The 4 November 2026 VASP compliance deadline in Kenya

The VASP compliance deadline in Kenya is 4 November 2026. Section 47 of the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025) gives every existing crypto operator one year from the Act’s commencement on 4 November 2025 to comply with the Act. That clock is running now. The hard part, and the trap most founders fall into, is that the licensing channel itself is not yet open. The Central Bank of Kenya and the Capital Markets Authority confirmed jointly on 18 November 2025 that no VASP has been licensed and that licensing only starts once the subsidiary Regulations are gazetted. As of 30 June 2026 those Regulations are still in draft. So you cannot apply for a licence today, yet the transitional window keeps counting down. That leaves every incumbent provider with a structural choice: prepare to file the moment the channel opens and document a good-faith effort, or wind the Kenyan-facing service down before 4 November 2026. The anti-money-laundering duties, separately, already bite in full from 4 November 2025, regardless of any licence.

Short answer

The deadline is 4 November 2026. Section 47 gives existing operators one year from commencement (4 November 2025) to comply.
The clock runs even though you cannot apply yet. Licensing opens only when the Regulations are gazetted; they are still draft as of 30 June 2026.
The AML duties are already live. Every VASP became a POCAMLA reporting institution on 4 November 2025, with CDD, monitoring, STR, CTR, MLRO and FRC-registration obligations.
The choice is binary. Prepare to file and document good faith, or wind down the Kenyan service before the window closes.
The penalty for getting it wrong: up to KES 25 million for a company, and up to KES 10 million or five years (or both) for an individual, under section 40(3).
For the full framework, see the pillar: VASP licensing in Kenya.

What is the VASP compliance deadline in Kenya?

The deadline is 4 November 2026. Section 47 of the VASP Act reads: “Upon the commencement of this Act, any person providing virtual asset services shall, within one year of the commencement, comply with the provisions of this Act.” The Act commenced on 4 November 2025, on a single commencement date on the face of the gazetted text. One year from that date is 4 November 2026.

This is a transitional grace window for businesses that were already operating before the Act came into force. If you were running a crypto exchange, a custodial wallet, a payment gateway, a brokerage, a tokenisation platform or any of the eleven activities in the First Schedule before 4 November 2025, section 47 is the clause that applies to you. It does not give you a free year of unregulated trading. It gives you a year to bring the business into compliance with the Act.

The window closes on 4 November 2026, and the licensing channel is still not open.

Why does the clock run if you cannot get a licence yet?

This is the contradiction at the heart of the regime, and the single most important thing for a Kenyan crypto founder to grasp right now.

The VASP Act is fully in force. Every Part commenced on 4 November 2025, including section 8(2), which prohibits unlicensed operation, and section 47, which sets the one-year clock.

But the licensing channel is not open. Under section 10(2), the application must be in the manner and accompanied by the fee prescribed by the Cabinet Secretary for the National Treasury, and section 49(2) puts the application form, supporting documentation and fees in subsidiary Regulations he has not yet gazetted. The Treasury published the draft Virtual Asset Service Providers Regulations, 2026 for public comment on 17 March 2026, with consultation running to 10 April 2026. As of 30 June 2026, no Legal Notice gazetting them has appeared on Kenya Law. CBK and CMA stated on 18 November 2025 that licensing begins only upon issuance of the Regulations.

So you have a statute that says comply within a year, a prohibition on unlicensed operation, and no way to obtain the licence that would make you compliant. Nothing on the face of the Act stops the section 47 clock while the regulators finish the Regulations.

That is why the readiness work matters now. You cannot file yet, but you can build the file, the controls and the corporate structure so that you are first in the queue the day the channel opens, and so that your good-faith effort is documented if the window expires before licensing is live.

What is the structural choice every operator faces?

Strip the regime down and an incumbent provider has two honest options before 4 November 2026.

Option one: prepare to file. Build the entire application file now: company structure, fit-and-proper directors, capital, AML programme, data protection registration, custody architecture. Sit ready to lodge the moment the regulators publish their forms and fees. Document every step, because if the channel does not open before the deadline, a documented good-faith effort to comply is materially better than nothing when you face a regulator or a court.

Option two: wind down the Kenyan-facing service. If the firm cannot realistically meet the bar, the cleaner course is to stop offering virtual asset services to Kenyan users before the window closes, rather than operate unlicensed into the cliff. Section 8(2) catches not just operating but “purporting to carry on” and “holding itself out as carrying on” the business in or from Kenya, so marketing alone is caught. A controlled exit, with client assets returned and customers notified, is a legitimate compliance response.

What is not an option is drifting past 4 November 2026 while still serving Kenyan users with no file, no controls and no exit plan. That is the most exposed position in the regime. The penalty for getting that call wrong sits in section 40(3): up to KES 25 million for the company, and up to KES 10 million or five years’ imprisonment, or both, for an individual. Section 41 then pulls in any director, partner or senior officer who “knowingly authorised, permitted or aided” the contravention, exposing them to the same criminal, civil or administrative penalty as the licensee. For more on personal exposure and the enforcement band, see the penalties for unlicensed VASP operation.

Which AML duties already bite, regardless of the licence?

This is the part of the regime that does not wait for the Regulations. It has been live since 4 November 2025.

The Second Schedule to the VASP Act amended the Proceeds of Crime and Anti-Money Laundering Act (Cap. 59A) to insert virtual asset service providers into the definition of “reporting institution”. That single amendment dragged the entire POCAMLA reporting-institution regime onto every Kenyan VASP from commencement. You do not need a licence to owe these duties. You owe them because you meet the definition of a VASP and the law now treats you as a reporting institution.

The concrete obligations, all live now:

Customer due diligence. POCAMLA section 45 requires you to identify and verify every customer before a business relationship or transaction. Anonymous onboarding is over.
Ongoing monitoring. Section 44(1) requires monitoring of all complex, unusual, suspicious or large transactions, completed or not.
Suspicious Transaction Reports. Section 44(2) requires a report to the Financial Reporting Centre within two days of suspicion arising.
Cash Transaction Reports. Under the Fourth Schedule, report all cash transactions exceeding USD 15,000, suspicious or not.
Records and controls. Section 46 requires seven-year records; section 47 requires a Money Laundering Reporting Officer and internal controls.
FRC registration. Section 47A requires registration with the Financial Reporting Centre via goAML on Form FRC RF 1-1. Skipping it is itself a criminal offence.

The urgency runs beyond the statute. Kenya was grey-listed by the Financial Action Task Force in February 2024 and remains on the grey list as of the FATF June 2026 plenary, with crypto at the centre of the agenda. A VASP not running CDD, monitoring and reporting today is exposed today, not on 4 November 2026. For the detailed build, see crypto AML and KYC obligations in Kenya.

What is the step-by-step readiness checklist?

Use the months left to do the work that does not depend on the Regulations. Almost all of it can be done now.

Confirm you are actually in scope. Test your activity against the eleven heads in the First Schedule and the section 4 carve-outs. Non-custodial wallets, closed-loop loyalty points, CBDC and fiat, and NFTs not used for payment or investment are carved out, but the section 4(2)(d) substance-over-form test means a label will not save you. If you are unsure, start with is cryptocurrency legal in Kenya.
Fix the corporate form. Section 8(1) restricts a VASP licence to a company limited by shares, Kenyan or foreign, registered under the Companies Act (Cap. 486). Sole proprietors and partnerships cannot hold a licence. If you operate as anything else, restructure now. See how to register a crypto company in Kenya.
Build the board and approve the CEO. Section 20 requires at least three directors, all natural persons, each on no more than two VASP boards. Section 30 requires the CEO to be regulator-approved before appointment. Line up fit-and-proper people now.
Establish a physical office in Kenya. Section 19 requires a physical office where business activities are carried out. A pure offshore model does not work.
Stand up the AML programme immediately. Appoint an MLRO, write the CDD and monitoring procedures, register with the Financial Reporting Centre on goAML, and start filing STRs and CTRs. These duties are live now, not future tasks.
Register with the ODPC. A VASP holds IDs, passports, addresses, transaction histories and wallet data, almost all of it personal data. Under section 18(1) of the Data Protection Act (Cap. 411C) you cannot lawfully process personal data without registering as a data controller. See crypto and data protection in Kenya.
Design custody to the section 31 standard. If you hold client assets, segregate client virtual assets from house and from other clients, hold each token type 1:1, and keep client crypto bankruptcy-remote from your own creditors. Build the architecture around this from day one.
Model the capital. The draft Regulations propose minimum core capital scaled by activity, from KES 2.5 million for an investment adviser up to KES 500 million for a stablecoin issuer, with separate capital per activity, and fees from KES 100,000 to KES 2,000,000. [DRAFT, not yet law: these figures come from the draft Regulations circulated to 10 April 2026 and are not gazetted as of 30 June 2026. They may change.] See crypto capital requirements in Kenya.
Sort the tax position. The old 3% Digital Asset Tax was repealed by the Finance Act 2025. Since 1 July 2025 the live tax is a 10% excise duty on the fees a VASP charges, not on transaction value. See crypto tax in Kenya.
Pre-assemble the application file and decide. Draft the section 10(6) and section 11 narrative now so you can lodge first the day the channel opens. If the file is realistic, commit to filing. If it is not, plan a clean wind-down before 4 November 2026.

Frequently asked questions

When exactly is the VASP compliance deadline in Kenya? 4 November 2026. Section 47 gives existing operators one year from the Act’s commencement on 4 November 2025 to comply with the VASP Act.

Can I get a VASP licence before the deadline? Not as of 30 June 2026. The licensing channel sits behind subsidiary Regulations that are still in draft. CBK and CMA confirmed on 18 November 2025 that no VASP has been licensed and that licensing starts only once the Regulations are gazetted. You can prepare your file now, but you cannot lodge an application yet.

Does the deadline pause because licensing is not open? Nothing on the face of the Act stops the section 47 clock while the Regulations are being finalised. The one-year window keeps running. That is why incumbents are documenting good-faith readiness rather than waiting.

What happens if I miss the deadline and keep operating? You expose the company to a fine of up to KES 25 million under section 40(3), and any director, partner or senior officer who knowingly authorised, permitted or aided the contravention to a fine of up to KES 10 million or five years’ imprisonment, or both, under sections 40(3) and 41. Operating, purporting to operate, and merely marketing without a licence are all caught by section 8(2).

I run a small crypto business. Do the AML rules apply to me right now? Yes. Every VASP became a POCAMLA reporting institution on 4 November 2025. CDD, ongoing monitoring, STRs, CTRs, an MLRO, seven-year records and FRC registration on goAML all apply now, independent of whether you hold a licence. Failing to register with the FRC is itself a criminal offence.

Should I prepare to file or wind down? That turns on whether you can realistically meet the bar: company form, three natural-person directors, a Kenyan office, the proposed capital, custody segregation, and the full AML and data-protection build. If you can, prepare to file and document the effort. If you cannot, plan a clean exit before 4 November 2026.

Is the draft capital figure final? No. The KES 2.5 million to KES 500 million range and the KES 100,000 to KES 2,000,000 fee range come from the draft Regulations published for comment to 10 April 2026. They are not gazetted as of 30 June 2026 and may change.

What if the Regulations are still not gazetted by 4 November 2026? Then incumbents face the position the regime created: a live deadline with no application channel. The defensible posture is a completed, documented readiness file plus full AML compliance, so you can lodge immediately on opening and show good faith if challenged. Take legal advice on this before the window closes.

The window is closing and the licensing channel is still shut. That combination is uncomfortable, but it favours the operators who use the time well. Firms that build the file now, run their AML programme today, and document a clean readiness effort will be first in the queue and best protected if the deadline arrives before licensing opens. Firms that wait will be choosing between a rushed application and an exposed position.

We work with crypto founders, exchanges, custodians, payment platforms and foreign groups entering Kenya. We scope the section 47 decision honestly: whether your file is realistic, what the readiness build costs, and whether prepare-to-file or wind-down is the right call. We cover the full stack, from corporate structuring and the AML and POCAMLA build-out to ODPC registration and the licensing strategy across CBK and CMA. Book a consultation and we will map your route to 4 November 2026.