From 10 Shillings to 150 Million: How VASP Regulations are Pricing Out Kenyan Innovation
Fabiola Mukabane7 min read·Just now--
I recently executed my first transaction on Bitcoin’s Lightning Network. It might seem insignificant but it meant a great deal to me. Have you seen the price of 1 BTC lately? That should explain my initial reservations to hop onto the virtual asset.
For a long time, I thought Bitcoin was a preserve of the elites. The political class, tycoons, elite traders; you get my drift. This was warranted because it never seemed like a practical asset for the rest of us.
This changed recently, when I attended the BitDevs Socratic Seminar. I learnt a lot about Bitcoin from both a developer’s and a common user’s perspective. I learnt that I could buy bitcoin for as little as 10 shillings using Mpesa on Bitika. I was also made aware of the fact that I could spend my bitcoin in an Mpesa native environment using Tando, which created a bridge between the lightning network and mpesa
In the near future, all this might not be possible. I mean, technically, you’ll still be able to buy and sell BTC or build a cool Web3 startup, but the odds of you operating a legally accredited Web3 business in Kenya will be directly proportional to the size of your pocket.
In case you’re a user of various tools in the vast Web3 ecosystem, you’ll likely be using tools built and operated by large foreign companies yet we have plenty of local talent breaking barriers in the sector.
Enter the Virtual Asset Service Providers (VASP) Draft Bill, subsidiary legislation implementing Kenya’s VASP Act 2025. It operationalizes the licensing, conduct and oversight of all virtual asset businesses in Kenya and was issued by the Cabinet Secretary, National Treasury. We’re talking 15 Parts, 147 Regulations and 6 Schedules covering everything from licence applications to freezing and seizure of virtual assets.
The Capital Barrier: Who Can Afford to Play?
Here’s where things get interesting or depressing, depending on where you’re standing. The regulations prescribe minimum paid-up capital requirements that would make most local startups rethink their career choices.
Want to run a virtual asset wallet provider like those custodial wallets you’ve been using? You’ll need KSh 150,000,000 in paid-up capital. That’s right, one hundred and fifty million shillings just to get your foot in the door.
Planning to launch a stablecoin maybe a KES-pegged token that could revolutionize payments in Kenya? Better have KSh 500,000,000 lying around. Half a billion shillings. This is the most heavily regulated category, complete with monthly proof-of-reserve reports, segregated accounts at Kenyan commercial banks, and a statutory obligation to offer redemption at par value on demand. No interest payments allowed, by the way.
Even if you’re thinking smaller, like becoming a virtual asset payment processor to help merchants accept crypto payments, you’re looking at KSh 50,000,000 minimum. Want to operate an exchange like those platforms where you discovered you could actually afford some satoshis? That’s another KSh 150,000,000.
The only category with a remotely accessible barrier to entry is the virtual asset investment adviser at KSh 2,500,000 but that’s just for giving advice, not actually handling anyone’s assets.
For context, platforms like Bitika or Tando, the very tools that democratized Bitcoin access for ordinary Kenyans, would need to cough up anywhere from KSh 50 million to KSh 150 million depending on their exact business model. And if they’re doing multiple things? They might need separate licenses for each activity.
Who’s Actually Being Regulated?
The regulations cast a wide net over ten categories of virtual asset service providers:
Virtual Asset Exchanges operate platforms where buyers and sellers trade crypto against each other or against fiat. They match orders, set trading rules, handle settlement, and maintain order books. Think Binance, Coinbase or local platforms like Mara.
Virtual Asset Brokers act as intermediaries executing buy or sell orders on behalf of clients. They don’t run the marketplace; they access it on your behalf, sourcing liquidity from exchanges and charging a commission or spread.
Virtual Asset Wallet Providers offer the software or hardware that lets you store, send, and receive virtual assets. The regulations primarily target custodial wallets where the provider holds your private keys.
Stablecoin Issuers create and manage tokens pegged to stable values which are typically fiat currencies like KES or USD. They must maintain reserve assets backing every coin in circulation and publish monthly proof-of-reserves.
Virtual Asset Payment Processors sit between merchants and consumers, converting virtual assets to fiat or vice versa at the point of transaction. Basically Pesapal, but for crypto.
Virtual Asset Investment Advisers provide professional advice on which assets to buy, sell or hold and how to structure a portfolio. They don’t execute trades themselves; they just give recommendations.
Virtual Asset Managers manage portfolios on behalf of clients under discretionary mandates like hedge funds, but for crypto. They must appoint a licensed Kenyan custodian to safeguard client funds, and investments in related companies can’t exceed 10% of total assets under management.
Initial Coin Offering (ICO) Providers facilitate the issuance of new tokens to the public as a fundraising mechanism. Every ICO requires prior regulatory approval and a licensed promoter which is the crypto equivalent of an IPO.
Virtual Asset Tokenization Providers take ownership rights in real-world assets such as property, commodities, equity, receivables and represent them as blockchain tokens. Imagine tokenizing a Nairobi apartment block so fractional ownership can be traded on-chain.
Token Issuance Platforms provide the infrastructure on which token issuers launch and distribute their tokens to the public. They’re focused on primary issuance rather than secondary trading.
The Grey Areas and Exclusions
Interestingly, some things remain ambiguous. NFTs aren’t explicitly named anywhere in the regulations. Whether they qualify as virtual assets depends on the definition in the VASP Act 2025. Non-transferable soulbound NFTs like those used for on-chain credit scoring might be carved out since they have no market value.
CBDCs (Central Bank Digital Currencies) issued by the Central Bank of Kenya would almost certainly be excluded since they constitute sovereign money, not privately issued virtual assets.
In-game tokens and loyalty points are excluded if they can’t be exchanged for fiat or other virtual assets outside their native platform.
The Compliance Burden
Beyond the capital requirements, licensees face an extensive list of ongoing obligations. You must maintain fair, transparent and efficient services. You need a formalized Business Continuity Plan approved by your board. KYC and Customer Due Diligence procedures before consumer onboarding. Full transaction metadata as required under Section 44 of the Act. A designated Compliance Officer. A Risk Management Framework. Regular reports to the relevant regulatory authority covering compliance, complaints, financials and system performance.
The board must approve all risk frameworks, business continuity plans, and capital plans. Fit-and-proper requirements apply to all directors, senior officers, and significant shareholders covering financial history, criminal record, professional conduct and regulatory history across all jurisdictions.
On cybersecurity alone, you’ll need a documented strategy, annual independent audits and immediate reporting of all cybersecurity events to the regulator.
The Fee Structure
The First Schedule lays out the fees. Application fees range from KSh 100,000 to KSh 500,000 depending on licence type. Annual renewal fees are typically KSh 500,000 or 0.15% of gross turnover, whichever is higher. For stablecoin issuance renewal, it’s 2% of prior year gross income or KSh 2,000,000, whichever is higher.
Exchanges pay a transaction fee of 0.05% per counterparty per trade. ICO approval carries a fee of 0.5% of the successful offer value. Licence assignment or transfer costs 0.25% of the transaction value.
The Watchdogs
A cross-agency Coordination Committee chaired by the National Treasury coordinates VASP oversight. Members include the Central Bank of Kenya, Capital Markets Authority, Asset Recovery Agency, Financial Reporting Centre, Directorate of Criminal Investigation, National Intelligence Service, Nairobi International Financial Centre Authority, National Computer and Cybercrimes Coordination Committee, Office of the Attorney General, Communications Authority of Kenya, and the National Counter Terrorism Centre.
The regulations also explicitly prohibit insider trading, market manipulation, false trading, market rigging, front-running, churning, cold calling and fraudulent inducement to trade. All advertisements and promotions must be pre-approved, risk-disclosed and consistent with relevant whitepapers including internet advertising on social media and messaging platforms.
Regulatory authorities can issue freezing and seizure orders, and licensees are legally obligated to comply. Non-compliance is a criminal offence. False statements in applications carry a fine of up to KSh 7,000,000 or 3 years imprisonment for individuals; KSh 20,000,000 for companies.
What This Means for Innovation
So here we are. The regulations aim to bring order to the Wild West of virtual assets in Kenya and there’s merit in that. Consumer protection matters. AML/CFT compliance matters. We’ve seen enough rug pulls and exchange collapses globally to know that some oversight is necessary.
But the barrier to entry effectively locks out the very innovators who’ve been building grassroots solutions. The developers building Lightning integrations. The founders creating Mpesa-to-crypto bridges. The teams tokenizing real-world assets to increase financial inclusion.
Unless you have access to hundreds of millions in capital or foreign investors willing to deploy that kind of money into a heavily regulated market, you’re essentially relegated to being a user of foreign platforms or an informal operator hoping you don’t get noticed.
The irony isn’t lost on me. I discovered I could participate in Bitcoin with as little as 10 shillings. But the people who made that possible? They’ll need 150,000,000 shillings to keep doing it legally.
Maybe that’s the point. Maybe the future of virtual assets in Kenya is one where only the big players survive, where innovation happens abroad and we’re just consumers. Or maybe there’s a conversation to be had about proportionate regulation; about creating pathways for smaller operators to grow into compliance rather than demanding unicorn-level capital from day one.
For now, I’m grateful I got to experience that Lightning Network transaction. Who knows how much longer tools like that will be accessible from homegrown solutions.
The regulations are here. Whether they’ll foster a thriving digital economy or strangle it in the crib remains to be seen.
