If you run an initial coin offering, tokenise a real-world asset, or operate a platform that issues and trades tokens for Kenyan users, you fall under the Capital Markets Authority arm of the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025). The Act names three distinct CMA-supervised activities for this space: Virtual Asset Offering Provider (ICOs), Virtual Asset Tokenization, and Token Issuance Platform. Each is a separate licensed activity under the First Schedule, and section 8(2) bars you from carrying on, purporting to carry on, or holding out as carrying on any of them in or from Kenya without a licence. The catch is that no one can be licensed yet: the implementing Regulations are still in draft and the CBK and CMA have jointly confirmed no VASP has been licensed. The harder boundary to get right is what your token actually is. If it is a security, it never enters the VASP regime and stays in the existing capital markets securities regime. This guide covers the three offering activities, the securities boundary, the NFT substance-over-form test, and what to do now while the channel is still closed.

Short answer

For the full framework across both regulators, application mechanics, AML, tax and the regulations timeline, read the pillar: VASP licensing in Kenya. This guide goes deep on the offering and tokenisation side only.

Which VASP licence does a token issuer need?

The Act licenses activities, not firms. The First Schedule lists eleven virtual asset activities and assigns each to either the CBK or the CMA. Three cover token issuance and offerings, and all three are CMA activities:

Two related CMA activities often sit alongside these: Virtual Assets Investment Advisor, which expressly covers advice on virtual assets, initial virtual asset offerings and NFTs, and Virtual Asset Exchange (and trading, clearing and settlement platforms) if your token then trades on a venue you operate.

Because the Act licenses per activity, a business that issues its own token, tokenises client assets and runs the secondary-trading venue may need more than one licence. Map your real activities to the First Schedule heads before assuming one licence covers everything. The dual-regulator split is covered in full on the pillar.

What is the securities boundary, and why does it matter most?

This is the threshold question, and it sits above the VASP regime, not inside it.

A “virtual asset” is defined in section 2 as “a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes and does not include digital representation of fiat currencies, securities and other financial assets.” The phrase that decides everything for a token issuer is the exclusion: securities and other financial assets are carved out of the virtual asset definition entirely.

The consequence is sharp. If the instrument you are issuing is a “security” as that term is used in the Capital Markets Act, it is not a virtual asset under the VASP Act and does not enter the VASP licensing regime. It stays inside the existing securities regime, with the prospectus, approval, disclosure and offer rules that already apply to securities offerings in Kenya. Wrapping a security in a token, or calling a public capital raise an “ICO”, does not move it into a lighter VASP track. If anything, it can expose you to both regimes at once: the securities offer rules for the underlying instrument, and potentially the VASP rules for any platform or transfer activity layered on top.

The marketing temptation runs the other way. Founders reach for “utility token” and “ICO” language precisely to avoid the heavier securities machinery. The Act does not reward that framing, and the CMA supervises both the securities regime and the VASP offering activities, so the same regulator decides which box your instrument falls into. Whether a given token is a security turns on the rights it carries, the expectations it creates and how it is marketed, and should be assessed against the Capital Markets Act and the relevant CMA rules for each specific token. Get a reasoned characterisation before you draft a whitepaper or take a single subscription. Talk to a fintech lawyer before you commit to a structure.

The other half of the section 2 definition is the inclusion test, and it is functional, not based on labels: a token is a virtual asset if it “can be used for payment or investment purposes”. That catches more than headline cryptocurrencies. Tokenised real-world assets are squarely in scope, which is why the Act gives tokenisation and token issuance platforms their own named heads, and most fundraising tokens that are not securities still sit inside the definition because they are used for investment or traded for value.

So a token issuer faces a two-step analysis:

  1. Is it a security? If yes, it leaves the VASP regime and sits in the securities regime. Stop here for VASP purposes and handle it as a securities offer.
  2. If not a security, can it be used for payment or investment? If yes, it is a virtual asset, and issuing or platforming it is a licensed VASP activity (offering provider, tokenisation, or token issuance platform).

The only way out of both is to fall inside one of the section 4 carve-outs, which are narrow and tested on substance.

Which tokens are carved out of the VASP regime entirely?

Section 4 lists categories that fall outside the Act. Four matter to token issuers:

The line founders most often get wrong is the NFT one. Section 4(2)(d) adds a substance-over-form rule: an NFT is assessed “by [its] nature and function rather than the designation given by [its] issuer”. Calling an instrument an “NFT” will not take it out of the regime if it works like a payment instrument, an investment or a stablecoin. If your NFT promises a yield, trades on a secondary market with an expectation of profit, or operates as a means of payment, it is not carved out. The regulator looks at function, not the label on the smart contract.

The same logic runs through the whole offering side. A “utility token” the market buys to flip for profit is being used for investment. A “service token” that can be cashed out or traded is not a pure virtual service token. Design the token’s actual function to match the regulatory box you want it in, and do not rely on naming.

Do you need a licence to run an ICO or tokenisation platform in Kenya?

Yes, once the channel opens. Section 8(2) provides that “a person shall not carry on, or purport to carry on, the business of virtual asset services, or hold itself out as carrying on that business in or from Kenya, unless that person is licensed to do so by the relevant regulatory authority under this Act.” Conducting an ICO, tokenising real-world assets, or operating a token issuance platform are each named virtual asset services, so each needs a CMA licence.

Three points sharpen this for token issuers:

For the full eligibility bar (physical office in Kenya, at least three natural-person directors, CEO pre-approval, fit-and-proper and capital), read the pillar.

Can you actually get an offering or tokenisation licence today?

No. As of 30 June 2026, you cannot get any VASP licence in Kenya, including the offering, tokenisation and token issuance platform licences. The implementing Regulations that carry the application forms, fees and capital thresholds are still in draft.

So the offering provider, tokenisation and token issuance platform licences exist on paper as named activities, but there is nothing to apply on yet. Anyone marketing themselves today as a “CMA-licensed token issuance platform” is, on the regulators’ own joint notice, misrepresenting.

There is also a clock. Section 47 gives existing operators one year from commencement to comply, so the transitional window closes on 4 November 2026. If you already run an ICO or tokenisation service touching Kenyan users, that window is running even though the licensing channel is not yet open. The full timeline and the compliance-cliff analysis are on the pillar and in the VASP compliance deadline guide.

What will it cost to license a token offering business?

The official fees and capital thresholds for offering and tokenisation activities sit in the Regulations, which are still draft. The draft figures below are proposed, not yet gazetted, and may change before they become law.

[DRAFT, not yet law: these figures are from the draft Regulations 2026 circulated for comment to 10 April 2026. No Legal Notice gazetting them has been published as of 30 June 2026. Do not rely on a specific shilling figure in a binding context until the Legal Notice is published.] For the full draft figure table, see crypto capital requirements in Kenya.

Our own fee depends on scope: a single ICO licence with a clean file and an existing Kenyan company is very different from a tokenisation platform that issues, hosts third-party issuances and runs a secondary-trading venue, each its own licensed activity. We scope the work, agree deliverables and milestones, and quote a fixed or capped fee. We will not quote blind.

How are tokens and token-sale earnings taxed in Kenya?

The tax position changed in 2025 and much online commentary is out of date. The old 3% Digital Asset Tax (section 12F of the Income Tax Act, inserted by the Finance Act 2023) was repealed by the Finance Act 2025. Anyone still quoting a 3% gross-value tax is citing repealed law.

Since 1 July 2025, the live tax is a 10% excise duty on the fees a virtual asset provider charges, inserted into the Excise Duty Act (Cap. 472) by the Finance Act 2025. It is charged on the platform fee, not on the value of the tokens issued or transferred, so for a token issuance platform the excise bites on its issuance or trading fees. There is no bespoke statutory crypto capital-gains regime, so any gains on token disposals turn on the facts (trading versus investment). The full breakdown, including the proposed CARF reporting for VASPs, is in crypto tax in Kenya.

Frequently asked questions

Is an ICO legal in Kenya? Conducting an ICO is a named, licensable activity (Virtual Asset Offering Provider) under the First Schedule of the VASP Act, supervised by the CMA. It is not banned, but section 8(2) means you may not carry it on, purport to carry it on, or market it in or from Kenya without a licence. Because the Regulations are still draft, the licensing channel is not yet open, so no compliant licensed ICO can launch through the VASP regime right now.

Is my token a security or a virtual asset? That is the first question to settle. Section 2 excludes “securities and other financial assets” from the virtual asset definition. If your instrument is a security under the Capital Markets Act, it sits in the securities regime, not the VASP regime, regardless of being tokenised or labelled an ICO. If it is not a security but can be used for payment or investment, it is a virtual asset and issuing it is a licensed VASP activity. The characterisation turns on the rights the token carries and how it is marketed, and should be assessed for each specific token.

Does tokenising property or a fund need a separate licence from issuing a token? Potentially yes. Virtual Asset Tokenization (converting real-world assets into tokens) and Token Issuance Platform (running the issuance and secondary-trading rails) are separate First Schedule heads from Virtual Asset Offering Provider (ICOs). The Act licenses per activity, so a business doing several of these may need more than one licence.

Are NFTs caught by the VASP Act? Only if they function as payment or investment. Section 4(2)(c) carves out NFTs not used for payment, investment or any other financial purpose, and section 4(2)(d) applies a substance-over-form test: an NFT is judged by its nature and function, not the label its issuer gives it. An NFT that promises yield, trades for profit on a secondary market or works as a payment instrument is not carved out.

Can a foreign issuer run a token sale to Kenyan users without a Kenyan licence? Not lawfully once the channel opens. Section 8(2) reaches anyone holding out as carrying on the business “in or from Kenya”, and the Act’s object in section 3 speaks to activity “in and from Kenya”. A foreign issuer that onboards or markets to Kenyan investors is in scope. The eligibility rules require a company registered under the Companies Act (Cap. 486), so a foreign issuer would need a registered Kenyan presence. Whether to build in Kenya or stay offshore is its own analysis: see crypto business offshore versus Kenya.

What happens if I run an ICO or tokenisation platform without a licence? Section 40(3) sets the penalty for unlicensed operation: a company faces a fine of up to KES 25,000,000, and an individual a fine of up to KES 10,000,000 or imprisonment of up to five years, or both. Section 41 extends personal liability to any director, partner or senior officer who knowingly authorised, permitted or aided the contravention. The detail is in unlicensed VASP penalties in Kenya.

Can a “utility token” avoid the regime? Only if it is genuinely a pure virtual service token under section 4(3) that does nothing but unlock the issuer’s own service and carries no payment or investment function. If the market buys it to trade or flip, or it can be cashed out, it is being used for investment and the carve-out does not apply. Substance governs, not the name.

What can I do now while the Regulations are still draft? Get the token characterised (security versus virtual asset versus carve-out), set up the right corporate vehicle, build the AML and data-protection functions that already bind every VASP, and prepare the application file so you can lodge the moment the channel opens. If you operate today, document your good-faith compliance effort against the 4 November 2026 window.

If you are planning an ICO, tokenising real-world assets, or building a token issuance platform for Kenyan users, the work to do now is the characterisation, the corporate structure and the application file, so you are ready the moment the Regulations are gazetted and the queue forms. We cover the full stack: the securities-versus-virtual-asset characterisation, the CMA licensing strategy across the offering and tokenisation heads, the AML and POCAMLA build-out, ODPC registration, and the tax position under the new excise regime. Book a consultation and we will scope your file.

Related reading: VASP licensing in Kenya, Is cryptocurrency legal in Kenya, Fintech lawyer Kenya, Register a crypto company in Kenya, Crypto tax in Kenya, and Crypto capital requirements in Kenya.