Crypto custody and custodial wallet licensing in Kenya (CBK)

If you hold or manage a client’s private keys, you are running a custodial wallet, and in Kenya that is a Central Bank of Kenya licensed activity under the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025). The custodial wallet provider sits in the First Schedule and is one of three activities the CBK supervises, alongside payment processors and stablecoin issuers. The line that decides whether you need the licence is simple: if a third party holds and manages the keys, that is custody and it is licensed; if the user alone controls their keys, that is non-custodial provision and it is excluded. The hardest part of a custody build is not the application form. It is section 31, which requires you to hold a sufficient amount of each token type to meet client obligations, segregate client assets from your own and from other clients, and keep client crypto bankruptcy-remote from your own creditors. You cannot get the licence yet, because the implementing Regulations are still in draft, but you can and should design the segregation architecture now.

Short answer

Custodial wallets are CBK-licensed. The “Virtual Asset Wallet Provider” activity in the First Schedule covers custodial wallet services where a third party holds and manages the private keys.
Non-custodial is excluded. Self-custody software, where the user alone controls their keys, falls outside licensing.
Section 31 is the core rule: hold a sufficient amount of each token type (1:1 per token), segregate client assets from house and from other clients, and keep client assets out of reach of the licensee’s creditors.
Eligibility: a company limited by shares registered under the Companies Act (Cap. 486), a physical office in Kenya, at least three natural-person directors, and a CBK-approved CEO.
Draft capital (not yet law): the draft Regulations 2026 propose minimum core capital scaled by activity, with separate paid-up capital for each licensed activity. Not gazetted as of 30 June 2026.
You cannot apply yet. CBK and CMA confirmed jointly on 18 November 2025 that no VASP has been licensed; licensing starts only once the Regulations are gazetted.

This is the custody-specific guide. For the whole framework, the dual CBK and CMA regime, the eleven licensed activities, the AML overlay and the transitional deadline, read the pillar: VASP licensing in Kenya.

What is a custodial wallet under Kenyan law?

The First Schedule lists eleven virtual asset activities and assigns each to CBK or CMA. The relevant head is the Virtual Asset Wallet Provider, covering custodial wallet services for corporate and retail clients where a third party holds and manages the private keys. That activity sits with the Central Bank of Kenya.

The word that does the work is “custodial”. A custodial wallet is one where someone other than the end user holds the private keys that control the assets, so they can move, freeze or lose them. That control triggers the licence, because it puts client value in the hands of a third party who must be held to prudential and conduct standards.

Custody is broader than a literal “wallet app”. An exchange holding customer balances in pooled wallets, a staking service that takes possession of client coin, a treasury or asset manager holding the keys to client positions, and a neobank product that lets users hold a balance of virtual assets are all custodial. If your platform can move a client’s coin without the client signing the transaction, you are a custodian.

Custodial vs non-custodial: where the licence line falls

The Act draws a clean line: custodial wallet provision is licensed, non-custodial services are excluded. The test is who controls the private keys.

Custodial (licensed): the provider holds and manages the keys and can sign transactions on the client’s behalf, move funds, or be compelled to do so. Pooled exchange wallets, hosted hot and cold storage, managed MPC setups where the provider holds enough key shares to transact, and any “we hold your coins” model fall here.
Non-custodial (excluded): the user alone controls the keys and the provider can never move the user’s assets. Self-custody wallets where the seed phrase lives only on the user’s device, and interface software that signs nothing, fall here.

The grey zone is shared-control and MPC architectures. Marketing a product as “non-custodial” does not make it so. The substance-over-form discipline that runs through the Act (most visible in the section 4(2)(d) NFT carve-out, which looks at function not label) applies here in spirit. If your key design gives the provider the technical ability to move client assets, alone or in collusion with one party you also control, a regulator will treat it as custody whatever the app store page says. The honest test is operational: can you, the provider, move the client’s coin without the client? If yes, you are custodial.

This line matters because it decides whether the entire CBK licensing, capital, segregation and conduct regime applies to you at all. Get it wrong in the optimistic direction and you are running an unlicensed custodial business, exposed to the section 40(3) penalties set out below.

Section 31: the segregation and bankruptcy-remoteness rules

Section 31 is the single most important clause in the Act for a custodian. It sets four duties. Read it as a design brief, not a compliance afterthought.

1. Hold a sufficient amount of each type of virtual asset. The licensee must maintain in custody a sufficient amount of each type of virtual asset to meet its obligations to the customer. This is a 1:1 reserve rule applied per token, not across a portfolio. If clients hold 100 BTC, 5,000 ETH and 2 million USDT through you, you must hold each in full. You cannot net a shortfall in one token against a surplus in another, and you cannot lend out the float and hope to buy it back. Rehypothecating client coin into proprietary trades, the model that collapsed several offshore exchanges, is unlawful on the face of section 31.

2. Meet the prescribed financial requirements relating to the virtual asset. Point 1 is about holding the actual coins; this duty is the capital and prudential buffers on top, which the Regulations will set.

3. Segregate client holdings from your own and from other clients. Client assets must be segregated from the licensee’s own holdings or property and from any other non-client assets. This is a two-way wall: house assets never commingle with client assets, and one client’s assets stay identifiable and separable from another’s. Whether through per-client addresses, omnibus sub-accounts with rigorous internal ledgering, or a hybrid, you must be able at any moment to say which coins belong to which client and which to the house.

4. Do not subject client assets to the claims of your creditors. The licensee must not subject client assets to the claim of its creditors. This bankruptcy-remoteness rule protects clients if the custodian fails: client crypto sits off the licensee’s balance sheet in substance, so on insolvency it is not part of the estate available to general creditors. It is returned to clients, not distributed to lenders and trade creditors.

Retrofitting bankruptcy-remoteness onto a commingled wallet after launch is extremely hard, so the architecture has to be designed around section 31 from day one.

How do you design custody to meet section 31?

The statute states the outcome; the architecture is yours to build. Five design choices follow directly from section 31.

Key management. Cold storage for the bulk of reserves, a tightly limited hot wallet for operational liquidity, and multi-signature or MPC arrangements so no single insider, or small colluding group, can move client funds alone. Document the key ceremony and recovery procedure.
Segregation model. Per-client addresses give the cleanest segregation at higher cost. An omnibus model with internal sub-ledgers is cheaper but puts the whole weight of segregation on your accounting, which must reconstruct, to the satoshi, who owns what at any instant. Either can satisfy section 31; the omnibus model demands reconciliation discipline the regulator will examine.
Reserve attestation. Prove the 1:1 per-token reserve continuously, not annually. Daily reconciliation of on-chain holdings against the client liability ledger, with exception alerts on any divergence, is the operational heart of a custody business.
Bankruptcy-remoteness structure. Work with counsel on a structure that keeps client assets out of your estate, often on trust, so that under Kenyan insolvency law they are not beneficially owned by the licensee. This is where a custody build most needs a lawyer early.
Operational resilience. A custodian also has to satisfy the load-bearing operational duties spread across the Act: business continuity and disaster recovery under section 24(k), cyber-security measures under section 28 (which itself points to the Computer Misuse and Cybercrimes Act, Cap. 79C), real-time read-only record access under section 44, and the CEO’s section 25 duty to notify adverse events including any cyber-security incident.

What capital does a custodial wallet provider need?

The Act leaves the figures to the Regulations. Section 22(1) requires every VASP to stay financially sound by meeting prescribed capital, solvency and insurance requirements, and section 24 reinforces the duty to hold the prescribed capital. The numbers are not in the Act itself.

The draft Virtual Asset Service Providers Regulations, 2026 (published for comment 17 March 2026) propose the first concrete figures: minimum core capital scaled by activity, from about KES 2.5 million for an investment adviser up to KES 500 million for a stablecoin issuer, with the other activities in between. A firm holding more than one licence must hold separate paid-up capital for each activity, so a custodian that also runs an exchange capitalises both, not the higher of the two. The draft also proposes licensing fees of KES 100,000 to KES 2,000,000, heaviest on exchanges and stablecoin-handling payment processors. See crypto capital requirements Kenya for the full breakdown.

[DRAFT, not yet law: these figures come from the draft Regulations 2026 and the Regulatory Impact Statement circulated for comment to 10 April 2026. No Legal Notice gazetting them has been published as of 30 June 2026, and the custodian’s figure is within the proposed scaled range rather than a single published number. Treat any shilling figure as the proposed direction, not the final law.]

Who must hold the licence, and what are the eligibility basics?

The custody application goes to CBK. The general VASP eligibility rules apply:

Company limited by shares registered under the Companies Act (Cap. 486), Kenyan or foreign (section 8(1)). Sole proprietors, partnerships and trusts cannot hold the licence.
A physical office in Kenya where business is carried out (section 19); a virtual-only Kenyan presence does not satisfy this.
At least three directors, all natural persons, each on no more than two VASP boards (section 20).
A CBK-approved CEO (section 30) and a Kenyan bank account as a continuing condition (section 24).

If you custody coin as part of an exchange or broker offering, you may need a CMA licence for the markets-side activity and a CBK licence for custody, two applications to two regulators. The pillar explains the dual-regulator split in full.

Can you get a custodial wallet licence in Kenya today?

No. The VASP Act is in force, but the licensing channel sits behind subsidiary Regulations that have not been gazetted. CBK and CMA jointly confirmed on 18 November 2025 that no VASP has been licensed and that licensing begins only once the Regulations are issued. As of 30 June 2026, no Legal Notice making them has appeared, so there is nothing to apply on, no form, no fee schedule, no published prudential thresholds.

The transitional clock is still running, though. Section 47 gives existing operators one year from commencement (4 November 2025) to comply, so the window closes on 4 November 2026. If you already run a custodial service touching Kenyan users, you are inside that window and should be building the segregation architecture and corporate structure now, ready to file the moment the channel opens. Anyone marketing themselves today as a “CBK-licensed custodian” is, on the regulators’ own joint notice, misrepresenting.

Frequently asked questions

Is a custodial wallet a CBK or a CMA activity? CBK. The Virtual Asset Wallet Provider activity, covering custodial wallets where a third party holds and manages the private keys, sits with the Central Bank of Kenya in the First Schedule, alongside payment processors and stablecoin issuance.

Do non-custodial wallet providers need a licence? No. Non-custodial wallet services are excluded from licensing. If the user alone controls the keys and you can never move their assets, you are outside the custody licence. The risk is calling a product non-custodial when your key design actually lets you transact for the client; substance governs, not the label.

What does section 31 require a custodian to hold? A sufficient amount of each type of virtual asset to meet client obligations (a 1:1 per-token reserve), the prescribed financial requirements, segregation of client assets from house and from other clients, and bankruptcy-remoteness so client coin is not available to the licensee’s creditors on insolvency.

Can I run an omnibus wallet instead of per-client addresses? The Act mandates the segregation outcome, not the method. An omnibus structure with rigorous internal sub-ledgers can satisfy section 31, but the whole weight of segregation then rests on your reconciliation discipline, which a regulator scrutinises closely. Per-client addresses give cleaner segregation at higher cost.

What happens if I run custody without a licence? Section 8(2) prohibits unlicensed operation and section 40(3) sets the penalty: for a company, a fine up to KES 25,000,000; for an individual, a fine up to KES 10,000,000 or up to five years imprisonment, or both. Section 41 extends that to a director, partner or senior officer who knowingly authorised, permitted or aided the contravention. See unlicensed VASP penalties Kenya.

Does custody trigger AML obligations too? Yes. Every VASP, including a custodian, became a reporting institution under POCAMLA (Cap. 59A) from 4 November 2025: customer due diligence, ongoing monitoring, suspicious transaction reporting, record-keeping, an MLRO and registration with the Financial Reporting Centre. See crypto AML and KYC in Kenya.

Get your custody build right from day one

Custody is the activity where the gap between “we have an app” and “we meet section 31” is widest. The reserve, segregation and bankruptcy-remoteness rules touch your key management, internal ledger, corporate structure and insolvency exposure all at once, and they are far cheaper to design in than to retrofit. The channel is not open yet, which makes now the right moment to build the architecture, structure the entity, and have the file ready to lodge the day CBK starts accepting applications.

We work with custody businesses, exchanges that custody client coin, and treasury and asset managers building on Kenyan rails, covering the corporate structuring, the section 31 design, the CBK licensing strategy, the AML build-out and the data-protection overlay. Book a consultation and we will scope your custody file.