A Regime That Blinked, Then Held Firm
On July 22, 2026, Kenya's National Treasury gazetted the Virtual Asset Service Providers Regulations, 2026 — Legal Notice No. 134 of Kenya Gazette Supplement No. 185 — completing the licensing architecture for the Virtual Asset Service Providers Act that President William Ruto signed into law in October 2025 (TechCabal). Most coverage has fixated on the headline number: stablecoin issuers now need KSh 300 million in paid-up capital, plus liquid capital of KSh 60 million or 100% of current liabilities, whichever is higher (Tuko). That figure is real, but it obscures the more consequential story: Treasury drafted an aggressive regime, sat through four months of public consultation, and then cut its own proposed thresholds by as much as 95% before publishing the final text (tech-ish).
That retreat deserves credit before the criticism. Tokenisation-provider capital fell from KSh 200 million to KSh 10 million. ICO and token-issuance platform minimums dropped from KSh 200 million to KSh 20 million. Investment-adviser capital requirements were scrapped entirely. Treasury also killed a proposed 0.05% levy on every exchange trade and a 33.3% ownership cap that would have forced founders to dilute early. Only wallet providers, at KSh 150 million, emerged from the draft process unchanged (tech-ish).
The Case Kenya Is Right to Make
The steelman for going hard here is real. Kenya has spent two and a half years on the Financial Action Task Force's grey list, placed there in February 2024 over deficiencies in anti-money-laundering and counter-terrorism-financing controls — a designation that raises correspondent-banking costs and scares off exactly the institutional capital Nairobi wants for its fintech sector (Capital FM Africa). Kenya is also the country where M-Pesa turned mobile money into daily infrastructure for tens of millions of people with limited formal banking access — meaning a lightly policed crypto on-ramp isn't a niche speculative product here, it's a plausible mass-market substitute for a savings account. A licensing regime with real capital floors, asset segregation, and seven-year transaction-record retention (TechCabal) is a defensible response to both pressures. Treasury's willingness to revise draft numbers by nearly an order of magnitude after hearing from the Virtual Asset Association of Kenya is also evidence of a functioning consultation process, not just consultation theater.
Where the Regime Overreaches
The part that doesn't survive scrutiny is the extraterritorial clause. The regulations reach foreign virtual-asset businesses that actively target Kenyan customers or derive economic benefit from the country, even with zero physical presence there (TechCabal). On paper this closes an obvious loophole — a Cayman-registered exchange can't simply market to Nairobi and skip the CBK/CMA gauntlet local competitors face. In practice, Kenya has no realistic enforcement lever over a platform with no local bank account, no local office, and no local director to summon. The EU's MiCA regime faced the same critique and largely resolved it through market size: platforms comply because losing 450 million consumers is expensive. Kenya's market, valuable as it is regionally, does not carry that leverage. The likely outcome is a two-tier system: compliant firms bear the KSh 300 million-plus cost of licensure, while offshore platforms that ignore the rule keep serving Kenyan retail users through apps and VPNs, with none of the asset-segregation or reserve protections the regulation exists to guarantee. That is the opposite of the stated goal.
A Split Regulator, a Fixed Clock
The CBK/CMA division of labor — CBK for stablecoin issuers and fiat conversion, CMA for exchanges, token issuance, ICOs, and tokenization (TechCabal) — is sensible in principle, mirroring how most jurisdictions split payments oversight from securities-style oversight. But dual-regulator regimes only work if the two bodies coordinate cleanly on firms that straddle categories, such as an exchange that also issues its own stablecoin. Kenya hasn't yet published joint supervisory guidance clarifying how such firms are treated, and existing operators have only until November 4, 2026 to be licensed or wind down (tech-ish) — a compressed runway for a regime whose final capital numbers only became public in late July.
The Bottom Line
Kenya's climbdown on capital thresholds is a genuine win for proportionate regulation, and Treasury should get public credit for actually listening rather than gazetting the March draft unchanged. But cutting domestic compliance costs while leaving an unenforceable extraterritorial mandate on the books doesn't protect Kenyan users from the platforms most likely to defraud them — it just taxes the ones already playing by the rules. If the FATF grey-list exit is the real objective, effectiveness will matter more than the text: Kenya needs to show it can actually license, supervise, and discipline firms under this framework before the next FATF assessment, not just that it published an impressive-looking rulebook.