BENJAMIN ARUNDA: Kenya’s VASP Bill will legitimise crypto startups, but at a cost

For years, youth-led startups have been building blockchain-powered solutions, peer-to-peer platforms, and decentralised finance (DeFi) tools in a regulatory grey zone. While this legal ambiguity offered freedom to experiment, it also capped growth, scared off institutional partners, and kept consumer trust on shaky ground. 

The VASP Bill promises to change that by introducing a licensing regime that would, for the first time, recognise virtual asset businesses in law, granting them legitimacy and the ability to scale openly. For innovators, this is both an opportunity and a challenge; the gateway to mainstream finance comes with rules, oversight, and costs they’ve never had to shoulder before.

Yet, striking the right balance between protecting consumers and fostering innovation is proving to be the Bill’s most delicate test. As currently drafted, the legislation leans heavily toward consumer safeguards, with stringent Know Your Customer (KYC) and Know Your Transaction (KYT) requirements that cut against one of crypto’s core value propositions, anonymity. 

Add to that the annual licensing fees and compliance demands, and some fear the Bill could tilt the playing field. Still, for many in the sector, such as executives in players like Binance and Yellow Card, the Bill marks progress, a sign that regulators are maturing in their understanding of virtual assets, even if their first attempt at rulemaking feels overly cautious.

The readiness of Kenya’s financial infrastructure to integrate a legally recognized crypto economy is another open question. On paper, the country’s fintech ecosystem is agile, with adaptable infrastructure and a track record of leapfrogging traditional systems. But for banks, most of which have kept crypto at arm’s length following Central Bank of Kenya warnings, the knowledge gap is wide. 

Years of dismissing blockchain as a passing hype mean many will now have to scramble, investing heavily in consultants and training to catch up. Ironically, this hesitation could hand an advantage to fintechs that engaged early with the digital asset space, allowing them to leapfrog competitors just as the market opens.

Implementation, however, may be the Bill’s toughest hurdle. The virtual asset sector is fluid, borderless, and notoriously resistant to control. While the law would bring VASPs under formal oversight, enforcing compliance, especially among decentralized platforms and cross-border actors, will be difficult.

Subjective “fit and proper” assessments will require regulators with deep technical knowledge, and the proposed requirement for VASPs to maintain a physical office clashes with the remote-first nature of most crypto enterprises. 

The Bill also places heavy reporting obligations on VASPs while banning anonymity-enhancing services, a move likely to meet resistance from innovators for whom privacy is not a loophole but a principle.

In short, the VASP Bill represents a bold step toward mainstreaming Kenya’s crypto economy, but its success will hinge on how well lawmakers and regulators understand the culture, technology, and global realities of the space they are trying to govern.

Citizen Digital spoke to Benjamin Arunda, Africa’s first blockchain published author, chair of the Africa Blockchain Council and tech law researcher.

1. How could Kenya’s VASP Bill open new avenues for youth-led startups and fintech innovators in the digital asset sector?

The VASP Bill presents an opportunity for crypto startups to be recognised in law and be able to legitimately grow their enterprises without legal uncertainties of their status. While innovators may freely operate in an unregulated or grey area, this limits their growth. The licensing regime will bring legitimacy to the businesses and regain the trust of most consumers who, until now, still see crypto as a scam in its entirety.

2. As drafted, does the VASP Bill effectively balance consumer protection with fostering innovation, or could it end up hindering the growth of the Web3 ecosystem?

In the current form, the VASP Bill leans more towards consumer protection. This is not what we anticipated. The KYC/KYT requirements and scrutiny by the VASP Bill is so high it could diminish one of the key value propositions of crypto which is anonymity.

Additionally, annual licensing will increase compliance and operation costs making it unattractive for Web3 innovators with virtual asset elements. However, the Bill shows some progress, proof that the regulator has grown in their understanding of the sector.

3. How ready is Kenya’s financial system, spanning banks, fintechs, and regulators, to adopt and sustain a legally recognized cryptocurrency economy?

Kenya's financial ecosystem is agile, and relevant infrastructure largely adaptable. However, for traditional financial services institutions, there is a huge knowledge gap. Until now, most traditional banks see crypto as a hype that is passing away, and they have adhered to cautions from CBK to keep off, but they also kept off from learning and preparing for adoption.

I foresee most banks spending millions on crush consultancies and firefighting to align with the VAS opportunity. As most Banks play catch-up, on the flipside, fintechs that embraced this early enough will leapfrog significantly.

4. What key obstacles could hinder the implementation of the VASP Bill, particularly in enforcing compliance among decentralized platforms and cross-border cryptocurrency operators?

The VA sector is so dynamic and so difficult to regulate. The VASP Bill will have some successes, especially because it brings VAS under the ambit of the government regulators. However, there will be challenges. For instance, the Fit and Proper Assessment for licensees is quite subjective and requires the regulator to be knowledgeable in VA to make a proper judgement.

The proposal to require VASPs to maintain a physical office may also prove challenging to implement, because VASPs mostly operate remotely and may seek to dodge this requirement. The Bill relies heavily on VASPs to report to the regulatory body on its activities and prohibits anonymity-enhancing services. This may prove challenging as anonymity is at the core of most Web3 innovations.