KenyaVirtual Asset Service Providers Act, Notice of a Cyber-Security Incident
Virtual Asset Service Providers Act (No. 20 of 2025), s. 25
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a virtual asset service provider licensed under the Virtual Asset Service Providers Act, 2025 by the Central Bank of Kenya or the Capital Markets Authority, whichever the Act's First Schedule names for the licensed activity, for virtual asset services offered in or from Kenya (reached by declaring that you are a crypto-asset provider). A person already providing virtual asset services has one year from the Act's commencement on to comply (section 47).
- Have your chief executive officer notify the relevant regulatory authority in writing when the chief executive officer becomes aware or has reason to believe that a cyber-security incident has occurred (section 25(1)(k)).
- Within seven working days of providing that notification, furnish the relevant regulatory authority with a written report setting out the particulars of the situation and the mitigating measures you will undertake (section 25(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The relevant regulatory authority under the Act, which may take administrative enforcement action against a person who violates a provision of the Act, including a formal written warning, a direction to remedy the non-compliance, and suspension or revocation of a licence.
Settledness
- As of
- Open questions
- Are the written notice under section 25(1)(k) of the Act and the twenty-four hour notice under regulation 99(1) of the Regulations one notification or two?
What this law does
Section 25(1) of the Act requires the chief executive officer of a licensee to notify the relevant regulatory authority in writing where the chief executive officer becomes aware or has reason to believe that a cyber-security incident has occurred. Section 25(2) of the Act requires the licensee to furnish the relevant regulatory authority with a written report setting out the particulars of the situation within seven working days of providing the notification.
Where a person contravenes section 25 of the Act, the relevant regulatory authority must take the enforcement action it considers necessary under section 39 of the Act. The relevant regulatory authorities under the Act are the Capital Markets Authority and the Central Bank of Kenya, together with any other public body the Cabinet Secretary designates by notice in the Kenya Gazette.
The First Schedule to the Act makes the Central Bank of Kenya the responsible authority for custodial wallet providers, payment processors and stablecoin issuance, and the Capital Markets Authority the responsible authority for exchanges, trading platforms, brokers, investment advisors, managers, offering providers and tokenization. The Act was published in the Kenya Gazette on , assented to on and commenced on .
Section 47 of the Act gives a person already providing virtual asset services one year from the commencement to comply with the Act.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.