Is a crypto-asset provider, in Kenya

Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page

• Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
• Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
• This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
• Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
• This duty is in effect now and has applied since the Act commenced on 30 May 2018; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.

Virtual Asset Service Providers Act (No. 20 of 2025), s. 25 · Read the law's page

• This binds a virtual asset service provider licensed under the Virtual Asset Service Providers Act, 2025 by the Central Bank of Kenya or the Capital Markets Authority, whichever the Act's First Schedule names for the licensed activity, for virtual asset services offered in or from Kenya (reached by declaring that you are a crypto-asset provider). A person already providing virtual asset services has one year from the Act's commencement on 4 November 2025 to comply (section 47).
• Have your chief executive officer notify the relevant regulatory authority in writing when the chief executive officer becomes aware or has reason to believe that a cyber-security incident has occurred (section 25(1)(k)).
• Within seven working days of providing that notification, furnish the relevant regulatory authority with a written report setting out the particulars of the situation and the mitigating measures you will undertake (section 25(2)).

Virtual Asset Service Providers Act (No. 20 of 2025), ss. 24(k) and 28 · Read the law's page

• This binds a virtual asset service provider licensed under the Virtual Asset Service Providers Act, 2025 by the Central Bank of Kenya or the Capital Markets Authority, whichever the Act's First Schedule names for the licensed activity, for virtual asset services offered in or from Kenya (reached by declaring that you are a crypto-asset provider). A person already providing virtual asset services has one year from the Act's commencement on 4 November 2025 to comply (section 47).
• Have appropriate and effective cyber security measures, as prescribed or as provided for under the Computer Misuse and Cybercrimes Act (section 28(1)).
• Plan for business continuity and disaster recovery in the event of an incident or a disaster (section 24(k)).

Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 18, 21, 96, 97 and 100 · Read the law's page

• This binds a licensee under the Virtual Asset Service Providers Act, 2025, that is a virtual asset service provider licensed by the Central Bank of Kenya or the Capital Markets Authority, whichever the Act's First Schedule names for the licensed activity; the Regulations apply to persons offering virtual asset services in or from Kenya, including one that actively solicits or targets local consumers or derives income from Kenya without a physical presence (regulation 4) (reached by declaring that you are a crypto-asset provider). A person already providing virtual asset services has until 4 November 2026, one year from the Act's commencement, to comply with the Act (section 47 of the Act).
• Have in place cybersecurity measures for the establishment and maintenance of appropriate systems and controls for managing cybersecurity and operational risks, with organisational, human and technological resources to prevent system and process failures, arrangements for continuity of operations if a significant process or system becomes unavailable or is destroyed, and monitoring to detect and prevent cyber incidents quickly (regulation 96(1) and (2)).
• Ensure there is a chief information security officer or the equivalent with oversight over your cybersecurity systems, maintain and distribute documentation of your internal processes and systems for managing operational and cybersecurity risk, and train all staff in cybersecurity periodically (regulation 96(3)).
• Review your cybersecurity strategy and policy at least annually and after a cybersecurity incident, and submit the results and any remedial actions to your board of directors no later than one month after the review (regulation 96(4) and (5)).
• Keep systems and controls adequate for the virtual asset services you perform, having regard to confidentiality, access by authorised persons, integrity, and maintenance of systems including code version control and updates (regulation 97(1) to (3)).
• Run vulnerability assessment, risk assessment and penetration testing of your systems on a bi-annual basis during the first year of licensing and at least once a year afterwards, and keep audit trail systems that protect the integrity of the data and hardware they record and log cybersecurity events (regulation 97(4)).
• When the relevant regulatory authority requires it, and with its approval, appoint a qualified independent party to audit your systems and controls and give the authority a written opinion that they are suitably designed and operating effectively (regulation 97(5) and (6)).
• Have a cybersecurity audit report prepared by a fit and proper person responsible for cyber security audit, covering the functionality and integrity of your electronic systems, identified cybersecurity risk, and the cybersecurity program and proposals to redress inadequacies (regulation 100).
• Develop and maintain business continuity and incident response plans approved by your board of directors, covering resources, recovery priorities, communications, critical services and recovery time objectives, and incident detection, escalation, containment and recovery; review and test them annually and make the plans or the test report available to the relevant regulatory authority (regulation 21).
• Establish and maintain technology resources so that they are secure and keep the data they contain confidential (regulation 18(2)(c)).

Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 26 and 99 · Read the law's page

• This binds a licensee under the Virtual Asset Service Providers Act, 2025, that is a virtual asset service provider licensed by the Central Bank of Kenya or the Capital Markets Authority, whichever the Act's First Schedule names for the licensed activity; the Regulations apply to persons offering virtual asset services in or from Kenya, including one that actively solicits or targets local consumers or derives income from Kenya without a physical presence (regulation 4) (reached by declaring that you are a crypto-asset provider). A person already providing virtual asset services has until 4 November 2026, one year from the Act's commencement, to comply with the Act (section 47 of the Act).
• Notify the relevant regulatory authority within twenty-four hours of discovering a cybersecurity incident that results from a cybersecurity event, which is any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse your electronic systems or the information stored on them (regulation 99(1)).
• Provide a detailed report within five working days on whether the incident affects the services or network and information systems that support your critical or important functions, affects services you are authorised to provide, or is a malicious and unauthorized access to your network and information systems, including the remedial actions to mitigate it and prevent future events (regulation 99(2) and (3)).
• Report any material cybersecurity incident, loss of keys, or unauthorised transaction within twenty-four hours (regulation 99(4)).
• By the tenth day of each calendar month, submit to the relevant regulatory authority a report on the previous month that includes material service interruptions and major security breaches (regulation 26(2)).