Virtual assets framework in Kenya

Kenya has moved towards a legal framework for virtual asset service providers. The Capital Markets Authority and the Central Bank are the bodies to check for what is in force. This page explains what that means in general terms, and what a reader should ask a venue before sending money.

The state of the framework

Kenya has moved towards a legal framework for virtual asset service providers. The framework involves the Capital Markets Authority and the Central Bank. The reader should check those bodies' own pages for what is in force. This page does not assert any act's name, date, licence list, or whether a given venue is licensed.

The framework is not a promise that any particular venue is safe. It is a set of rules that some venues may follow. The reader should look at the regulator's register, not just the venue's website.

What to ask a venue

Before sending money to a crypto-asset venue, the reader should ask for its legal entity. The legal entity is the company that will hold the money. It is named in the venue's terms and conditions. The reader should check that name on the regulator's register.

The reader should also ask for the venue's home regulator. The home regulator is the authority in the country where the legal entity is based. The reader should check that regulator's register for the entity's name.

The complaint route

A venue should have a complaint route. The complaint route is the process for raising a problem. It should be written in the venue's terms and conditions. The reader should read it before sending money.

If the venue does not have a complaint route, or if the route is not clear, that is a warning sign. The reader should not send money until the route is clear.

Licence does not mean safety

A licence from a regulator does not mean the venue is safe. It means the venue has met the regulator's requirements at a point in time. The regulator can revoke the licence. The reader should check the regulator's register for the current status.

A licence also does not promise profit. The venue can lose money. The reader should read the risk warning before sending money.

Crypto as a price contract

Some venues offer crypto as a price contract, not as coins. A price contract is an agreement on a price. The client does not receive coins. The client's money is at risk if the price moves against the position.

The reader should check what the venue offers. If the venue offers coins, the reader should ask where the coins are held. If the venue offers price contracts, the reader should read the risk warning.

The regulators' pages

The Capital Markets Authority and the Central Bank have pages on virtual assets. The reader should check those pages for what is in force. The pages may list licensed venues, or they may state that no venues are licensed.

The reader should not rely on this page for the current state. This page describes the general framework. The regulators' pages are the source for what is in force.

A virtual asset service provider is not the same as a cryptocurrency

Kenyan discussions treat a coin and the business that sells it as one thing. A virtual asset is a digital representation of value that can be traded or transferred. A virtual asset service provider is the company that exchanges, holds, or moves that asset for customers. The draft framework regulates the provider, not the coin itself.

This distinction matters when a group chat promises returns from 'crypto'. If a person takes money to trade on your behalf, they are acting like a service provider even if they have no office. The future licensing regime will ask such people to register, keep customer funds separate, and report transactions. Until then, the person is simply holding your money.

When you send funds to a paybill or till number for a 'crypto investment', ask whose name appears at confirmation and whether that name matches a registered business. A provider that is not registered with the Capital Markets Authority may still operate from a phone. The framework is meant to change that by making unregistered activity an offence.

The framework will not make any specific coin legal or illegal

A common question is whether Bitcoin or another coin is legal in Kenya. The proposed rules do not answer that directly. They instead create a licensing path for businesses that deal in virtual assets. A coin can remain outside the rules while the business handling it must comply.

This means a group chat that says 'we trade USDT' is not magically lawful because USDT exists. The question is whether the person taking your money is licensed as a virtual asset service provider. Without a licence, that person may be operating an unregulated investment scheme, even if the underlying coin is widely traded.

The framework also proposes that providers must assess whether a virtual asset is suitable for retail customers. Some assets may be restricted to professional investors. So a coin's popularity in a chat does not tell you whether a provider will be allowed to sell it to you once rules take effect.

A paybill or till number does not show whether a crypto venue is licensed

Mobile money channels hide the legal status of the person receiving funds. A paybill number can be rented by a registered company, a sole trader, or an informal group. The name that appears at confirmation is often a trading name that was registered with Safaricom, not a licence from the Capital Markets Authority.

Under the draft framework, a licensed provider will have to display its licence number and the regulator's name in all communications. That requirement will not apply to a paybill confirmation screen, but it will apply to websites and social media pages. Until the rules are in force, any paybill can claim to be a crypto exchange.

When you send money to a till number for 'crypto trading', you are paying an unverified counterparty. The reversal process can recover funds only if the recipient cooperates or if the payment was made to a registered paybill with a dispute mechanism. A crypto venue that is not licensed has no obligation to return your money.

The framework changes the meaning of 'licensed' for crypto venues

Currently, a crypto platform may be registered as a company but not licensed to deal in virtual assets. The draft rules create a specific licence for virtual asset service providers. That licence will require fit-and-proper tests for directors, minimum capital, and segregation of customer funds.

A business that today claims it is 'registered' may be telling the truth about its company registration but not about any financial licence. The framework will make it an offence to use words like 'licensed' or 'regulated' without holding the correct virtual asset licence. Until then, the word 'registered' on a website means little.

When the rules take effect, a venue that is not licensed will be barred from advertising to Kenyans. But enforcement will take time. The safest approach is to ask a venue for its licence number and check it against the CMA's public register. If the number is missing or cannot be verified, treat the venue as unlicensed.

Crypto as a price contract puts the venue on the other side of your trade

When you buy crypto from a venue, you are entering a price contract. The venue quotes a price in shillings, you pay, and the venue owes you a certain amount of crypto. If the venue is unlicensed, nothing stops it from quoting a price that is far from the market rate.

A group chat that 'trades for you' is not giving you a price contract at all. It is promising a return based on future price movements. That is a different legal animal, closer to a managed investment scheme. The draft framework treats such activity as a virtual asset service only if the person holds your crypto or fiat and trades on your behalf.

Ask whether the venue is acting as an exchange or as an investment manager. An exchange shows you a live price and lets you buy or sell instantly. An investment manager takes your money and promises a profit after some time. The latter is far riskier and may fall outside the virtual asset framework entirely, into the realm of unlicensed investment schemes.

The framework's transitional period will create a window for unlicensed operators

No licensing regime starts overnight. The draft rules propose a transitional period during which existing providers must apply for a licence or stop operating. During that window, unlicensed venues may continue to take money from Kenyans, arguing that they are 'in the process of applying'.

A group chat that promises 'we are applying for a licence' is using a classic stalling tactic. The transitional period is not a free pass. The CMA can still issue cautions against unlicensed entities during that time. And a payment made to an unlicensed venue during the transition is no safer than one made today.

The safest way to handle the transitional period is to wait for the CMA to publish a list of licensed providers. Until that list exists, any venue claiming to be 'regulated' is either lying or referring to a foreign regulator. Kenya's framework will not recognise foreign licences automatically, so a venue must be licensed locally.

A venue's terms can change between the chat and the payment

A group chat may quote a return in the morning and a different one by evening. The till or paybill confirmation does not carry the promise. What the venue's website or bot said at the moment of sending may no longer match the receipt. A payment record alone cannot show which version of an offer you accepted. The venue can point to a later update and say the earlier message was a mistake or a draft.

This gap matters when you try to complain. The mobile money receipt lists an amount and a time, not a percentage or a date for payout. Without a saved screenshot or a forwarded message with a timestamp, the venue and the payment provider see different things. The provider sees a completed transfer. The venue sees a request for a service whose terms are whatever its current page displays.

Before sending, a reader can ask the venue to state the terms in a channel that leaves a trail, such as an email or a saved chat export. A voice note in a group disappears or gets deleted. A promise typed into a disappearing message cannot be retrieved later. The order that protects a payer is: receive the terms, check the date and the till or paybill, then send, and keep the terms next to the receipt.

A reversal request goes to the receiving provider, not to the venue

When a payment is sent to a till or paybill, the first stop for a reversal is the mobile money provider that operates that number. The venue that received the money is not a party to the reversal request. The provider will ask for the transaction code, the amount, and the reason. The provider then contacts the receiving party's provider, which may ask the till or paybill owner to consent.

If the receiving party agrees, the provider can reverse the full amount. If the receiving party disputes the request or the provider decides the payment was authorised, the reversal is refused. The provider does not judge whether the investment was fair or whether the return was promised. It only checks whether the payer confirms the transfer and whether the receiving party agrees to send the money back.

This means a reversal works best in the first moments after a mistaken or unauthorised payment. It is not a refund process for a losing trade or a broken promise. A reader who sends money to a venue and later regrets the decision has no automatic right to a reversal. The provider's role ends at moving the value; the dispute about what the venue owed stays between the payer and the venue.