CMA gets powers to license, audit crypto firms under new law

President William Ruto last week assented to the Virtual Asset Service Providers Bill 2024, marking a major step towards regulating Kenya’s fast-growing cryptocurrency sector.

The new law seeks to license and supervise firms dealing in digital assets such as Bitcoin, stablecoins, and non-fungible tokens (NFTs).

It establishes a legal framework for virtual asset trading, exchanges, and custody services, emerging areas that had operated without formal oversight.

Ruto’s government aims to promote transparency, protect investors, and curb illicit financial activities linked to digital currencies.

Firstly, all businesses offering crypto-related services, including exchanges, brokers, wallet providers, and token issuers, must obtain a license from the Capital Markets Authority (CMA).

Operators will be required to meet strict fit-and-proper tests, maintain adequate capital, and ensure consumer protection measures before approval.

“A virtual asset service provider shall at all times maintain its business in a financially sound condition by complying with such capital, solvency, and insurance requirements as may be prescribed,” the law states.

Similarly, licensed firms will be obligated to conduct Know Your Customer (KYC) checks, report suspicious transactions, and maintain detailed records of users and transactions.

They must also cooperate with the Financial Reporting Centre (FRC) to detect and prevent money laundering, terrorism financing, and fraud.

At the same time, the law mandates clear disclosure of fees, risks, and transaction details to users.

Providers are prohibited from making misleading advertisements or promising guaranteed profits, and clients’ funds and digital assets must be held in segregated accounts and safeguarded from misuse.

Similarly, any entity planning to issue digital tokens or cryptocurrencies to the public will need CMA approval. This covers Initial Coin Offerings (ICOs), tokenized securities, and stablecoins.

The new law also requires service providers to implement robust data protection and cybersecurity standards, including encryption and secure storage of private keys.

Breaches must be reported promptly to the CMA and data authorities, as well as when the virtual assets provider becomes insolvent or there is a likelihood of it becoming insolvent.

Operating without a valid license will attract fines of up to Ksh.10 million, imprisonment for up to 10 years, or both, in the case of an individual. For a company, a fine of up to Ksh.20 million applies.

A virtual asset service provider shall maintain a registered office in Kenya, and its affairs must be managed by a board of directors with at least two directors.

The law gives the CMA powers to supervise, audit, and inspect registered entities.

“A licensee shall, where the relevant regulatory authority so requires, provide the relevant regulatory authority with online or automated real-time read-only access to both its client’s and its own virtual asset transaction records,” it states.

Failure to do this, as well as giving false disclosures to the regulator, one risks a fine of up to Ksh.30 million and up to 10 years imprisonment. Daily fines stack until compliance.

“If the offence… is a continuing offence, the individual or company is liable to a further fine not exceeding seven hundred and fifty thousand shillings, for every day, after the first day, that the offence continues after conviction,” the law adds.

It also calls for coordination among regulators, including the Central Bank of Kenya, Financial Reporting Centre, and Data Protection Commissioner, to ensure cohesive enforcement.

Cryptocurrencies like Bitcoin have continued to gain popularity globally in recent years.

The Kenyan government has painted a huge potential for the virtual assets sector, which has an estimated four million users, according to United Nations Trade and Development (UNCTAD) figures.

Additionally, a recent Central Bank of Kenya (CBK) survey shows that 31% of commercial and microfinance banks have expressed interest in virtual assets, noting the assets' potential opportunities in enhancing financial access to the unbanked.

Banks pointed out that crypto and NFTs provide alternative payment and investment channels, improving transaction speed and reducing transaction costs, CBK said.

But the lenders highlighted their fears with the risks associated with digital currencies, such as challenges in enforcing anti-money laundering, countering the financing of terrorism, and counter-proliferation financing controls.

In addition to the latest regulation, the government has sought to incentivise crypto adoption through the recently passed 2025 Finance Bill, in which the National Treasury slashed the 3% levy on digital assets trade introduced in 2023 by half to 1.5%.

The new law, borrowed from established practices from such countries as the United States and Britain, positions Kenya among African countries embracing digital asset regulation, alongside Nigeria and South Africa.