key management, insurance coverage, bankruptcy remoteness, and customer asset recovery procedures. The CMA expects documented procedures for all custody-related operations.

Taxation of VASP Operations

VASP operations face specific tax obligations in Kenya. The Kenya Revenue Authority (KRA) taxes cryptocurrency transactions, and VASPs must collect and remit applicable taxes. Understanding your tax obligations is essential for sustainable operations.

Tax considerations include corporate income tax on trading profits, withholding tax on certain payments, VAT implications for services, and reporting requirements for customer transactions. Proper tax structuring from the outset prevents complications later.

How Mofintech Supports VASP Licensing

Mofintech Africa is a leading advisor for VASP licensing in Kenya. We combine deep CMA expertise with understanding of cryptocurrency technology to help crypto businesses launch compliant operations.

Our VASP services include licence strategy, documentation preparation, AML framework development, technology compliance review, security audit coordination, and ongoing regulatory advisory. Whether you are launching an exchange, custody service, or DeFi platform, we provide the regulatory guidance you need to operate legally in Kenya.