KenyaVirtual Asset Service Providers Act, Cybersecurity Measures and Business Continuity
Virtual Asset Service Providers Act (No. 20 of 2025), ss. 24(k) and 28
In force since .
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a virtual asset service provider licensed under the Virtual Asset Service Providers Act, 2025 by the Central Bank of Kenya or the Capital Markets Authority, whichever the Act's First Schedule names for the licensed activity, for virtual asset services offered in or from Kenya (reached by declaring that you are a crypto-asset provider). A person already providing virtual asset services has one year from the Act's commencement on to comply (section 47).
- Have appropriate and effective cyber security measures, as prescribed or as provided for under the Computer Misuse and Cybercrimes Act (section 28(1)).
- Plan for business continuity and disaster recovery in the event of an incident or a disaster (section 24(k)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The relevant regulatory authority under the Act, which may take administrative enforcement action against a person who violates a provision of the Act, including a formal written warning, a direction to remedy the non-compliance, and suspension or revocation of a licence.
Settledness
- As of
- Open questions
- Which cyber security measures must a licensee meet under section 28(1) of the Act, given that it points to the prescribed measures and to the Computer Misuse and Cybercrimes Act?
What this law does
Section 28(1) of the Act requires a licensee to have appropriate and effective cyber security measures as prescribed or as provided for under the Computer Misuse and Cybercrimes Act. Section 24(k) of the Act requires every virtual asset service provider to plan for business continuity and disaster recovery in the event of an incident or a disaster.
Where a licensee contravenes section 28 of the Act, the relevant regulatory authority must take the enforcement action it considers necessary under section 39 of the Act. The relevant regulatory authorities under the Act are the Capital Markets Authority and the Central Bank of Kenya, together with any other public body the Cabinet Secretary designates by notice in the Kenya Gazette.
The First Schedule to the Act makes the Central Bank of Kenya the responsible authority for custodial wallet providers, payment processors and stablecoin issuance, and the Capital Markets Authority the responsible authority for exchanges, trading platforms, brokers, investment advisors, managers, offering providers and tokenization. The Act was published in the Kenya Gazette on , assented to on and commenced on .
Section 47 of the Act gives a person already providing virtual asset services one year from the commencement to comply with the Act.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.