Kenya Crypto Law Today: Running an Exchange Without a Licence Is Now a Crime — 5 Years, KSh25M Fines, and 0 Licences on the Register

Today, November 4, 2026, running a crypto exchange, wallet service or brokerage in Kenya without a licence becomes a criminal offence. The penalty is up to five years in prison for an individual and a fine of up to KSh25 million for a company. And here is the twist that makes this deadline genuinely extraordinary: as of November 2, independent checks of the public registers found no virtual-asset licences at all.

Kenya did not ban crypto. It did something subtler and, for platforms, riskier: it gave the industry a full year to get licensed, published the detailed application rules only in July 2026, and then let the clock run out. Whether regulators enforce the new line hard on day one, phase it in, or face a court challenge over the gap between the deadline and the absence of visible licences, the next few weeks will reshape how millions of Kenyans buy, sell and store digital assets. If you hold coins on any platform that serves Kenyan users, the seven checks near the end of this article are the ones that matter most.

Bitcoin is trading near $76,600 on November 4, down about 10% over the past month, so this shock lands in a fragile market. But Kenya's story is not a price story — it is a licensing story, and licensing stories decide which platforms survive and where customer funds end up.

What changed on November 4, 2026

Kenya's Virtual Asset Service Providers Act, 2025, was assented to on October 15, 2025, published in the Kenya Gazette on October 21, and commenced on November 4, 2025. Section 47 of the Act gave businesses already providing virtual asset services a one-year transition period to comply. That year expired on November 4, 2026.

From today, section 8 of the Act applies in full: no person may carry on the business of virtual asset services "in or from Kenya" without the required licence. The wording matters. It is not limited to companies incorporated in Kenya. A foreign platform that serves Kenyan users can fall inside the phrase "in or from Kenya," which is why global exchanges with Kenyan customers cannot simply ignore the deadline because their headquarters sit elsewhere.

The Act covers ten licence categories, spanning exchanges, brokers, wallet providers, payment processors, token-offering providers and stablecoin issuers. Two regulators split the job: the Central Bank of Kenya (CBK) supervises payments and stablecoin issuers, while the Capital Markets Authority (CMA) oversees exchanges, brokers and tokenisation. That split is itself a practical problem for a platform that does several of those things at once — it may need to satisfy two regulators, not one.

The implementing regulations — the Virtual Asset Service Providers Regulations, 2026, published as Legal Notice No. 134 — were only gazetted on July 22, 2026. That left existing operators roughly three and a half months between the publication of the actual application forms, fees and capital thresholds and the end of the transition period. Lawyers writing about the deadline have flagged exactly this squeeze: the Act gave a year, but the detailed rules arrived late in that year.

The penalties are not a slap on the wrist

Kenya's regime has two tracks, and confusing them is the first mistake many readers make. The administrative track lets a regulator issue warnings, order remedial action, restrict new contracts, force out a director, or suspend or revoke a licence. The criminal track is separate and far more serious.

Under section 40(3) of the Act, operating without the required licence is an offence. On conviction, a company faces a fine of up to KSh25 million. An individual faces a fine of up to KSh10 million, imprisonment of up to five years, or both. Section 41 extends liability to directors and senior officers who knowingly allowed the unlicensed operation. In other words, this is not only a corporate fine that can be budgeted for — the people running the platform carry personal criminal exposure.

Those figures are maximums, not automatic sentences, and regulators must weigh conduct after the violation and previous disciplinary history. But a criminal offence changes the calculation for any board: continuing unlicensed is no longer a compliance delay, it is a legal risk directors must personally sign off on.

Zero licences on the register: the awkward fact at the heart of the deadline

A report citing VASP Tracker stated that no VASP licence holders had been identified on the CBK and CMA public registers as of November 2, 2026. A separate independent review of the CMA's public directory found no dedicated virtual asset licensing category displayed. That does not prove that no licence has been granted anywhere — registers can lag, and applications may be in process — but it does mean the public cannot currently verify who is licensed, which is a problem for users trying to do the right thing.

The ambiguity runs deeper. The Act does not explicitly say a company whose application is still being processed is automatically protected. Some legal analysis argues section 8(2)'s wording — "unless licensed" — leans toward the stricter reading: you need the licence itself, not merely an application in flight. Others argue the intent must be looser, because regulators get thirty days to decide a complete application and the detailed rules only arrived in July. Until the CBK or CMA publishes a clear statement, platforms and users are in a grey zone the law itself created.

This is the central tension of November 4: a hard criminal deadline, a soft public record, and no published "pending applications are safe" exemption. Enforcement choices in the coming days will matter more than the statute's text, because they will show whether Kenya intends a clean break, a phased landing, or a period of forbearance while licences are processed.

The capital bar: from KSh10 million to KSh300 million

Licensing in Kenya is not just a form. The minimum paid-up capital requirements, as reported from the regulations, scale sharply with the risk of the business. Brokers, payment processors and token-offering providers need KSh10 million; exchanges need KSh100 million; wallet providers need KSh150 million; stablecoin issuers need KSh300 million.

Those thresholds, combined with daily custody reporting to the central bank, monthly proof of reserves and multi-year audited accounts in comparable regimes, explain why licensing favours larger, better-capitalised firms. Small local startups face a steep climb; large international exchanges face a different problem — deciding whether the Kenyan market justifies the compliance build at all. Some will apply, some will geo-block Kenyan users, and some will quietly wind down. All three outcomes have happened in other licensing regimes, and users usually learn about the third outcome last.

Who is covered — and who is not

The law targets businesses, not individual holders. It does not mean that every Kenyan who owns Bitcoin or Ethereum must obtain a VASP licence. If you buy crypto for yourself, hold it in your own wallet and do not offer services to others, you are not the regulated entity. The regulated entities are the platforms in the middle: the exchange that matches your trade, the wallet service that holds your keys, the broker that executes for you, the payment processor that moves your shillings into crypto.

That distinction matters for the practical advice in this article. Your risk is not that you will be prosecuted for owning crypto. Your risk is counterparty risk: if the platform you use is forced to stop, restrict withdrawals, or exit, your access to your funds can freeze even though you did nothing wrong. That is why self-custody — holding your own keys in a wallet you control — keeps coming up in every licensing crackdown, from Kenya to Brazil to Kazakhstan. Our guide to best crypto wallets for beginners in 2026 explains the hot-versus-cold wallet trade-off in plain terms, and our complete beginner's guide to buying Bitcoin covers how to move coins off an exchange safely.

Foreign platforms are the greyest area. The Act's "in or from Kenya" scope suggests a platform cannot dodge the law simply by being incorporated abroad while serving Kenyan users. But enforcement against a foreign entity with no Kenyan presence is harder, so expect the first visible effects to be local platforms pausing or restricting sign-ups, and foreign platforms updating their Kenya terms.

What most people get wrong about Kenya's deadline

Myth 1: "Kenya banned crypto." Wrong. The Act creates a licensing regime, not a prohibition. Licensed businesses can operate. The question is who gets licensed and how fast, not whether crypto is legal.

Myth 2: "If my exchange is big and global, it must be licensed." Not necessarily. Size does not equal a Kenyan licence. Check the register and the platform's own Kenya-specific announcement, not its global reputation.

Myth 3: "Applying is the same as being licensed." The Act does not explicitly say so. An application in process may or may not protect a platform after November 4. Do not assume it does.

Myth 4: "Nothing will happen on day one, so nothing will ever happen." Licensing deadlines often start quietly and bite later, through bank restrictions, payment-processor cut-offs, or enforcement against one visible platform that sets an example. Brazil's parallel deadline shows the pattern: the banking cut-off arrives days after the filing deadline, not on the same day.

Myth 5: "Moving everything to a decentralised exchange solves it." Partly. Decentralised exchanges remove one counterparty, which is why our guide to what a DEX is and how record DEX trading works is worth reading. But DEXs carry their own risks — smart-contract bugs, no customer support, and no recourse if you send funds to the wrong address — and they do not remove the need to get fiat in and out through a regulated on-ramp.

Kenya is not alone: the global licensing squeeze

Kenya's November 4 deadline is the second half of a remarkable week for crypto licensing. Brazil's central bank closed its first licensing window on October 30 with only about 40 applications from an expected 150 to 200 firms, and from November 6 Brazilian banks and payment providers are barred from serving crypto firms outside the regime. Firms that missed Brazil's deadline have about 30 days to wind down. Our full breakdown of Brazil's licensing deadline and the November 6 bank cut-off shows how a filing deadline turns into a banking deadline within days.

South Korea, meanwhile, has pushed exchanges toward higher cold-storage standards after the $6.3 billion Binance hack, and Kazakhstan has blocked major exchanges including Coinbase while approving others such as Kraken. The pattern is consistent worldwide: regulators are no longer asking whether crypto should be regulated, they are asking which firms are inside the perimeter and cutting off the banking and payment rails for everyone else. Kenya's version is stricter than most because it attaches criminal penalties to the unlicensed operation itself, not just to the loss of banking access.

For Kenyan users, the comparison cuts both ways: a licensed market should eventually be safer, but the transition is where users lose money — through frozen withdrawals, forced migrations and platforms that exit without a clear wind-down plan.

7 checks before you trust a platform with your coins after November 4

This checklist is the original, practical core of this article. Run through it for every platform where you hold funds, and do not skip a check because the platform's marketing looks professional.

1. Is it actually licensed — or just "applying"? Ask for the licence category, the regulator (CBK or CMA) and the licence number, then check the public register. "We are in the process" is not a licence.

2. Can you withdraw right now, in full? Test a small withdrawal before you need a large one. Platforms in trouble restrict withdrawals gradually — first large amounts, then all amounts, then new sign-ups.

3. Are your coins in your own wallet or on the platform's balance sheet? If the platform holds your keys, you are a creditor if it fails. Moving long-term holdings to self-custody removes that risk, but only if you protect your seed phrase properly.

4. Does the platform publish proof of reserves and custody arrangements? Licensed regimes increasingly require daily custody reporting and monthly proof of reserves. A platform that will not show either is asking you to trust it blindly.

5. What happens to Kenyan users in its terms? Read the Kenya-specific terms, not the global ones. Look for geo-blocking, forced migration to another entity, or a wind-down clause with a date.

6. Is your fiat on-ramp still working? In Brazil, the banking cut-off mattered more than the licence itself. If Kenyan banks stop serving your platform after November 4, deposits and withdrawals in shillings can stop even if crypto trading continues.

7. Do you have a second way out? Keep a verified account on a second platform and a self-custody wallet ready before you need them. The worst time to set up an alternative is during a freeze, when verification queues explode.

If a platform fails two or more of these checks, reduce your balance on it until it can answer them. That is not financial advice — it is operational hygiene, the same logic as not keeping all your cash in a single bank during a banking crisis.

What happens next: 3 scenarios for the coming weeks

Hard enforcement: regulators name unlicensed platforms, banks cut them off, some pause Kenyan operations — users should withdraw quickly from affected platforms. Phased forbearance: regulators publish a transition list and pending applicants keep operating while decisions are made — verify your platform is actually on that list. Court or policy challenge: industry groups challenge the gap between the deadline and the late regulations — uncertainty stretches for months and self-custody matters even more.

The most likely outcome, judging by Brazil and other regimes, is a mix of the first two: a public list of applicants, quiet pressure on the rest, and one or two visible enforcement actions to set the tone. Also watch the payment rails: if Kenyan banks and mobile-money providers refuse transactions for named unlicensed platforms, that bites fastest, because it needs no court case — only a list.

What to do today if you use a Kenyan crypto platform

First, do not panic-sell. A licensing deadline is not a reason to sell Bitcoin at $76,600 into a falling market. The decision is about where your coins sit, not whether crypto itself is doomed. Second, inventory your exposure: list every platform, the approximate balance, and whether you can withdraw. Third, move long-term holdings you do not need for trading into a wallet you control, and test the withdrawal with a small amount first. Fourth, keep records: screenshots of balances, transaction histories and the platform's Kenya announcements, in case a wind-down or dispute follows. Fifth, if you stake, check whether staking counts as a separate regulated service under your platform's licence — our guide to what crypto staking is and how to earn rewards explains the custody difference between staking on an exchange and staking from your own wallet.

Frequently asked questions

Is crypto banned in Kenya from November 4, 2026?

No. Kenya has not banned crypto. It now requires virtual-asset businesses to be licensed. Individuals holding crypto for themselves do not need a VASP licence.

What is the penalty for running an unlicensed crypto business in Kenya?

On conviction, a company faces a fine of up to KSh25 million. An individual faces a fine of up to KSh10 million, up to five years in prison, or both. Directors who knowingly allowed the offence can also be liable.

Are any crypto platforms licensed in Kenya yet?

As of November 2, 2026, independent checks found no VASP licence holders identified on the CBK and CMA public registers. That may reflect a lag in publication rather than zero grants, but users cannot currently verify licences from the public record alone.

Does applying for a licence protect a platform after November 4?

Not explicitly. The Act does not establish an automatic exemption for pending applications, and legal analysis is divided on whether "unless licensed" in section 8(2) allows a pending application to suffice. Platforms should not assume it does.

Which regulator licenses which crypto business in Kenya?

The Central Bank of Kenya supervises payments and stablecoin issuers. The Capital Markets Authority oversees exchanges, brokers and tokenisation. A platform doing several activities may need to satisfy both.

What should I do if my exchange freezes withdrawals?

Keep records of your balance and all communications, do not accept "refund" offers through links, messages or phone calls, and move any funds you can still access to self-custody. If the freeze persists, seek legal advice and report the platform to the relevant regulator.

Conclusion

Kenya's November 4 deadline is a test case for the whole world's approach to crypto: a one-year grace period, detailed rules published late, criminal penalties for the unlicensed, and — so far — no licences visible on the public register. If regulators enforce it cleanly and publish a clear list of who is in and who is out, Kenya could emerge with one of Africa's most credible licensed crypto markets. If enforcement is uneven, or if users discover too late that their platform was never licensed, the transition itself will do the damage.

For users, the lesson is simple: know who holds your coins, verify the licence, keep a second way out, and hold long-term funds in a wallet you control.

Sources: Dawan Africa, Crypto News Focus, Clay Law, Digital Policy Alert and Bitcoin.com on Brazil.