The rapid growth of cryptocurrencies and other digital assets has forced governments across the world to confront a difficult regulatory challenge: how to encourage innovation while preventing financial crime and protecting consumers. The enactment of the Virtual Asset Service Providers Act, 2025 (VASP Act) represents the country’s first comprehensive attempt to regulate the digital asset ecosystem.
A particularly important feature of the Act is its integration of anti-money laundering and counter-terrorism financing (AML/CFT) obligations into the virtual asset sector. Service providers are required to comply with preventive measures, including reporting suspicious transactions, maintaining audited financial records, and cooperating with authorities investigating financial crime.
One of the main policy motivations behind the VASP Act was the growing concern that cryptocurrencies could be used for money laundering, terrorism financing, and other illicit financial activities. Before the enactment of the Act, Kenya lacked a specific legal regime governing digital asset intermediaries, leaving regulators with limited tools to supervise the sector. The absence of regulation had attracted scrutiny from international bodies such as the Financial Action Task Force (FATF), which highlighted the risks associated with unregulated digital asset markets.
Despite these positive developments, the effectiveness of the VASP Act ultimately depends on its implementation and enforcement, areas where notable gaps remain. First, the Act’s operational framework is still evolving. Although the law came into force in November 2025, the detailed regulations necessary for licensing and supervision are still being developed. As a result, regulators have not yet issued licences to virtual asset service providers. This transitional period creates a regulatory grey area in which digital asset activities may continue without full oversight.
Second, effective supervision of blockchain-based transactions requires specialized technical expertise. Regulators must develop capacity in areas such as blockchain analytics, digital custody supervision, and cyber-incident response. Without such expertise, the enforcement powers granted by the Act may prove difficult to exercise effectively.
Finally, concerns remain about the risk of regulatory capture or uneven market competition, particularly if large international exchanges dominate the licensing process while smaller local innovators struggle to meet compliance requirements. Striking the right balance between regulation and innovation will therefore be crucial to the long-term success of the framework.
The VASP Act, 2025 represents a significant step toward regulating Kenya’s rapidly expanding digital asset sector. By introducing licensing requirements, integrating AML/CFT obligations, and empowering regulators to supervise the market, the Act strengthens Kenya’s capacity to combat financial crime and protect investors. At the same time, the law’s effectiveness will depend heavily on the timely development of implementing regulations, the technical capacity of regulators, and the ability to address emerging challenges such as decentralized finance.
Ultimately, the VASP Act reflects a broader reality of financial regulation in the digital age: the law can establish the framework, but its success depends on how effectively it adapts to a technology that evolves far faster than legislation itself. The real question, therefore, is not whether Kenya has taken the right first step, but whether its regulatory system can keep pace with the rapidly changing world of virtual assets.