KenyaVirtual Asset Service Providers Regulations, Reporting of Cybersecurity Incidents
Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 26 and 99
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a licensee under the Virtual Asset Service Providers Act, 2025, that is a virtual asset service provider licensed by the Central Bank of Kenya or the Capital Markets Authority, whichever the Act's First Schedule names for the licensed activity; the Regulations apply to persons offering virtual asset services in or from Kenya, including one that actively solicits or targets local consumers or derives income from Kenya without a physical presence (regulation 4) (reached by declaring that you are a crypto-asset provider). A person already providing virtual asset services has until , one year from the Act's commencement, to comply with the Act (section 47 of the Act).
- Notify the relevant regulatory authority within twenty-four hours of discovering a cybersecurity incident that results from a cybersecurity event, which is any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse your electronic systems or the information stored on them (regulation 99(1)).
- Provide a detailed report within five working days on whether the incident affects the services or network and information systems that support your critical or important functions, affects services you are authorised to provide, or is a malicious and unauthorized access to your network and information systems, including the remedial actions to mitigate it and prevent future events (regulation 99(2) and (3)).
- Report any material cybersecurity incident, loss of keys, or unauthorised transaction within twenty-four hours (regulation 99(4)).
- By the tenth day of each calendar month, submit to the relevant regulatory authority a report on the previous month that includes material service interruptions and major security breaches (regulation 26(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The relevant regulatory authority, as the Act defines it, which may suspend or revoke a licence, approval or authorisation issued under the Regulations or direct the person to take remedial action under regulation 142(2).
Settledness
- As of
- Open questions
- To whom is a material cybersecurity incident, loss of keys or unauthorised transaction reported under regulation 99(4), and how does that report relate to the notice under regulation 99(1)?
What this law does
Regulation 99(1) requires a licensee that discovers a cybersecurity incident as a result of a cybersecurity event to notify the relevant regulatory authority within twenty-four hours of such discovery.
Regulation 99(2) requires the licensee to provide a detailed report within five working days on whether the cybersecurity incident affects services or systems supporting critical or important functions, affects services it is authorised to provide, or constitutes malicious and unauthorized access to its network and information systems. Regulation 99(4) requires a licensee to report any material cybersecurity incident, loss of keys, or unauthorised transaction within twenty-four hours.
Regulation 26(2) requires a licensee to submit to the relevant regulatory authority, monthly and by the tenth day of the following calendar month, a report that includes material service interruptions and major security breaches.
The Regulations define a cybersecurity incident as an occurrence that jeopardizes without lawful authority the integrity, confidentiality, or availability of information or an information system, or that constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use of policies. The Regulations were published in the Kenya Gazette and commenced on .
When LexLint raises it
When your app profile says your app is a crypto-asset provider.