Kenya's VASP Regulations, 2026: What They Mean for AML, KYC and KYB Compliance

Kenya's virtual asset industry has entered a new regulatory phase. The Virtual Asset Service Providers (VASP) Regulations, 2026, gazetted as Legal Notice No. 134 on 22 July 2026, put into practice the Virtual Asset Service Providers Act, 2025. Together, they set out how virtual asset businesses operating in or from Kenya are licensed and supervised. The requirements cover customer due diligence, anti-money laundering (AML) controls, governance, cybersecurity and consumer protection.

The stakes are high. About 4.25 million Kenyans own crypto, Kenya ranks 5th in the world for crypto transaction volumes, and the country has been on the FATF grey list since February 2024. Legal commentary identifies 4 November 2026 as the transition deadline for existing operators.

For businesses in the sector, that means reviewing how they onboard customers, verify business relationships, assess risk and keep records that will stand up to regulatory scrutiny. These are not one-off compliance tasks. They are part of how a VASP operates.

Who do the Regulations apply to?

The framework covers businesses providing virtual asset services in or from Kenya, including:

• Virtual asset exchanges that facilitate trading in digital assets
• Wallet providers and custodians
• Payment processors handling payments that involve digital assets
• Brokers and investment service providers dealing in virtual assets
• Stablecoin issuers and tokenisation businesses
• Token issuance and offering platforms

A physical office in Kenya isn't required for the rules to apply. A provider that targets Kenyan customers, or earns income from Kenya, can be in scope from abroad.

Supervision is split between two regulators. The Central Bank of Kenya (CBK) oversees wallets, stablecoins and payments. The Capital Markets Authority (CMA) oversees exchanges, brokers, asset managers and token offerings. Minimum paid-up capital ranges from nil for investment advisers to KES 100 million for an exchange, KES 150 million for a wallet provider and KES 300 million for a stablecoin issuer.

The first step for any founder or compliance team is to work out where the business sits in that framework, and which obligations follow from it.

1. AML compliance starts with knowing who you're dealing with

The VASP Act makes every licensed provider a reporting institution under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA). In practice, crypto businesses now carry AML duties similar to banks. That includes monitoring transactions and reporting suspicious activity to the Financial Reporting Centre (FRC).

Under Regulation 32, licensees must carry out customer due diligence before onboarding. That means identifying the customer and verifying their identity in line with POCAMLA.

Customer due diligence is more than collecting a document. Take a customer opening an exchange account whose ID details don't match their registration. The compliance team must decide whether the discrepancy can be resolved, whether more information is needed, and whether onboarding should go ahead. That decision should follow policy and the law, not an unexplained pass or fail.

Identity verification is one part of an AML programme. Transaction monitoring, suspicious transaction reporting and record-keeping are separate duties.

2. KYC: verifying individual customers

Know Your Customer (KYC) checks establish who a person is before they can use a service. For VASPs, the pressure point is remote onboarding, where teams rely on submitted documents, selfies and other digital evidence.

The scale is significant. An exchange onboarding 10,000 users a month makes 120,000 identity decisions a year. Common challenges include:

• Documents that are incomplete, unclear or inconsistent
• Details that don't match across the application and the supporting evidence
• Suspected manipulation of identity documents or selfies, including AI-generated or edited images
• Cases that need further review before a decision can be made

A verification tool may produce a result, but the compliance team still needs to understand what was assessed and how open questions were handled.

Deeptrack's Sentinel supports this evidence-assessment layer of KYC. It works with identity documents, selfies and related evidence, and supports structured review, escalation and a documented decision for onboarding and higher-risk cases.

3. KYB: understanding the businesses behind accounts

Know Your Business (KYB) matters whenever a VASP deals with corporate customers, merchants or counterparties. A registration certificate and a list of directors rarely answer every question. Depending on risk, the review may need to confirm the company's identity, understand who owns and controls it, identify beneficial owners, and check that the information is consistent.

Under the new rules, KYB applies at two levels:

• The provider itself. Licence applicants must disclose their directors, senior officers, significant shareholders (above 10%) and beneficial owners, all of whom must pass fit-and-proper checks. The CEO must be domiciled in Kenya, and ownership changes above 10% need the regulator's approval.
• The provider's customers and counterparties. These need due diligence suited to the relationship. Banks, SACCOs and fintechs serving crypto firms will also need to confirm that a licence is genuine.

A forged licence, a doctored certificate or a nominee director can pass a quick check. Deeptrack supports identity and document evidence assessment within KYB workflows. That helps teams structure their reviews and document how questions were resolved.

4. Screening and escalation: when a case raises concerns

Identity verification doesn't address every AML risk. Depending on the customer's risk profile, a VASP may also need sanctions screening, screening for politically exposed persons (PEPs), enhanced due diligence and ongoing monitoring. Each serves a different purpose:

• Verification establishes who the customer is.
• Screening flags matches against sanctions lists or other risk categories.
• Monitoring picks up activity that may need investigation or a suspicious transaction report.

Findings also have to be handled properly. A potential screening match needs checking before it is confirmed. A document discrepancy warrants review but doesn't prove fraud. A higher-risk relationship may trigger enhanced due diligence.

Sentinel includes sanctions and PEP screening alongside structured evidence review. The aim is that relevant findings reach the right people and are handled in line with the provider's procedures.

5. Records: when a decision needs to be explained

Compliance doesn't end when an application is approved, declined or referred. Transaction records, including wallet addresses and chain IDs, must be kept for at least seven years. Licensees may also have to give the regulator access to their systems and records during inspections.

An inspector won't just ask whether a customer was checked. They'll ask what was considered, who reviewed it and why the outcome was reached. A record showing only a final status rarely answers that. Useful records include:

• The evidence reviewed
• Findings and reviewer notes
• Escalation history
• The final decision and the reasons for it

At 120,000 onboardings a year, an exchange would hold about 840,000 such decisions over a seven-year period.

Deeptrack connects evidence assessment with human review, escalation and a documented decision record, so the context behind each decision is preserved. Records like these support internal review and regulatory readiness. They don't replace any specific record-keeping obligation set by law.

6. What should VASPs review now?

With the 4 November 2026 deadline close, these questions are a useful starting point:

• Licensing: Have we identified the right regulatory category for each service we provide?
• Customer due diligence: Can we show how we identify and verify customers before onboarding?
• Business due diligence: Do our processes cover company identity, ownership and beneficial ownership?
• Screening and escalation: Do we have defined steps for sanctions or PEP matches, discrepancies and higher-risk cases?
• Records: Can we retrieve the evidence and review history behind any onboarding decision?
• Wider AML controls: Have we covered transaction monitoring, FRC reporting and ongoing due diligence?

The list isn't exhaustive. Each provider should map its obligations against the Act, the Regulations and POCAMLA, and confirm its position with the regulator and legal counsel. Penalties are significant: operating without a licence can carry fines of up to KES 10 million and up to 10 years in prison under the Act.

Building compliance that works in practice

Kenya's VASP framework places customer due diligence inside a wider system of licensing, financial crime controls, governance and supervision. For virtual asset businesses, that means looking at how compliance works day to day: how information is collected, how people and businesses are assessed, how concerns are escalated and how decisions are documented.

Deeptrack supports this through identity and document evidence assessment, screening and structured review workflows. Compliance teams get clearer evidence and more consistent processes, while the regulated business keeps responsibility for its decisions.