If you are building a crypto exchange, a custodial wallet, a stablecoin, a payment gateway or a tokenisation platform aimed at Kenyan users, you need fintech counsel who already lives inside the Virtual Asset Service Providers Act, 2025. Muthomi Mutiga & Co Advocates is that counsel. We act for founders, treasury teams and foreign groups planning a Kenyan entry, and we cover the full stack: corporate structuring, licensing strategy across the two regulators, the anti-money-laundering build, the data-protection registration, and the tax position under Kenya’s new excise regime. The most important fact to act on now is timing. The VASP Act commenced on 4 November 2025, every existing operator must comply by 4 November 2026, and the licensing channel is still not open because the Regulations have not been gazetted. That gap is not a reason to wait. It is the window in which the structuring, the AML systems and the application file get built so you are first in the queue the day the channel opens.

Short answer

Why hire a fintech lawyer in Kenya now?

Three things changed in the last year, and together they make this the moment to get counsel in place.

First, virtual assets became statute. The Virtual Asset Service Providers Act, 2025 was assented to on 15 October 2025, gazetted on 21 October 2025, and commenced in full on 4 November 2025. Every Part is in force, including the prohibition on unlicensed operation and the penalty band behind it.

Second, the anti-money-laundering obligations are already live, even though no licence can yet be issued. The Act made every virtual asset service provider a “reporting institution” under the Proceeds of Crime and Anti-Money Laundering Act from 4 November 2025. Full customer due diligence, transaction monitoring, suspicious-transaction reporting, an MLRO and registration with the Financial Reporting Centre apply to your crypto business now, regardless of where the licensing process stands.

Third, there is a hard deadline. Existing operators have one year from commencement to comply, closing on 4 November 2026. With the channel still shut, the safe path is to have the structure, the compliance systems and the draft application ready to lodge the moment the Regulations are gazetted.

Founders get this wrong in two ways: doing nothing because “you cannot get a licence yet anyway”, or marketing themselves as already licensed when no one in Kenya is. The first runs into the deadline with nothing built. The second is misrepresenting on the regulators’ own joint notice. Our job is to keep you out of both.

For the full statutory framework, read our pillar on VASP licensing in Kenya. This page is about how we help you act on it.

What does a fintech and virtual asset lawyer actually do?

The work breaks into six connected workstreams. A real engagement usually runs several in parallel because they depend on each other.

VASP licensing strategy. The Act licenses activities, not firms. The First Schedule lists eleven activities and assigns each to either the Capital Markets Authority or the Central Bank of Kenya, so a business that runs a wallet and an exchange needs two licences from two regulators. We map your product to the right activity heads, work out whether you need one regulator or both, and design the licence stack before a single application is drafted. Getting this map wrong is the most expensive early mistake a founder can make.

AML and POCAMLA build. This is the part that binds today. We stand up the customer due diligence, the monitoring rules, the suspicious-transaction and cash-transaction reporting workflows, the seven-year records regime, the internal controls, the MLRO function, and the registration with the Financial Reporting Centre through the goAML portal. For the substance, see crypto AML and KYC in Kenya.

ODPC registration and data protection. A VASP holds national IDs, passports, transaction histories, wallet addresses and IP logs. Almost all of it is personal data, which makes you a data controller under the Data Protection Act, and registration with the Office of the Data Protection Commissioner is mandatory before you process any of it. We handle the registration so it does not become a gap in your licence file. See crypto data protection in Kenya.

Corporate structuring. The Act requires a company limited by shares, Kenyan or foreign but registered under the Companies Act. Sole proprietors and partnerships cannot hold a licence. There are also rules on directors, the chief executive, physical presence in Kenya, and share issues and transfers needing regulator approval. We design the entity, board and ownership so it passes the eligibility bar rather than getting bounced on a structural defect.

Tax. The old 3% Digital Asset Tax was repealed. The live tax since 1 July 2025 is a 10% excise duty on the fees a VASP charges, not on transaction value. There is no bespoke statutory crypto capital-gains regime, so treatment turns on the facts. We structure your flows around the current rules and flag where the proposed Finance Bill 2026 reporting obligations are heading. See crypto tax in Kenya.

Regulatory opinions. Sometimes you do not need a licence at all. The Act carves out genuine closed-loop loyalty points, central bank digital currency and fiat, certain non-fungible tokens, and pure utility tokens, and non-custodial wallet services are excluded from licensing. We write the reasoned opinion on whether your specific product is caught, applying the substance-over-form test the regulators will use rather than the label you have chosen. For founders, an opinion that says “you are outside the Act” can be worth more than any licence.

Who needs a VASP licence, and who does not?

Whether you need a licence is the first question we answer, and it is not always obvious.

You are caught if you carry on, purport to carry on, or hold yourself out as carrying on virtual asset services in or from Kenya. The eleven licensed activities cover exchanges, trading and clearing platforms, brokers, investment advisors, asset managers, initial coin offerings, tokenisation, token issuance platforms, custodial wallets, payment processors and stablecoin issuance. The reach is territorial: a foreign-incorporated platform that targets or onboards Kenyan customers is in scope.

You are outside the Act if your product falls into a carve-out. Non-custodial wallet services are excluded from licensing, as are genuine closed-loop loyalty and utility points, central bank digital currency and fiat, and non-fungible tokens not actually used for payment or investment. The catch is the substance-over-form test: calling an instrument an “NFT” or a “utility token” will not save it if it functions like a security, a payment instrument or a stablecoin. This is exactly where a written opinion earns its fee.

We sit on the line between these two outcomes for clients every week. Book a consultation and we will tell you, on your facts, which side you are on.

How much does it cost to get a VASP licence in Kenya?

There are two separate costs, and people conflate them.

The first is the official regulator-side fee, which sits in the Regulations and is not yet gazetted. The draft published for comment in March 2026 proposes licensing fees from KES 100,000 to KES 2,000,000, and minimum core capital scaled by activity, from around KES 2.5 million for an investment adviser up to KES 500 million for a stablecoin issuer, with separate paid-up capital for each licensed activity. All of these figures are DRAFT, not yet law, and may change. Do not budget against a fixed shilling figure until the Legal Notice is published.

The second is our professional fee. That depends on how much of the journey we run and how complex your business is. A founder doing one custodial wallet licence with a clean file and an existing Kenyan company runs a very different fee profile from a foreign exchange group that needs a Kenyan subsidiary, two parallel applications, an ownership restructure, and AML, data-protection and audit functions stood up from scratch.

We do not quote a fee blind. We scope the work, agree the deliverables and milestones, and give you a fixed or capped fee. Book a consultation and we will price your file properly.

What does the engagement look like?

It runs in phases so you never pay for work you do not yet need. We scope the product against the activity heads and quote a fee, then structure the entity and issue any classification opinion, then build the POCAMLA systems, MLRO function, Financial Reporting Centre registration and ODPC registration, then assemble and lodge the licence file the moment the Regulations are gazetted. You can engage us for the whole arc or a single phase. Many founders start with the AML and structuring work because that is what binds today, then move to the application once the channel opens.

Three client types come to us most often: Kenyan founders building a product from the ground up; foreign groups planning a Kenyan entry, who usually need a subsidiary and an ownership structure that passes the approval regime; and existing crypto businesses facing the 4 November 2026 deadline, who need the AML build, a ready-to-lodge file and a view on whether to file or wind down. If you are a custodian or stablecoin issuer, the structuring is heavier because of the client-asset segregation and reserve rules. If you are an exchange, the AML and market-conduct build is the centre of gravity.

Frequently asked questions

Can I get a VASP licence in Kenya today? No. The Central Bank of Kenya and the Capital Markets Authority confirmed jointly in November 2025 that no VASP has been licensed and that licensing will only begin once the Cabinet Secretary’s Regulations are gazetted. As of 30 June 2026 those Regulations are still in draft. Anyone marketing themselves as an already-licensed Kenyan VASP is misrepresenting.

Do I need a Kenyan company, or can my offshore parent apply? The Act requires a company limited by shares that is either Kenyan or a foreign company registered under the Companies Act. A foreign company can apply, but only once it has registered in Kenya. Sole proprietors and partnerships cannot hold a licence at all. For the structuring choice, see crypto business: offshore versus Kenya.

What happens if I operate without a licence? The penalties are the largest in the Act. A company faces a fine of up to KES 25,000,000. An individual faces up to KES 10,000,000 or up to five years imprisonment, or both. A director, partner or senior officer who knowingly authorised, permitted or aided the contravention is personally liable for the same penalty. Marketing or holding out before you are licensed carries the same band as operating. See unlicensed VASP penalties in Kenya.

How are virtual assets taxed in Kenya right now? The old 3% Digital Asset Tax was repealed. Since 1 July 2025 the live tax is a 10% excise duty on the fees a VASP charges, not on transaction value. There is no bespoke statutory crypto capital-gains regime, so gains depend on the facts of each transaction. We structure your flows around the current rules. See crypto tax in Kenya.

Do I have to register with anyone other than the licensing regulator? Yes. A Kenyan VASP runs three parallel registrations: the licence with the CBK or CMA, the reporting-institution registration with the Financial Reporting Centre under POCAMLA, and the data-controller registration with the Office of the Data Protection Commissioner. We handle all three.

Can you tell me whether my product is even caught by the Act? Yes, and sometimes that is the most valuable thing we do. The Act carves out several categories, including non-custodial wallets, and the test is substance over form. We issue a reasoned opinion on whether your product needs a licence at all.

Book a consultation

The time to scope your file is now, while the Regulations are being finalised, not after they are gazetted and your competitors are already in the queue. Whether you need a full licensing strategy, an AML and POCAMLA build, an ODPC registration, a structuring decision, or a clear opinion on whether you are caught at all, we will scope the work and quote a fixed or capped fee. Book a consultation and we will scope your file.

Related reading: VASP licensing in Kenya, is cryptocurrency legal in Kenya, crypto AML and KYC in Kenya, crypto tax in Kenya, register a crypto company in Kenya, and crypto business: offshore versus Kenya.