Kenya's crypto industry has spent years operating in a regulatory vacuum despite being one of the continent's largest markets for digital assets — Chainalysis data cited by TechCabal puts inflows between July 2024 and June 2025 at roughly $19 billion, more than double the prior year's ~$7 billion. That vacuum closed on July 24, 2026, when the Virtual Asset Service Providers Regulations, 2026 — Legal Notice No. 134 — was gazetted, operationalising the Virtual Asset Service Providers Act that President William Ruto signed in October 2025. Binance, Luno, Yellow Card, VALR and the Kenyan-founded Kotani Pay have all confirmed they are applying for licences, according to TechCabal's reporting.
A defensible case for real teeth
The strongest argument for LN 134's aggressive posture is straightforward: Kenya has already been burned by under-regulated digital platforms handling sensitive consumer data and money, and crypto's pseudonymity makes it a natural conduit for fraud and money laundering if licensing is purely nominal. A regulator that can only fine a collapsing exchange after customer funds have vanished offers little real protection. Giving the Capital Markets Authority (CMA) and Central Bank of Kenya (CBK) the power to freeze assets, seize hardware wallets under court order, and install a statutory manager to preserve customer funds mid-collapse is a coherent response to a real failure mode — one FATF-aligned regimes elsewhere have already adopted in some form.
What the regulator can now do
Under LN 134, CBK supervises virtual-asset-to-fiat conversion and stablecoin issuers, while CMA regulates exchanges, token issuance and tokenisation platforms — a split confirmed in CBK's own public notice on the draft rules. The gazetted version goes further than that draft: regulators can reject or revoke licences, impose administrative sanctions, freeze specific consumer accounts or virtual assets tied to suspected financial crime, and — with court approval — seize devices, hardware wallets and seed phrases, converting frozen assets to fiat to preserve value during an investigation. Non-compliant firms face fines up to KES 8 million ($61,800) and individuals up to KES 5 million plus five years imprisonment, per TechCabal's account of the seizure framework.
Notably, the final text also does something the March draft did not: it grants VASPs a statutory right to appeal licence refusals, suspensions and sanctions. That is a genuine improvement, and one worth crediting — a regulator empowered to freeze your assets without a codified path to contest that decision is a very different, and much harder to justify, proposition than one that is.
The gap: who protects the data?
Here is what LN 134 does not resolve. Licensed VASPs will run mandatory KYC — collecting national ID numbers, biometric-adjacent identity data and full transaction histories, retained for seven years per CMA/CBK reporting rules. That is precisely the category of processing the Office of the Data Protection Commissioner (ODPC) exists to police under the Data Protection Act, 2019 — data minimisation, purpose limitation, lawful cross-border transfer. But ODPC is not a co-regulator under LN 134; it is a separate statutory body enforcing a separate law, with no formal coordination mechanism the gazetted text or CBK's own notices describe.
Kenya has direct experience with what that gap costs. In 2023, ODPC found that Worldcoin's biometric-data collection violated the Data Protection Act and moved to suspend its operations; a High Court order ultimately gave the company seven days to delete Kenyan users' biometric data, which ODPC confirmed complete only in January 2026 — more than two years after the violation was first flagged. That is the enforcement timeline Kenyan crypto users are relying on if a VASP mishandles their KYC data: not the fast, asset-freezing machinery CMA/CBK now wield over money, but the slower, complaint-driven, frequently under-resourced process ODPC has historically run over data.
The right call, with one missing clause
On balance, LN 134 is a well-calibrated piece of financial regulation: it is licensing-first rather than prohibition-first, sets capital tiers from roughly KES 10 million up to KES 300 million by activity type rather than a single prohibitive bar, and — critically — pairs its new enforcement muscle with an appeal right that wasn't there in draft. That combination is what lets firms with real compliance budgets like Binance and VALR view Kenya as, in Binance Africa's own words to TechCabal, "a great start" rather than a market to avoid.
What it lacks is a data-protection counterpart to the appeal right: a formal duty for CMA and CBK to loop ODPC into licensing decisions where a VASP's data-handling practices are unresolved, or a joint incident-reporting channel for KYC breaches. Kenya wrote the financial-crime playbook first because that is where the political urgency sat after two years of unregulated crypto growth. It should not take another Worldcoin-length enforcement gap to write the privacy playbook next.