KenyaVirtual Asset Service Providers Regulations, Cybersecurity Systems, Controls and Continuity Plans
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a licensee under the Virtual Asset Service Providers Act, 2025, that is a virtual asset service provider licensed by the Central Bank of Kenya or the Capital Markets Authority, whichever the Act's First Schedule names for the licensed activity; the Regulations apply to persons offering virtual asset services in or from Kenya, including one that actively solicits or targets local consumers or derives income from Kenya without a physical presence (regulation 4) (reached by declaring that you are a crypto-asset provider). A person already providing virtual asset services has until , one year from the Act's commencement, to comply with the Act (section 47 of the Act).
- Have in place cybersecurity measures for the establishment and maintenance of appropriate systems and controls for managing cybersecurity and operational risks, with organisational, human and technological resources to prevent system and process failures, arrangements for continuity of operations if a significant process or system becomes unavailable or is destroyed, and monitoring to detect and prevent cyber incidents quickly (regulation 96(1) and (2)).
- Ensure there is a chief information security officer or the equivalent with oversight over your cybersecurity systems, maintain and distribute documentation of your internal processes and systems for managing operational and cybersecurity risk, and train all staff in cybersecurity periodically (regulation 96(3)).
- Review your cybersecurity strategy and policy at least annually and after a cybersecurity incident, and submit the results and any remedial actions to your board of directors no later than one month after the review (regulation 96(4) and (5)).
- Keep systems and controls adequate for the virtual asset services you perform, having regard to confidentiality, access by authorised persons, integrity, and maintenance of systems including code version control and updates (regulation 97(1) to (3)).
- Run vulnerability assessment, risk assessment and penetration testing of your systems on a bi-annual basis during the first year of licensing and at least once a year afterwards, and keep audit trail systems that protect the integrity of the data and hardware they record and log cybersecurity events (regulation 97(4)).
- When the relevant regulatory authority requires it, and with its approval, appoint a qualified independent party to audit your systems and controls and give the authority a written opinion that they are suitably designed and operating effectively (regulation 97(5) and (6)).
- Have a cybersecurity audit report prepared by a fit and proper person responsible for cyber security audit, covering the functionality and integrity of your electronic systems, identified cybersecurity risk, and the cybersecurity program and proposals to redress inadequacies (regulation 100).
- Develop and maintain business continuity and incident response plans approved by your board of directors, covering resources, recovery priorities, communications, critical services and recovery time objectives, and incident detection, escalation, containment and recovery; review and test them annually and make the plans or the test report available to the relevant regulatory authority (regulation 21).
- Establish and maintain technology resources so that they are secure and keep the data they contain confidential (regulation 18(2)(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Regulation 142(1) fixes an administrative fine for a contravention of regulation 21(5), 96(6), 97(8) or 100(2) of not more than five million shillings for a company and not more than three million shillings for an individual; the cap shown is the company figure.
- Rule
- Fixed only
- As of
- Currency
- KES
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
The relevant regulatory authority, as the Act defines it, which may suspend or revoke a licence, approval or authorisation issued under the Regulations or direct the person to take remedial action under regulation 142(2).
Settledness
- As of
- Open questions
- Does bi-annual testing in regulation 97(4) mean twice in the first year of licensing or at two-year intervals?
What this law does
Regulation 96(1) requires a licensee, pursuant to section 28(1) of the Act, to have in place cybersecurity measures for the establishment and maintenance of appropriate systems and controls for managing cybersecurity and operational risks. Regulation 96(3) requires a licensee to ensure that there is a chief information security officer or the equivalent with oversight over its cybersecurity systems.
Regulation 96(4) requires a licensee to review its cybersecurity strategy and policy regularly, and at least annually. Regulation 97(4) requires a licensee's systems and controls to include vulnerability assessment, risk assessment and penetration testing on a bi-annual basis during the first year of licensing and at least once a year for subsequent years.
Regulation 97(5) requires a licensee, subject to the approval of the relevant regulatory authority, to appoint a qualified independent party to audit its systems and control as and when the authority requires. Regulation 21 requires a licensee to develop and maintain formalised business continuity and incident response plans approved by its board of directors. Regulation 21(3) requires a licensee to annually review and test its business continuity and incident response plans.
Regulation 100 requires a cybersecurity audit report to be prepared by a fit and proper person responsible for cyber security audit. The Regulations were published in the Kenya Gazette and commenced on .
When LexLint raises it
When your app profile says your app is a crypto-asset provider.