A crypto exchange license in Kenya is issued by the Capital Markets Authority (CMA), not the Central Bank, because running an exchange is one of the CMA-supervised activities in the First Schedule to the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025). An exchange is any platform that provides transfer and conversion services between virtual assets, or between virtual assets and fiat currency. To hold the licence you must be a company limited by shares registered under the Companies Act (Cap. 486), run a physical office in Kenya, appoint at least three natural-person directors and a regulator-approved CEO, pass the fit-and-proper test, and meet the prescribed capital. The catch is timing: the Act commenced on 4 November 2025 but the implementing Regulations are still in draft, so no exchange has been licensed yet and you cannot apply today. The channel opens only once the Cabinet Secretary gazettes the Regulations, and existing operators must comply by 4 November 2026 under section 47.

Short answer

For the full framework across all eleven activities and both regulators, start with the pillar: VASP licensing in Kenya. This guide goes deep on the exchange activity only.

What counts as a crypto exchange under the VASP Act?

The First Schedule lists a “Virtual Asset Exchange” as a discrete activity: a platform providing transfer and conversion services between virtual assets, or between virtual assets and fiat. If your platform lets a user swap KES for a token, swap one token for another, or move value between virtual assets through an order book or a quote engine, you are running an exchange and the activity sits with the CMA.

It is distinct from a broker, which facilitates the exchange of virtual assets for and on behalf of clients: a broker routes orders, an exchange is the venue. It is also distinct from a trading, clearing and settlement platform, a separate named CMA activity. Both are CMA heads, but you licence the function you actually perform, and an integrated exchange that also clears and settles may touch more than one head. The regulator assesses what you do, not the label on your pitch deck.

What sits outside the definition comes from section 4: closed-loop loyalty or utility points, central bank digital currency and fiat, and non-fungible tokens not used for payment or investment. Section 4(2)(d) makes that a substance-over-form test. Calling your instrument an NFT will not remove it from scope if it functions like a security or a payment instrument, and a platform that lists tokens with a yield promise or a secondary-market profit expectation is running an exchange whatever it calls the assets.

The territorial reach is wide. Section 3 covers activity “in and from Kenya”, and section 8(2) catches anyone who carries on, purports to carry on, or holds out as carrying on the business “in or from Kenya”. A foreign-incorporated exchange that onboards Kenyan users is in scope. See Crypto business: offshore vs Kenya for how that plays out for a foreign group.

Who can apply for a crypto exchange licence in Kenya?

Eligibility is set by section 8(1). The applicant must be a company limited by shares, either incorporated in Kenya or a foreign company limited by shares registered under the Companies Act (Cap. 486). Sole proprietors, partnerships, unlimited companies and trusts cannot hold the licence. A Dubai or BVI parent can apply, but only after it has registered as a foreign company under the Companies Act. There is no route for an individual trader to be licensed personally.

The structural requirements stack on top of corporate form:

If you have not yet incorporated the operating company, that is the first build step. See Register a crypto company in Kenya for the corporate scaffolding an exchange applicant needs in place.

How does the exchange application process work?

The mechanics live in sections 10 and 11. The application goes to the CMA, because the exchange activity is assigned to the CMA in the First Schedule. Under section 10(2) it must be made in the manner, and with the fee, prescribed by the Cabinet Secretary, so the form, the supporting bundle and the application fee all live in the Regulations, which are not yet gazetted.

Section 10(6) lists what the regulator must consider, and that list is your file’s spine: eligibility under section 8, the skills and experience of your personnel, your ability to meet the Act’s requirements and to comply with consumer protection and data protection laws, your financial obligations including insurance, capital and solvency, the fit-and-proper status of directors and senior officers under section 18, cybersecurity standards under the Computer Misuse and Cybercrimes Act (Cap. 79C), suitable premises or data solutions for retaining records, the public interest, and compliance with the Regulations.

Section 11 adds the substantive assessment matrix: the size, scope and complexity of the service, the underlying technology, the applicant’s expertise, its AML, CFT and counter-proliferation-financing procedures, its data protection systems, the risks the exchange poses, the applicant’s net worth, source of funds, capital reserves and financial stability, the impact on financial services in Kenya, the prospect of promoting innovation and competition, and the fit-and-proper status of directors, senior officers and beneficial owners. Section 11(k) adds that if your business is already supervised in another sector, the CMA needs a no-objection from that regulator before it can grant the licence.

The CMA may grant the licence with or without conditions, or reject it with written reasons under section 10(4). A grant is published in the Kenya Gazette within thirty days under section 10(7). You must notify the regulator of any change to the information you supplied within fourteen days under section 10(8). Knowingly or recklessly providing false information is an offence under section 40(2). The Act does not bind the CMA to a fixed decision turnaround; any window is delegated to the Regulations and is not yet gazetted.

Are the exchange directors and owners fit and proper?

Fit and proper is governed by section 18, and for an exchange it is the test that most often decides the file. It applies to directors, senior officers and any other person the CMA names. The factors are wide: probity, competence, experience and soundness of judgment, diligence, educational and professional qualifications, knowledge of legal obligations, any evidence of dishonesty or fraud offences, any prior contravention of virtual asset law, and financial-standing integrity.

The test does not stop at the board. Section 11(j) extends it to beneficial owners at the licensing stage, and section 32(2)(a) extends it again, for AML purposes, to significant shareholders, beneficial owners, directors and senior officers. The CEO is separately approved under section 30. For an exchange backed by offshore capital, the CMA looks through the structure to the people who ultimately own and control the venue, so the ownership chart and the source-of-funds story have to survive scrutiny before a licence is granted.

How much capital does a crypto exchange need?

Section 22(1) requires every VASP to maintain its business in a financially sound condition by complying with the prescribed capital, solvency and insurance requirements, and section 24(b) repeats the duty to hold the prescribed capital. The Act leaves the figures to the Regulations and expressly contemplates different figures for different activities, so an exchange does not carry the same number as an investment adviser.

The draft Virtual Asset Service Providers Regulations, 2026 published for comment on 17 March 2026 propose the first concrete numbers. Minimum core capital is scaled by activity: from about KES 2.5 million for an investment adviser up to KES 500 million for a stablecoin issuer, with the other categories in between, and a firm holding more than one licence must hold separate paid-up capital for each activity.

[DRAFT, not yet law: these figures come from the draft Regulations 2026 and the Regulatory Impact Statement circulated for comment to 10 April 2026. No Legal Notice gazetting them has been published as of 30 June 2026, so they may change. Do not commit to a specific shilling figure in a binding context until the Legal Notice is published.] The exact exchange tier within the range is not yet fixed on the public record, so plan around the draft band and confirm your tier when the Regulations are gazetted. The deeper breakdown sits in Crypto capital requirements in Kenya.

The fee side is the same shape. The draft Regulations propose licensing fees from KES 100,000 to KES 2,000,000, with the highest falling on exchanges and stablecoin-handling payment processors, so an exchange should expect to sit near the top of the band. That figure is also draft until gazetted.

What changes if the exchange also holds client coin?

This is where most exchange files get the architecture wrong. The moment your exchange holds customer virtual assets, section 31 applies, and it is the most demanding clause in the Act for an operator. It requires the exchange to maintain, in its custody, a sufficient amount of each type of virtual asset to meet its obligations to customers; to meet the prescribed financial requirements; to segregate client holdings from its own and from any other non-client virtual assets; and to keep client assets out of reach of the licensee’s creditors. In plain terms: client crypto must be fully reserved one-to-one per token type, held off the exchange’s balance sheet, segregated from house and other clients, and bankruptcy-remote. You cannot run a fractional book or commingle customer coin with treasury, and the sub-wallet, omnibus-with-ledger or trust architecture has to be designed around section 31 from day one.

Section 44 reinforces this: on request, the exchange must give online, automated, real-time, read-only access to both its client and its own virtual asset transaction records, and keep those records for at least seven years. An exchange that custodies needs proof-of-reserves-grade record-keeping wired into the platform. For the custody obligations in full, including where custody crosses into a separately licensed activity, see Crypto custody license in Kenya.

The dual-licence trap: when an exchange needs a CBK licence too

The single most expensive mistake in scoping an exchange is assuming one licence covers the whole product. The VASP Act licenses activities, not firms. The exchange head sits with the CMA. But a custodial wallet provider, where a third party holds and manages the private keys, is a separate First Schedule activity assigned to the CBK.

So if your exchange runs a built-in hosted wallet where you hold customer keys, you are doing two licensed activities at once: an exchange (CMA) and a custodial wallet (CBK). That means two applications to two regulators, two fee lines and, on the draft Regulations, separate paid-up capital for each activity, with section 31 segregation applying to the custody leg on top.

The boundary that saves you is the carve-out for non-custodial wallets, which are excluded from licensing entirely. If your exchange is genuinely non-custodial, where the user controls their own keys and you never hold them, you avoid the CBK custodial-wallet licence and stay a single-activity CMA file. The line is who controls the private keys. The instant you take custody, the second regulator is in the room.

The pattern recurs across the activity list: an exchange that processes fiat-and-crypto payments touches the CBK payment-processor head, and one that lets users buy a stablecoin you issue touches the CBK stablecoin head. Map every feature against the First Schedule before deciding how many licences you are running. The split between CMA and CBK is set out in VASP license categories in Kenya.

What happens if you operate an exchange without a licence?

Section 8(2) prohibits carrying on, purporting to carry on, or holding out as carrying on virtual asset services in or from Kenya without a licence. Section 8(3) makes contravention an offence, and section 40(3) sets the penalty: for an individual, a fine of up to KES 10,000,000 or up to five years imprisonment, or both; for a company, up to KES 25,000,000. Marketing an unlicensed exchange to Kenyan users carries the same band, because “holds itself out” is a separate limb of section 8(2). Section 41 extends that exposure to a director, partner or senior officer who knowingly authorised, permitted or aided the contravention: negligence alone is not enough, but a founder who runs the exchange knowing it is unlicensed cannot hide behind the corporate veil.

The trap right now is the transitional window. Section 47 gives existing operators one year from commencement to comply, and that clock closes on 4 November 2026. The fact that the licensing channel is not yet open does not, on the face of the Act, stop the clock. Any exchange already serving Kenyan users must either prepare to file the moment the channel opens and document a good-faith effort, or wind the Kenyan-facing service down before the window expires. The deadline mechanics are at VASP compliance deadline in Kenya, and the enforcement detail at Unlicensed VASP penalties in Kenya.

Frequently asked questions

Which regulator licenses a crypto exchange in Kenya, CBK or CMA? The Capital Markets Authority. A virtual asset exchange is a CMA-supervised activity under the First Schedule. The CBK supervises custodial wallets, payment processors and stablecoin issuance, so an exchange that also custodies or processes payments needs a second CBK licence.

Can I get a crypto exchange licence in Kenya today? No. The Act commenced on 4 November 2025, but the Regulations are still draft. CBK and CMA confirmed on 18 November 2025 that no VASP has been licensed and that licensing starts only once the Regulations are gazetted. As of 30 June 2026, no Legal Notice making them has appeared on the public record.

Does my exchange need to be a Kenyan company? It must be a company limited by shares registered under the Companies Act (Cap. 486), either a Kenyan company or a foreign company registered under that Act. Sole proprietors and partnerships cannot hold the licence.

How much capital does an exchange need? The figures sit in the Regulations. The draft Regulations 2026 propose core capital from about KES 2.5 million for an investment adviser up to KES 500 million for a stablecoin issuer, with separate paid-up capital per activity. The exact exchange tier is not yet fixed, and all figures are draft and not yet gazetted as of 30 June 2026.

Does an exchange need a separate licence to hold customer coin? If the exchange holds customer assets, section 31 segregation applies to it directly. If it runs a hosted custodial wallet where it controls customer keys, that is a separate CBK-licensed activity. A genuinely non-custodial exchange avoids the custody licence because non-custodial wallet services are excluded from licensing.

What are the AML obligations for an exchange? From 4 November 2025 every VASP is a reporting institution under POCAMLA (Cap. 59A): customer due diligence, transaction monitoring, Suspicious Transaction Reports within two days, Cash Transaction Reports above USD 15,000, seven-year records, an MLRO, and registration with the Financial Reporting Centre. See Crypto AML and KYC in Kenya.

What is the penalty for running an unlicensed exchange? For a company, a fine of up to KES 25,000,000. For an individual, up to KES 10,000,000 or five years imprisonment, or both. A director or senior officer who knowingly authorised, permitted or aided the contravention is personally liable for the same penalty under section 41.

If you are building a crypto exchange aimed at Kenyan users, the time to scope your file is now, while the Regulations are being finalised, not after they are gazetted and your competitors are in the queue. We cover the full stack: corporate structuring, the CMA application strategy, the section 31 custody architecture if you hold client coin, the dual-licence mapping where a CBK wallet or payment leg is involved, the fit-and-proper and beneficial-ownership file, the POCAMLA AML build-out and the data protection registration. Book a consultation and we will scope your exchange properly.

Related reading: VASP licensing in Kenya, Crypto custody license in Kenya, VASP license categories in Kenya, Crypto capital requirements in Kenya, Register a crypto company in Kenya, and Fintech lawyer Kenya.