The Virtual Asset Service Providers Bill, 2025

Background

The Virtual Asset Service Providers Bill, 2025 is introduced to address potential risks associated with the misuse of virtual asset products and services, such as fraud, money laundering, and terrorism financing. By establishing a robust legislative framework, the Bill seeks to bring virtual asset activities—such as cryptocurrency exchanges, custodial wallets, and token issuance—under formal regulatory oversight in Kenya to promote financial stability and protect consumers.

Key Amendments

The Bill introduces significant updates to several existing laws to incorporate virtual asset services:

• The Proceeds of Crime and Anti-Money Laundering Act (Cap. 59A): Amends Section 2 to include virtual asset service providers within the definition of 'reporting institutions' and adds explicit definitions for virtual assets and providers.
• The Capital Markets Act (Cap. 485A): Amends Section 2 to explicitly insert 'virtual asset' under the definition of 'securities' and grants the Capital Markets Authority powers to regulate and license virtual asset services.
• The Central Bank of Kenya Act (Cap. 491): Grants the Central Bank of Kenya powers to license and supervise virtual asset service providers.
• The National Payment System Act (Cap. 491A): Integrates virtual asset service provider compliance requirements.

New Obligations

Virtual asset service providers operating in or from Kenya face several new regulatory and operational duties:

• Licensing Requirements: Under Clause 11, any person intending to carry on virtual asset services must apply for a license from the relevant regulatory authority (CMA or CBK) and meet requirements regarding skills, capital, cyber security, and physical premises.
• Fit and Proper Person Assessments: Under Clause 19, licensees cannot appoint directors or senior officers unless they satisfy 'fit and proper' criteria, including assessments of honesty, financial integrity, and competence.
• Governance and Capital: Licensees must maintain a physical office in Kenya (Clause 20), have at least three directors (at least three of whom must be natural persons) (Clause 21), and comply with prescribed minimum capital, solvency, and insurance requirements (Clause 23).
• Asset Protection and Cybersecurity: Licensees must hold a sufficient amount of each type of virtual asset to meet customer obligations, segregate customer assets from their own (Clause 32), and implement cybersecurity measures in line with the Computer Misuse and Cybercrimes Act (Clause 29).

Penalties

The Bill details both administrative and criminal penalties for non-compliance:

• Operating Without a License: Conducting virtual asset services without a license is an offence under Clause 9(3), carrying a fine of up to KSh 10 million or 5 years in prison for individuals, and up to KSh 20 million for companies (Clause 41(3)).
• Providing Misleading Information: Supplying false information during a license application carries a fine of up to KSh 7 million or 3 years of imprisonment for individuals, and up to KSh 20 million for companies (Clause 41(2)).
• Illegal Transfer of Ownership: Unauthorized transfer or disposal of shares in a licensee (Clause 28(5)) is penalized with fines of up to KSh 3 million for individuals (and up to 3 years in prison) and KSh 5 million for corporate bodies (Clause 41(1)).
• Administrative Fines: The regulatory authorities can impose administrative penalties for breaches of specific license conditions, including fines up to KSh 3 million for individuals and KSh 10 million for corporate entities (Clause 40(2)(f)).

Transitional Provisions

Under Clause 48, any person already providing virtual asset services at the commencement of the Act must comply with its provisions within one year of the commencement date.