It started with a warning. In 2015, the Central Bank of Kenya issued a stark public notice: Bitcoin is not legal tender, and the CBK accepts no responsibility for losses. Banks quietly stopped processing transactions for crypto businesses.
Founders watched Kenya’s 50-million-person market from the outside, pressing their faces to the glass.
Then 2023 arrived, and Kenya changed its mind.
The CBK lifted its informal banking ban on crypto businesses. The Capital Markets Authority’s regulatory sandbox had already greenlit several digital asset companies.
A dedicated Virtual Asset Service Providers framework was in motion. Kenya didn’t just open the door to Web3 , it began renovating the entrance.
But here’s what founders get wrong: open doesn’t mean unregulated. Kenya’s crypto compliance framework is real, specific, and enforced. If you launch without understanding it, you’ll understand it the expensive way, through a regulatory enforcement action.
This guide changes that.
Who Regulates Crypto in Kenya? (It’s Not Just the CBK)
Kenya’s crypto regulatory landscape has two primary players, and most founders conflate them:
Central Bank of Kenya (CBK) — The CBK governs payment-related activities. If your product moves money, remittances, stablecoin transfers, digital payment processing, CBK’s National Payment System Act applies. CBK also oversees AML/CFT compliance for payment businesses and has overall supervisory authority over systemic financial risk.
Capital Markets Authority (CMA) — The CMA governs investment-related crypto activities. If your platform enables crypto trading, digital asset exchanges, or crypto investment products, the CMA is your primary regulator. The CMA runs East Africa’s most active regulatory sandbox and has already licensed several digital asset exchanges.
Some crypto businesses , particularly multi-function platforms, fall under both. Understanding which regulator owns your compliance journey is the first critical decision you’ll make.
CBK Compliance Requirements: The Payment Layer
For businesses with payment functions, CBK compliance involves four core pillars:
- PSP Registration: If your blockchain product processes payments for third parties, you may need to register as a Payment Service Provider under the National Payment System Act. This requires submitting a formal application, capital adequacy proof, and a detailed technical description of your payment infrastructure.
- AML/CFT Programme: You must build and document a full AML/CFT programme, this means customer due diligence (CDD) policies, ongoing transaction monitoring, suspicious transaction reporting (STR) to the Financial Reporting Centre (FRC), and staff training records.
- Data Localisation: CBK expects regulated entities to maintain Kenyan-resident data infrastructure and to comply with Kenya’s Data Protection Act (2019).
- Cybersecurity Framework: A documented cybersecurity policy aligned with CBK’s cybersecurity guidance is required. Penetration testing, incident response plans, and business continuity protocols are standard expectations.
CMA Compliance Requirements: The Investment Layer
For digital asset exchanges and investment platforms, the CMA pathway involves:
- Regulatory Sandbox Entry: The CMA sandbox lets innovative companies test products in a controlled regulatory environment for up to 12 months. Sandbox entry requires an application demonstrating your product concept, investor protection mechanisms, and operational controls.
- Full Digital Asset Exchange License: After the sandbox, businesses apply for full licensure. Requirements include: minimum capital thresholds, fit-and-proper assessments for all founders and directors, comprehensive compliance manuals, and ongoing reporting obligations to the CMA.
- Investor Disclosures: All CMA-regulated entities must maintain clear, accurate investor disclosures, including risk disclosures specific to digital assets.
Step-by-Step: How to Become Compliant in Kenya
Step 1: Incorporate locally.
You cannot apply for any regulatory approval in Kenya without a locally registered entity. This is the step most founders skip and then backtrack on. Register your company in Kenya with Norebase →
Step 2: Classify your regulatory pathway.
Is your primary function payments (CBK) or investment/trading (CMA)? Some businesses are both. Knowing this upfront saves months of misdirected effort.
Step 3: Apply for the sandbox or PSP registration.
CMA applications typically take 3–6 months for a complete submission. CBK PSP registration timelines vary — allow 3–9 months for a straightforward application.
Step 4: Build your compliance stack.
Your AML/CFT programme, KYC procedures, transaction monitoring tools, STR reporting protocols, and data protection framework all need to be built before you go live, not after.
Step 5: Engage local counsel.
Kenya’s crypto framework is actively evolving. Provisions from the draft VASP Act will likely change specific requirements. Local legal counsel is not optional, it’s insurance.
The Mistakes Crypto Founders Keep Making in Kenya
- Treating CBK and CMA as interchangeable. They have distinct mandates. Your product determines which owns your compliance journey — or whether both do.
- Graduating from the sandbox… never. Sandbox approval is temporary. The goal is always full licensure.
- Under-documenting the AML programme. ‘We use a third-party KYC tool’ is not an AML programme. Regulators want policies, procedures, training records, and evidence of monitoring.
- Launching without local incorporation. No local entity, no regulatory application. Full stop.
Frequently Asked Questions
Can a foreign-owned company get a crypto license in Kenya?
Yes. Foreign ownership is permitted. But the operating entity must be locally incorporated in Kenya.
How long does CMA sandbox approval take?
Typically 3–6 months from the date of a complete application submission.
Do I need both CBK and CMA approval?
Only if your business performs both payment processing and investment/trading functions. Many businesses only need one.
What is Kenya’s VASP Act and when does it take effect?
Kenya’s draft Virtual Asset Service Providers Act creates a dedicated licensing pathway for virtual asset businesses. As of 2025, the draft was under active review. Once enacted, it will consolidate the current CBK/CMA split into a cleaner framework. Stay updated via the CMA Kenya website.
What is the minimum capital requirement for a crypto business in Kenya?
Capital requirements vary by license type under the CMA framework. For sandbox applicants, thresholds are typically lower. Contact Norebase for current figures relevant to your specific business model.
Ready to launch a compliant crypto business in Kenya? Book a free Norebase compliance consultation →
Related Guides:Crypto License in Kenya · Register a Blockchain Company in Kenya · Virtual Asset License in Africa