To register a crypto company in Kenya you incorporate a company limited by shares under the Companies Act (Cap. 486), because that is the only vehicle the Virtual Asset Service Providers Act, 2025 lets hold a VASP licence. Sole proprietors, partnerships and trusts are shut out by section 8(1). The company needs at least three directors who are all natural persons, a physical office in Kenya, a Kenyan bank account, and directors and beneficial owners who can pass the regulator’s fit-and-proper test. On top of the company you run three parallel registrations: the VASP licence with the Central Bank of Kenya or the Capital Markets Authority (or both), reporting-institution registration with the Financial Reporting Centre under POCAMLA, and data-controller registration with the Office of the Data Protection Commissioner.

The catch is timing. You can incorporate and build every compliance function today, but you cannot yet obtain the VASP licence itself: the implementing Regulations are still draft and CBK and CMA have confirmed no VASP has been licensed. So registration today means everything except the licence, getting the company application-ready for the moment the channel opens.

Short answer

This guide covers the corporate formation and readiness steps. For the full regulatory framework, the activity list, the dual-regulator model and the penalties, see the pillar on VASP licensing in Kenya.

What kind of company do you need to register?

A company limited by shares, and nothing else. Section 8(1) of the VASP Act restricts eligibility to “a company limited by shares registered under the Companies Act or a foreign company limited by shares and registered under the Companies Act (Cap. 486)”. That line decides your structure before you draft anything:

The Act is this strict because the rest of the regime, the capital rules, the fit-and-proper test on beneficial owners, the share-transfer approval regime and the client-asset segregation rules, all assume a share-capital company with identifiable owners. Most Kenyan founders incorporate a fresh private company through the Business Registration Service eCitizen portal; foreign groups can incorporate a Kenyan subsidiary or register the parent, with the subsidiary route usually cleaner for the banking, tax and fit-and-proper workstreams that follow.

How many directors do you need, and who can they be?

At least three, and every one of them must be a natural person. Section 20(1) of the VASP Act requires a minimum of three directors, all natural persons, and caps any single director at sitting on no more than two VASP boards at once.

A private company can normally run on a single director under the Companies Act, but a crypto company in Kenya cannot be a one-director shell, and corporate directors do not count. The two-board cap matters for anyone planning a group of related VASP entities: you cannot park the same individual as a director across several sister companies, so plan board composition across the group before you incorporate. Each director must then clear the fit-and-proper bar.

What is the fit-and-proper test, and who does it apply to?

Fit and proper is the regulator’s judgment that the people running and owning the company are honest, competent and financially sound. Under section 18 of the VASP Act it applies to directors, senior officers and any other person the regulator names. Section 11 extends the same test to beneficial owners at the licensing stage, and section 32 extends it to significant shareholders for AML supervision.

The factors the regulator weighs include probity, competence, experience and soundness of judgment; educational and professional qualifications; knowledge of legal obligations; any evidence of dishonesty, fraud offences or prior contravention of virtual asset law; and financial standing and integrity.

The CEO sits in a separate category. Under section 30 of the VASP Act the CEO must be approved by the regulator before appointment; the approval is a precondition, not a notification. Assemble the people file early: IDs, qualifications, CVs, declarations of any past disciplinary or criminal history, and source-of-funds evidence for beneficial owners. A weak people file is one of the most common reasons a serious application stalls.

Do you need a physical office and a Kenyan bank account?

Yes to both. They are continuing conditions, not optional extras.

Section 19 of the VASP Act requires every VASP to maintain a physical office in Kenya where its business activities are carried out. A virtual presence or a registered-agent address used only for service of documents does not meet that standard, and an offshore operating model with a nameplate in Nairobi will not satisfy section 19.

Section 24(h) of the VASP Act makes opening and operating a Kenyan bank account a continuing obligation of the licence. Kenyan banks run their own enhanced due diligence on crypto-facing businesses, so account opening can be the slowest single step in the journey. Start it early, and expect the bank to ask for the same source-of-funds and beneficial-owner evidence the regulator will. Together these requirements are why a credible Kenyan crypto company cannot be assembled entirely from abroad.

What are the three parallel registrations?

Most founders underestimate this. A licensed VASP in Kenya is not one registration but three, under three statutes, with three regulators.

1. The VASP licence (CBK or CMA, or both). The licence is issued by whichever regulator matches your activity. The Central Bank of Kenya licenses custodial wallets, payment processors and stablecoin issuers; the Capital Markets Authority licenses exchanges, trading and settlement platforms, brokers, investment advisers, asset managers, ICO offering providers, tokenisation and token issuance platforms. A business that does more than one activity, say a custodian that also runs an exchange, needs more than one licence. The full activity-to-regulator map is in the pillar on VASP licensing in Kenya.

2. Financial Reporting Centre registration under POCAMLA. The VASP Act amended the Proceeds of Crime and Anti-Money Laundering Act (Cap. 59A) so that every VASP became a “reporting institution” from 4 November 2025. Registration with the Financial Reporting Centre is mandatory under POCAMLA, and failing to register is itself a criminal offence. This duty is live now, regardless of whether the licence is available. The AML programme on top, due diligence, suspicious transaction reports and the money laundering reporting officer, is covered in Crypto AML and KYC in Kenya.

3. ODPC registration under the Data Protection Act. A crypto company holds national IDs, passports, addresses, transaction histories, wallet addresses and IP logs, almost all of it personal data, which makes it a data controller under the Data Protection Act (Cap. 411C). Section 18(1) prohibits acting as a controller or processor without registering with the Office of the Data Protection Commissioner, so registration is a precondition for processing any customer data, on top of the licence and the FRC registration. See Crypto data protection in Kenya for the overlay.

The order matters: the company and the FRC and ODPC registrations can be done now, but the VASP licence cannot, because the channel is not open yet.

Why can you not get the VASP licence yet?

Because the law that defines the licence is in force, but the Regulations that operate it are not. The VASP Act commenced on 4 November 2025, but the application form, fees, capital thresholds and prudential rules all sit in subsidiary Regulations the Cabinet Secretary for the National Treasury has not yet gazetted. The draft Regulations went out for comment on 17 March 2026, consultation closed on 10 April 2026, and as of 30 June 2026 no Legal Notice gazetting them has appeared. CBK and CMA confirmed jointly on 18 November 2025 that no VASP has been licensed and that licensing will only begin once the Regulations are issued. Anyone marketing themselves as a “CBK-licensed” or “CMA-licensed” VASP right now is, on the regulators’ own joint notice, misrepresenting.

The right read is not “wait and do nothing”, but “do everything that does not depend on the licence channel, so you can file the day it opens”. Existing operators must comply by 4 November 2026. See the VASP compliance deadline in Kenya for what that cliff means.

Step by step: registering a crypto company in Kenya

  1. Confirm your activities. Identify which licensed activities you perform. That decides which regulator you answer to, how many licences you need and how much capital. Substance over form: calling something an “NFT” does not exempt it if it functions as a payment or investment instrument.
  2. Incorporate the company. Register a private company limited by shares under the Companies Act (Cap. 486), or register the foreign parent as a foreign company, drafting the constitution and shareholding with the VASP capital and share-transfer rules in mind.
  3. Build the board. Appoint at least three directors, all natural persons, none sitting on more than two VASP boards, and assemble each director’s fit-and-proper file.
  4. Secure the office and the bank account. Take a real physical office in Kenya and open a Kenyan bank account; expect the bank’s due diligence to be the long pole.
  5. Vet the CEO and beneficial owners. The CEO needs prior regulator approval, and beneficial owners face the fit-and-proper test. Prepare source-of-funds evidence early.
  6. Register with the Financial Reporting Centre. Complete POCAMLA reporting-institution registration and stand up the AML programme: due diligence, monitoring, a money laundering reporting officer and internal controls.
  7. Register with the ODPC. Register as a data controller under the Data Protection Act before processing any personal data.
  8. Assemble the licence application file. Build the eligibility evidence, the capital plan, the cybersecurity and client-asset-segregation architecture and the public-interest case, ready to lodge the moment the Regulations are gazetted.
  9. File when the channel opens. Lodge with the matching regulator once the Regulations are in force and the forms and fees are published.

Steps 1 through 7 can be done today. Steps 8 and 9 are gated on the Regulations.

Frequently asked questions

Can I register a crypto company in Kenya right now? You can incorporate the company and complete the FRC and ODPC registrations today. You cannot yet obtain the VASP licence itself, because the implementing Regulations are still draft and not gazetted as of 30 June 2026.

Can my foreign company apply, or do I need a Kenyan company? A foreign company can apply, but only if it has registered as a foreign company limited by shares under the Companies Act (Cap. 486). An unregistered offshore parent cannot apply. Many foreign groups incorporate a Kenyan subsidiary instead, which makes the banking, tax and fit-and-proper work cleaner.

Do I really need a physical office in Kenya? Yes. Section 19 requires a physical office in Kenya where the business activities are actually carried out. A registered-agent address or a virtual office does not satisfy this.

How much capital will I need? The draft Regulations 2026 propose minimum core capital scaled by activity, from about KES 2.5 million for an investment adviser up to KES 500 million for a stablecoin issuer, with separate capital for each licensed activity. These figures are DRAFT, not yet gazetted as of 30 June 2026, and may change, so do not rely on a specific number in a binding context yet. See crypto capital requirements in Kenya for the breakdown.

Is it worth incorporating now if the licence is not available? For most serious founders, yes. Everything except the licence can be built now, and the compliance window closes on 4 November 2026. Being application-ready when the channel opens is a real advantage over competitors who waited.

Registering a crypto company in Kenya is corporate structuring, an AML build, a data-protection build and a licensing strategy run in parallel, against a deadline that does not wait for the Regulations. We help founders and foreign groups incorporate the right vehicle, compose a compliant board, complete the FRC and ODPC registrations, and assemble a licence-ready file. Book a consultation and we will scope your file.

Related reading: VASP licensing in Kenya, Crypto AML and KYC in Kenya, Crypto data protection in Kenya, crypto capital requirements in Kenya, and the VASP compliance deadline in Kenya.