The regulations are gazetted. The window closes 4 November.

In February we wrote that Kenya had a virtual asset law but that the detail was still settling. That detail arrived on 22 July 2026, when the Cabinet Secretary for the National Treasury gazetted the Virtual Asset Service Providers Regulations, 2026 under Legal Notice No. 134, made under section 49 of the Act.

The Regulations are what turns the Act from a statement of intent into a working licensing regime. They set out the categories, the capital, the governance, the cybersecurity obligations and the consumer protections. They are now law, and the transitional window the Act gave existing operators expires in five weeks.

Which regulator holds your provider

The dual-regulator split survives into the final Regulations. The Central Bank of Kenya supervises payment-side and stablecoin activity. The Capital Markets Authority supervises the market-facing categories, and that is where asset management and investment advice sit.

For a firm like ours, the CMA list is the relevant one. For an institution buying services, the first question is not whether a provider is licensed but which of the ten categories it is licensed in, because a licence in one category authorises nothing in another.

The test catches offshore providers too

Regulation 4 applies the framework to anyone offering virtual asset services “in or from Kenya”, and deems a person to be operating in or from Kenya where they actively solicit or target local consumers, or derive economic benefit or income from Kenya. Physical presence is not required.

This is the provision most likely to matter to a Kenyan treasury or trustee board, and it is the one least likely to have been discussed with them. If your organisation holds virtual assets through an offshore exchange, custodian or manager that markets into Kenya, that provider may well need a Kenyan licence. After 4 November, a provider operating without one is committing an offence, and your exposure sits with a counterparty in that position.

What an application actually demands

The bar is not procedural. An application under Regulation 6 requires personal details, qualifications and business interests for every director, senior officer, significant shareholder and beneficial owner; a business plan to the prescribed form; fit and proper assessments; proof of source of funds; descriptions of all systems and controls; and operational policies covering risk management, AML/CFT/CPF, cybersecurity, IT and complaints handling.

It also requires audited financial statements for the prior three years, or opening financials verified by an auditor for a new entity, together with an independent information systems audit including vulnerability assessment and penetration testing. The regulator then has thirty days to determine a complete application.

Read that list against the calendar. A firm starting its application today is not assembling paperwork, it is commissioning an audit.

Capital

The Fifth Schedule sets minimum paid-up capital by category, to be maintained at all times from licensing. Capital raised through shareholder loans, borrowed funds, unpaid commitments or revaluation reserves does not count. For a Virtual Asset Manager the minimum paid-up capital is KES 20 million.

Where a licensee holds more than one licence, Regulation 85(6) applies the full paid-up capital of the highest category plus fifty per cent of the capital prescribed for each additional activity, rather than simply adding the thresholds together. The relief is not expressly extended to liquid capital.

Governance is prescribed, not advisory

The Regulations set the shape of the board rather than leaving it to the applicant. A licensee needs at least three directors with one-third of them independent, and the chairperson may not also be the chief executive officer. The persons running the finance function and the internal audit function must be members in good standing of the Institute of Certified Public Accountants of Kenya or a recognised equivalent. A compliance officer is appointed by the board, may not hold any function that is itself subject to compliance, and must have direct access to the board.

Firms that treated governance as a cost centre will find this the slowest part of the application, because a board cannot be assembled in five weeks. Our own board was constituted before these requirements were gazetted: four directors, two of them independent non-executives, a chairperson who is not the chief executive, and two fellows of ICPAK. Whether any applicant satisfies the CMA is for the CMA to determine, but the structural work is not something we are starting now.

What we would check this month

• Map your own activity. Identify which of the ten categories describes what your organisation actually does, and which regulator holds it. Holding virtual assets on your own balance sheet is a different question from offering a service.
• Ask every provider for its category, not its status. “Licensed” and “licensed to do this” are different answers.
• Ask offshore providers the Regulation 4 question directly. If they market into Kenya or earn income here, ask what their Kenyan licensing position is and when it will be resolved.
• Get the custody position in writing. The Regulations require consumer assets to be segregated from the licensee's own holdings, held in separate accounts, and not lent, pledged or encumbered, with reconciliation of on-chain holdings against internal records and periodic statements to consumers. Ask whether your provider does this today.
• Diarise renewal, not just licensing. Licences are renewed annually and applications fall due before expiry, so this is a standing obligation rather than a one-off.

Where BTX Capital stands

We have applied to the Capital Markets Authority for two licences, Virtual Asset Manager and Virtual Asset Investment Advisor. Both applications are pending and we do not hold a CMA licence until they are determined. We have said since inception that our ambition to become East Africa's first publicly listed digital asset treasury company is subject to regulatory approval, and the phrase is there because it is load-bearing.

If your board is working through what Legal Notice 134 means for an existing holding or an existing provider relationship, that is a conversation we are glad to have, whether or not it ends in a mandate.

This article is general commentary on the Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134, Kenya Gazette Supplement No. 185). It is not legal advice, and it is not a complete account of the Regulations. Requirements differ by licence category and some detail remains subject to regulator guidance. Institutions should take independent professional advice on their own position.