Penalties for operating an unlicensed crypto business in Kenya

Operating an unlicensed crypto business in Kenya is now a criminal offence with the largest penalty band in the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025). A company that carries on virtual asset services without a licence faces a fine of up to KES 25,000,000. An individual faces a fine of up to KES 10,000,000, or imprisonment for up to five years, or both. The prohibition lives in section 8(2), the penalty in section 40(3), and the personal exposure for directors in section 41. The Act commenced on 4 November 2025, so the prohibition is already live, even though no firm has yet been licensed because the implementing Regulations are still in draft. Existing operators have until 4 November 2026 to comply under section 47. The trap is that the offence covers three distinct acts: actually carrying on the business, purporting to carry it on, and merely holding yourself out as carrying it on in or from Kenya. Marketing a crypto service you cannot yet lawfully run can trigger the same fine as running it.

Short answer: what you are exposed to

• Company fine: up to KES 25,000,000 for unlicensed operation (section 40(3)).
• Individual fine and prison: up to KES 10,000,000 and/or up to five years (section 40(3)).
• Three offences in one section: carry on, purport to carry on, or hold out (section 8(2)), with the offence and penalty operating through section 8(3). All carry the same penalty.
• Director liability: any director, partner or senior officer who knowingly authorised, permitted or aided the contravention is personally liable for the same penalty (section 41).
• Mixer ban: running a mixer, tumbler or anonymity-enhancing service is a separate offence under the same section 40(3) penalty.
• The cliff: existing operators must comply by 4 November 2026 (section 47). The licensing channel is not yet open, which makes the deadline harder, not softer.

For the full framework around how licensing works, who the two regulators are and what each licence category covers, read the pillar: VASP licensing in Kenya. This guide is the penalty deep-dive.

What is the penalty for operating without a VASP licence in Kenya?

The penalty has two faces, one for the company and one for the individual.

Section 40(3) of the VASP Act sets it out. In the case of a company, the fine is up to KES 25,000,000. In the case of an individual, the punishment is a fine of up to KES 10,000,000, or imprisonment for a term of up to five years, or both. These are maximums, not fixed penalties, so a court has room to scale the sentence to the facts. But the ceiling is high, and it is criminal exposure, not a regulatory fee.

The same penalty band applies whether the unlicensed activity is a full exchange, a custody business, a stablecoin issuance, a token offering or a payment gateway. The Act does not grade the penalty by activity type. Running any of the eleven First Schedule activities without the right licence engages section 8(2) and the section 40(3) penalty.

One nuance matters for planning. The company fine and the individual fine are separate heads, so a single unlicensed operation can produce exposure at both levels at once: up to KES 25,000,000 against the company, and up to KES 10,000,000 plus a custodial sentence against a director or officer. They are not alternatives. They stack.

What exactly does section 8(2) prohibit?

Section 8(2) is the prohibition. It says no person may carry on, or purport to carry on, the business of virtual asset services, or hold itself out as carrying on that business in or from Kenya, unless licensed to do so by the relevant regulatory authority under the Act.

Read carefully, that is three distinct offences, not one.

• Carrying on the business. Actually operating: running the exchange, holding client keys, issuing the stablecoin, processing the payments.
• Purporting to carry on the business. Presenting yourself as already in operation when you are not properly licensed. This catches the firm that flips a “live” switch before its file is approved.
• Holding out. Marketing, advertising or otherwise representing that you carry on virtual asset services in or from Kenya. This is the one founders underestimate. A landing page, a pitch deck circulated to Kenyan users, or a “coming soon, regulated in Kenya” banner can be holding out.

All three carry the same penalty under section 40(3). The offence is not limited to the moment money moves; it reaches the marketing layer. Anyone today describing themselves as a “CBK-licensed VASP” or “CMA-licensed VASP” is, on the regulators’ own joint notice, misrepresenting, because no VASP has been licensed yet.

The territorial reach is deliberately wide. Section 8(2) bites activity “in or from Kenya”, so a foreign-incorporated platform that targets or onboards Kenyan customers is in scope, even if its servers and team sit elsewhere. Offshore incorporation does not remove the Kenyan exposure if the business is aimed at Kenyan users. We unpack that in crypto business offshore vs Kenya.

When is a director personally liable under section 41?

Section 41 is the provision that turns a corporate offence into a personal one for the people running the business.

It provides that where an offence or contravention against the Act is committed by a licensee, a director, partner or any senior officer of the licensee who knowingly authorised, permitted or aided in the commission of the offence also commits the contravention or offence, and is liable for any criminal, civil or administrative penalty to which the licensee is liable under the Act.

Three features control how this applies.

First, the class of person is specific: a director, a partner, or any senior officer. It is not every employee. It reaches the people with authority over the conduct.

Second, the mental element is high. The individual must have knowingly authorised, permitted, or aided the contravention. Knowledge plus one of those three acts is required. On the face of the section, pure negligence or an honest “I did not know” is not enough to convict the individual. This is a deliberately narrower hook than the classic Kenyan “consent, connivance or neglect” formula in the Companies Act, which can catch mere neglect. Under section 41, neglect alone is not the trigger.

Third, once the section is engaged, the individual is exposed to the same penalty as the licensee: criminal, civil, or administrative. So a director who knowingly permitted unlicensed operation is personally exposed to the section 40(3) penalty of up to KES 10,000,000 and up to five years.

The “knowingly” threshold is both a shield and a warning. It protects a director who genuinely did not know and could not reasonably have known. It does not protect a director who signed off on a go-live decision, approved the marketing, or waved through onboarding while aware the licence was not in place. Documented internal challenge, minuted objections, and a clear paper trail showing a director did not authorise or permit the conduct are what stand between a board member and personal liability.

Is running a crypto mixer illegal in Kenya?

Yes, and it carries the same penalty as unlicensed operation.

Section 21 requires every VASP to conduct its business with integrity at all times and, specifically, prohibits undertaking mixer or tumbler services or anonymity-enhancing services. Breaching that prohibition is a criminal offence under section 40(3), which means the same KES 25,000,000 company fine and KES 10,000,000 or five-year individual exposure applies.

This bites two architectures directly. CoinJoin-style transaction-mixing and privacy-coin handling that strips traceability are both squarely within the prohibition. A Kenyan VASP cannot offer them, and a business whose model depends on them cannot be licensed.

The mixer ban sits alongside the wider anti-money-laundering duties that already apply to every VASP. Even before any licence is granted, every Kenyan crypto business that meets the VASP definition is a “reporting institution” under the Proceeds of Crime and Anti-Money Laundering Act from 4 November 2025, with full customer due diligence, monitoring and reporting obligations. We cover those in crypto AML and KYC in Kenya. Anonymity-enhancing services are the opposite of what the AML regime demands, which is why they are banned outright rather than merely regulated.

What is the 4 November 2026 cliff and why does it matter?

Section 47 is the transitional provision. It says that upon commencement of the Act, any person providing virtual asset services must, within one year of commencement, comply with the provisions of the Act. Commencement was 4 November 2025. The window therefore closes on 4 November 2026.

That date is a hard cliff, and the timing makes it sharper than it looks.

The Act is fully in force. Every Part commenced on 4 November 2025, including the section 8(2) prohibition. But the licensing channel itself is not open. The implementing Virtual Asset Service Providers Regulations, 2026 were published in draft for public comment on 17 March 2026, and as of 30 June 2026 they have not been gazetted. The Central Bank of Kenya and the Capital Markets Authority confirmed jointly on 18 November 2025 that no VASP has been licensed and that licensing will begin only once the Regulations are issued. In plain terms, you cannot get a VASP licence in Kenya today, because there is nothing to apply on. The detail sits in the VASP compliance deadline in Kenya.

This creates a genuine bind for existing operators. The clock under section 47 is running, but the channel to comply is shut, and the window closes on 4 November 2026.

If the Regulations are not gazetted and the application process is not stood up before 4 November 2026, an incumbent provider faces a structural choice:

• Prepare to file the moment the channel opens, and document a clear, dated good-faith effort to comply: corporate restructuring done, AML build-out in place, capital lined up, application file drafted and ready to lodge.
• Wind down the Kenyan-facing service before 4 November 2026, removing the activity, the holding-out and the onboarding so that the section 8(2) prohibition is not being contravened past the deadline.

The section 40(3) penalty is the cost of getting that call wrong. KES 25,000,000 for the company, plus KES 10,000,000 and five years of personal exposure for any director who knowingly let the unlicensed operation run past the cliff, is a heavy price for a wait-and-see posture.

How does the unlicensed penalty compare with other VASP offences?

The section 40(3) band is the heaviest in the Act, and several different offences feed into it.

The structural point is that unlicensed operation and the mixer ban share the same penalty ceiling, and section 41 then projects that exposure onto named individuals. A founder who reads only the corporate fine and assumes the company carries the risk is missing half the exposure.

This is why the licensing pathway matters so much. The way to stay out of section 40(3) entirely is to be inside the regime: the right company form, the right licence category, the application file ready for the moment the channel opens. The categories themselves are mapped in VASP licence categories in Kenya, and the entity and incorporation requirements in registering a crypto company in Kenya.

Frequently asked questions

What is the fine for running a crypto exchange without a licence in Kenya? Up to KES 25,000,000 for the company under section 40(3). The directors or officers responsible can also face up to KES 10,000,000 and up to five years in prison each, under section 40(3) read with section 41. The same band applies to custody, stablecoin issuance, token offerings and payment processing, not just exchanges.

Can I be jailed for operating an unlicensed crypto business in Kenya? Yes. Section 40(3) allows imprisonment of up to five years for an individual, or a fine of up to KES 10,000,000, or both. The custodial element applies to individuals, not to the company.

Is marketing a crypto service before getting a licence an offence? On the face of section 8(2), yes. The prohibition covers holding out as carrying on virtual asset services in or from Kenya, not just actually operating. Advertising, a “regulated in Kenya” claim, or onboarding pages can amount to holding out and carry the same penalty as running the service.

Are the directors personally liable if the company operates without a licence? Only if they knowingly authorised, permitted or aided the contravention, under section 41. Pure negligence or genuine ignorance is, on the face of the section, not enough. But a director who knew the licence was not in place and signed off on going live is exposed to the same penalty as the company.

Does operating offshore avoid the Kenyan penalty? Not automatically. Section 8(2) bites activity “in or from Kenya”, which reaches foreign platforms that target or onboard Kenyan users. Incorporating in another jurisdiction does not, by itself, remove the Kenyan exposure if the business is aimed at the Kenyan market. See crypto business offshore vs Kenya.

The licence channel is not open yet. Am I committing an offence by operating now? The section 8(2) prohibition is in force, and section 47 gives existing operators until 4 November 2026 to comply. The honest position is that the transitional window is running while the application channel is shut. The defensible path is to document a dated good-faith effort to comply and be ready to file the moment the Regulations are gazetted, or to wind down before the cliff. This is a fact-specific call that should be taken with advice.

Is a crypto mixer specifically banned? Yes. Section 21 prohibits mixer, tumbler and anonymity-enhancing services outright, and section 40(3) sets the penalty. This catches CoinJoin-style mixing and privacy-coin handling.

Are the draft capital and fee figures part of the penalty regime? No. The proposed minimum capital figures (from KES 2.5 million for an investment adviser up to KES 500 million for a stablecoin issuer) and the proposed licensing fees (KES 100,000 to KES 2,000,000) come from the draft Virtual Asset Service Providers Regulations, 2026. They are DRAFT, not yet gazetted as of 30 June 2026, and may change. They are eligibility requirements, not penalties.

If you run a crypto exchange, a custody business, a stablecoin issuer, a payment gateway or a token platform aimed at Kenyan users, the penalty exposure under section 40(3) is real and the 4 November 2026 cliff is close. The right move now is to scope your compliance file, document your good-faith effort, and decide deliberately whether to prepare to file or to wind down, rather than drift past the deadline by default. We work with founders, treasury teams and foreign groups planning their Kenyan position, and we cover the full stack: corporate structuring, licensing strategy across CBK and CMA, the AML build-out, and the director-liability protections that keep section 41 from reaching your board. Book a consultation and we will scope your exposure properly.

Related reading: VASP licensing in Kenya, the VASP compliance deadline in Kenya, crypto AML and KYC in Kenya, VASP licence categories in Kenya, and crypto business offshore vs Kenya.