VASP licence categories in Kenya: the CBK and CMA split

Kenya’s VASP licence categories split across two regulators, not one. The Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025) lists eleven virtual asset activities in its First Schedule and assigns each one to either the Capital Markets Authority (CMA) or the Central Bank of Kenya (CBK). CMA licenses eight market-facing activities: exchange, trading and clearing and settlement platform, broker, investment advisor, manager, offering provider (ICOs), tokenisation, and token issuance platform. CBK licenses three payment-rail activities: custodial wallet provider, payment processor, and stablecoin issuance. The licence attaches to the activity, not the firm, so a business that runs two listed activities needs two licences, even when both sit with the same regulator. There is no combined “VASP licence” and no standalone VASP authority. This guide maps every category, names its regulator, explains the per-activity model, and works through the common cases where a single business needs two licences.

Short answer

• Two regulators, eleven activities. Section 5 of the Act designates CMA and CBK; the First Schedule lists the eleven licensable activities.
• CMA (markets rail): exchange, trading and clearing and settlement, broker, investment advisor, manager, offering provider, tokenisation, token issuance platform.
• CBK (payments rail): custodial wallet provider, payment processor, stablecoin issuance.
• Per activity, not per firm. Run two listed activities and you need two licences, even within the same regulator.
• Non-custodial wallets are excluded. Only custodial wallet services (where a third party holds the keys) are licensable.
• You cannot be licensed yet. The implementing Regulations are still in draft, so no VASP has been licensed. See the pillar on VASP licensing in Kenya.

Who licenses VASPs in Kenya: CBK or CMA?

Both. Section 5 of the VASP Act names the Capital Markets Authority and the Central Bank of Kenya as the two relevant regulatory authorities. There is no third option and no single combined regulator. The Cabinet Secretary for the National Treasury has a residual power under section 5(c) to designate further bodies by Kenya Gazette notice, but for now the regime is dual.

The division of labour follows the nature of the activity, not the size or branding of the firm:

• CMA supervises the markets rail. Anything that looks like trading, advising, managing, broking, raising capital through a token, or moving real-world assets onto a blockchain falls to CMA.
• CBK supervises the payments rail. Anything that looks like holding client funds, moving value as a payment, or issuing a money-like stablecoin falls to CBK.

That is the underlying logic. The eleven specific heads below resolve every category to one regulator.

What are the 11 VASP activity categories in the First Schedule?

The First Schedule is the operative list. Each head is one licensable activity, and each one is assigned to either CBK or CMA on the face of the Schedule.

Read down the regulator column and the pattern is clear. CMA holds eight activities; CBK holds three. The three CBK heads are the ones where the business holds client value or issues a money-like instrument: custody, payments, and stablecoins.

Which activities does CMA license?

CMA licenses the eight markets-rail activities. In practical terms, if your business does any of the following, you apply to CMA:

• Exchange. You let users swap one virtual asset for another, or virtual assets for fiat.
• Trading, clearing and settlement. You run the matching, clearing or settlement infrastructure behind a market.
• Broker. You route or facilitate trades for clients through exchanges and wallets, acting on their behalf.
• Investment advisor. You give advice on which virtual assets, offerings or NFTs to buy or hold.
• Manager. You manage client portfolios that include virtual assets on a discretionary basis.
• Offering provider. You run initial coin offerings or related capital-raising.
• Tokenisation. You convert real-world assets (property, receivables, commodities) into on-chain tokens.
• Token issuance platform. You provide the platform on which real-world-asset tokens are issued and traded on the secondary market.

The common thread is investor exposure and market conduct. These are the activities a securities regulator naturally supervises, which is why they sit with CMA.

Which activities does CBK license?

CBK licenses the three payments-rail activities:

• Custodial wallet provider. You hold and manage clients’ private keys, so you control the assets on their behalf. This is custody, and it triggers the segregation duties in section 31 of the Act (client assets held 1:1 per token type, kept separate from house assets and from other clients, and bankruptcy-remote from your creditors).
• Payment processor. You arrange transactions involving virtual assets and fiat, or between virtual assets. This is the virtual-asset payment gateway.
• Stablecoin issuance. You create and manage approved stablecoins. This is the most heavily conditioned category in the regime: the draft Regulations propose the highest capital floor and a strict reserve regime (see the draft figures below).

The common thread is that the business holds or moves client value, or issues a money-like instrument. That is the Central Bank’s natural remit.

One carve-out matters here. Non-custodial wallet services are excluded from licensing. The licensable head is the custodial wallet provider, where a third party holds the keys. A pure software wallet where the user alone controls their keys is not caught. If you never take custody of a key, you are not running the licensable activity.

Why is the VASP licence per activity and not per firm?

This is the single most important structural feature of the regime, and the one founders most often get wrong.

The Act licenses activities, not companies. The First Schedule lists eleven activities, and section 8(2) prohibits carrying on, purporting to carry on, or holding out as carrying on “the business of virtual asset services” without a licence for it. The licence is granted against a named activity. Add a second activity and you need a second licence.

Three consequences follow.

You can need two licences from two different regulators. A wallet-plus-exchange business needs a CBK custody licence and a CMA exchange licence. There is no single window that grants both.

You can need two licences from the same regulator. This catches people out. Even within CMA, a broker that also gives discretionary portfolio management is running two listed activities (broker and manager) and needs a licence for each. The activity test does not collapse just because the same regulator supervises both.

You hold separate capital for each licensed activity. The draft Regulations propose that a firm holding more than one licence must hold separate paid-up capital per activity, not a single pooled figure. So the per-activity model is not only a paperwork point; it has a direct capital cost.

The practical takeaway: map every distinct thing your platform does against the eleven heads before you scope a licence application. Each match is a separate licence, a separate fit-and-proper assessment, and, under the draft, a separate capital tranche.

Worked examples: businesses that need two licences

Here is how the per-activity model plays out in the real cases we see.

Example 1: a centralised exchange that also custodies user coin. Most centralised exchanges hold user balances in house wallets, which is custody. That is two activities: Virtual Asset Exchange (CMA) and Virtual Asset Wallet Provider (CBK). Two licences, two regulators, two capital tranches under the draft.

Example 2: a broker-dealer that holds client assets. A broker facilitates trades on behalf of clients (CMA). If it also holds client coin between trades rather than passing through to a third-party custodian, it is also a custodial wallet provider (CBK). Two licences, two regulators.

Example 3: a stablecoin issuer that runs its own transfer rails. Stablecoin issuance sits with CBK. If the issuer also runs the on-chain payment processing or any exchange/conversion feature, it adds a CBK payment-processor licence or a CMA exchange licence depending on the feature. This is a multi-licence build from the start.

Example 4: a tokenisation platform with a secondary market. Converting real-world assets into tokens is tokenisation (CMA). Providing the platform on which those tokens then trade on the secondary market is a token issuance platform (CMA). Both heads sit with CMA, but they are two separate listed activities, so two licences from the same regulator.

Example 5: a portfolio manager who also advises. Discretionary portfolio management (manager, CMA) and investment advice (investment advisor, CMA) are two heads. A firm offering both needs both licences, both from CMA.

In every case, the rule is the same: count the activities, not the companies. For the full application mechanics, eligibility bar and timeline that sit on top of these categories, see the pillar on VASP licensing in Kenya.

How do the draft capital figures map to the categories?

The capital floors are set by Regulations, not by the Act itself. The draft Virtual Asset Service Providers Regulations, 2026 (published for comment on 17 March 2026, consultation closed 10 April 2026) propose the first concrete numbers, scaled by activity.

[DRAFT, not yet law. The following figures are from the draft Regulations 2026 and are not gazetted as of 30 June 2026. They may change. Do not rely on a specific shilling figure in a binding context until the Legal Notice is published.]

• Minimum core capital scales by activity: from about KES 2.5 million for an investment adviser up to KES 500 million for a stablecoin issuer, with the other categories in between.
• Separate paid-up capital per licensed activity: a firm holding more than one licence holds a separate capital tranche for each.
• Licensing fees are proposed at KES 100,000 to KES 2,000,000, heaviest on exchanges and stablecoin-handling payment processors.
• Stablecoin reserve rule: issuers must hold at least 30% of funds received in segregated accounts at Kenyan commercial banks, the remainder in low-risk Kenya-domiciled high-quality liquid assets.

The headline is that the heaviest categories are the CBK-supervised stablecoin head and the CMA-supervised exchange head. The lightest is the CMA-supervised investment-advisor head. For a deeper breakdown, see crypto capital requirements in Kenya. For the licence-specific guides, see crypto exchange license Kenya and crypto custody license Kenya.

Frequently asked questions

How many VASP licence categories are there in Kenya? Eleven. The First Schedule to the VASP Act 2025 lists eleven virtual asset activities. CMA licenses eight of them and CBK licenses three.

Which categories does CBK license? Three: custodial wallet provider, payment processor, and stablecoin issuance. These are the payments-rail activities where the business holds or moves client value or issues a money-like instrument.

Which categories does CMA license? Eight: exchange, trading and clearing and settlement platform, broker, investment advisor, manager, offering provider (ICOs), tokenisation, and token issuance platform. These are the markets-rail activities involving investor exposure and market conduct.

Can one company hold both a CBK and a CMA licence? Yes, and many will need to. The licence is per activity. A business that runs, for example, a custodial wallet (CBK) and an exchange (CMA) holds two licences from two regulators. Under the draft Regulations it also holds separate capital for each.

Do I need a separate licence for each activity even under the same regulator? Yes. The per-activity model does not collapse just because one regulator supervises both heads. A CMA broker that also runs discretionary portfolio management needs a broker licence and a manager licence, both from CMA.

Is a non-custodial wallet a VASP activity? No. Only custodial wallet services (where a third party holds and manages the private keys) are licensable. A pure non-custodial wallet, where the user alone controls their keys, is excluded from licensing.

Which category covers a crypto payment gateway? The Virtual Asset Payment Processor head, which is licensed by CBK. It covers arranging transactions involving virtual assets and fiat, or between virtual assets. See crypto exchange license Kenya for where exchange and payment functions overlap.

Can I apply for a VASP licence in any category today? No. The implementing Regulations are still in draft, and CBK and CMA confirmed jointly that no VASP has been licensed. Licensing starts only once the Regulations are gazetted. The category map above is the framework you will apply against when the channel opens. See the VASP compliance deadline in Kenya for the transitional window.

What happens if I run an activity in the wrong category or without the right licence? Operating without the correct licence is an offence under section 8 of the Act. For the penalty band and director exposure, see unlicensed VASP penalties in Kenya.

If you are building a crypto exchange, a custody business, a stablecoin issuer, a payment gateway or a tokenisation platform aimed at Kenyan users, the first step is to map every function your platform performs against these eleven categories, because each match is a separate licence and, under the draft Regulations, a separate capital tranche. We scope that map with founders, treasury teams and foreign groups planning their Kenyan entry, then build the licensing strategy across CBK and CMA. Book a consultation and we will run the category map on your specific model.

Related reading: the pillar on VASP licensing in Kenya, crypto exchange license Kenya, crypto custody license Kenya, crypto capital requirements Kenya, and unlicensed VASP penalties Kenya.