The Proposed New Law on Digital Assets: Review of the Virtual Assets Service Providers Bill, 2025

Virtual Assets (VAs) are capable of enhancing digital finance, e-commerce, international trade, and digital jobs, but also pose risks like cyber-security threats, fraud, and money laundering. A report by UNCTAD shows that over 4.25 million mostly young Kenyans own cryptocurrencies; this is a high uptake compared to other jurisdictions like the USA. Lobbying by various stakeholders has led to the Virtual Assets Service Providers Bill, 2025, aimed at leveraging opportunities while managing risks. As at 04th April 2025, the National Treasury had completed collecting public views from various parts of the country, but the bill is yet to be debated in parliament.

KEY PROVISIONS OF THE BILL

Definition of key terms

VA is defined in the Bill to mean “a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes and does not include digital representation of fiat currencies, e-money, securities and other financial assets.” However, virtual service tokens are not VAs and a person or legal arrangement that provides services that involve virtual service tokens only are not required to have a licence under the bill.

VASP is defined to mean a local company incorporated under the Companies Act 2015 or a foreign company issued with a certificate of compliance under the Companies act 2015 and conducts any activities related to VA services such as VA exchange, VA wallet provision, VA payment processing, VA brokerage VA management etc. For the avoidance of doubt, a natural person shall not carry on, or purport to carry on, in or from within Kenya, the business of VA services as per the Bill.

Scope of Application

The proposed law will apply to companies that offer virtual asset services in Kenya. However, for avoidance of doubt, it will not apply to digital representations within closed ecosystems, fiat currencies, non-fungible tokens not used for financial purposes, and other digital representations regulated by other laws or expressly excluded by the relevant regulatory authorities.

Licencing procedures

There is a mandatory requirement that all VASPs operating in or from Kenya must be licensed to do so by the relevant regulatory authority. A person intending to carry on the business of VA services shall submit an application for a licence to the relevant regulatory authority in compliance with such requirements as may be prescribed. When determining whether to grant or reject an application, the relevant regulatory authority will consider several factors including whether the applicant is eligible, has skilled personnel, and has internal mechanisms for data protection. Once a licence has been granted, it shall then be published in the Kenya Gazette and it shall be valid from the date it was issued through to 31st December of that year. The licence cannot be assigned or transferred without prior approval from the relevant authority.

Obligations for VASPs

The Bill imposes several duties upon VASPs including, but not limited to duty to appoint qualified directors, conduct business with integrity, ensure financial soundness of the business, keep transaction records for seven years, implement conflict of interest policies, notify authorities of substantial business changes, establish cybersecurity measures, prepare annual audited financial statements, and protect customer assets from creditor claims.

Designation of Regulatory Authorities

The Bill designates the following entities for purposes of regulation of the VASPs: the Capita Market Authority and the Central Bank of Kenya and any other body that the Cabinet Secretary may designate as such by a notice in the Kenya Gazette. These entities shall be responsible for, among other functions, licencing of VASPs, approval of issuance of initial VA offering, regulation and supervision of all activities related to VA service provision.

AML/CFT/CPF compliance by all virtual asset service providers

With regards to compliance with AML/CFT/CPF requirements, the Bill mandates that the relevant regulatory authority to regulate, supervise, and enforce compliance with thereof. This includes carrying out vetting of key personnel, inspections and surveillance for AML/CFT/CPF purposes.

CONCLUSION

This step is not unique to Kenya as Kenya takes account of regulatory approaches from various jurisdictions and provides a framework that is adaptive and flexible for domestic and international cooperation, compliance, consumer protection, financial innovation and management of risks. Accordingly, adoption of this policy is a major step towards establishing a secure and well-regulated environment for VAs and VASPs in Kenya. In addition, it provides guidance for regulators, competent authorities and other industry stakeholders to navigate the complexities of the digital space so that the country harnesses opportunities offered by VAs in a responsible manner.

NB: The Bill provides that where, on the commencement of the proposed law, a person is providing VA services, the person shall make an application under the Act within six months upon commencement, to be issued with a licence under the Act. Such a person may continue to carry out its business activities until its application for a licence is granted or refused.

This article is provided free of charge for information purposes only; it does not constitute legal advice and should be relied on as such. No responsibility for the accuracy and/or correctness of the information and commentary as set in the article should be held without seeking specific legal advice on the subject matter. If you have any query regarding the same, please do not hesitate to contact Banking & Finance, Commercial & Corporate Department at WACommercial@wamaeallen.com