The Virtual Asset Service Providers Regulations 2026

SPECIAL ISSUE 4253 Kenya Gazette Supplement No. 185 22nd July, 2026 (Legislative Supplement No. 103) LEGAL NOTICE NO. 134 THE VIRTUAL ASSET SERVICE PROVIDERS ACT (No.20 of 2025) THE VIRTUAL ASSET SERVICE PROVIDERS REGULATIONS, 2026 ARRANGEMENT OF REGULATIONS Regulation PART I –PRELIMINARY 1—Citation. 2—Interpretation. 3—Objects and purpose of these Regulations. 4—Application of these Regulations. 5—Fees payable. PART II—LICENSING AND AUTHORIZATION REQUIREMENTS 6—Application for a licence. 7—Issuance of licence. 8—Commencement of virtual asset business. 9—Alteration of facts disclosed in application. 10—Grounds for rejection of an application. 11—Renewal of licence. 12—False and misleading statements. 13—Assignment and transfer of licence. 14—Authorisation for conversion of virtual assets. 15—Renewal of authorisation. 16—Revocation of authorisation PART III —PROVISIONS ON ONGOING REQUIREMENTS 17—Ongoing obligations. 18—Human and technology resources. 19—Virtual asset business to establish proper markets.

4254 Kenya Subsidiary Legislation, 2026 20—Business and default rules. 21—Business continuity and incident response plans. 22—Transaction information. 23—Disclosure of information by employees. 24—Disclosure of information to consumers. 25—Consumer information. 26—Record keeping and submission of reports. 27—Provision of information required by the relevant regulatory authority. 28—Register of interests. 29—Ownership changes. 30—Conflict of interest. 31—Information at point of service. 32—Performance of customer due diligence prior to onboarding. 33—Performance of due diligence before admission for trading. 34—Transaction confirmation. 35—Fair allocation. 36—Timely allocation. 37—Off-market transactions. 38—Inspections and investigation. 39—Compliance officer. 40—Risk management. PART IV—CORPORATE GOVERNANCE REQUIREMENTS 41—Governance arrangements. 42—Board of directors. 43—Role of the board of directors. 44—Chief executive officer 45—Finance officers and internal auditors. PART V — INTERVENTION AND STATUTORY MANAGEMENT 46—Intervention in management. 47—Statutory management upon suspension or revocation. 48—Functions and powers of a statutory manager under regulation. PART VI—REQUIREMENTS FOR OFFER OF INITIAL COIN OFFERINGS AND LISTINGS FOR VIRTUAL ASSET EXCHANGES 49—Application for approval to issue initial coin offering. 50—Determination of the application. 51—Approval of promoter. 52—Approval of trading platforms.

Kenya Subsidiary Legislation, 2026 4255 53—Validity of approval for offer of initial coin offering. 54—Publication of white paper for an initial coin offering. 55—Modification of published white paper for an initial coin offering. 56—Commencement and duration of advertising. 57—Extension of issuance. 58—Change of promoter. 59—Register. 60—Listing requirements for virtual asset exchanges and token issuance platform. PART VII— PROVISIONS RELATING TO TOKENIZATION OF REAL-WORLD ASSETS 61—Application for virtual asset tokenization licence. 62—Requirements relating to issuance of tokenised real-world assets. 63—Contents of white paper for offering of tokenized real-world asset. 64—Modification of white paper for an offering of tokenized real￾world asset. 65—Listing of tokenized assets. PART VIII— PROVISIONS RELATING TO VIRTUAL ASSET WALLET PROVIDERS AND ISSUERS OF STABLECOIN 66—Responsibilities of a virtual asset wallet provider. 67—Application for a stablecoins issuance licence. 68—Contents of a stablecoin white paper. 69—Publication of the virtual asset white paper for stablecoins. 70—Requirements for the offer to the public or admission to trading of stablecoin. 71— Issuance and redeemability of stablecoins 72—Prohibition of granting interest. 73—Modification of published virtual asset white papers 74—Liability of issuers of stablecoins for the information given in a stablecoin white paper. 75—Stablecoin reserve assets. 76—Custody of reserve assets. 77—Investment of funds received in exchange for stablecoin 78—Ongoing information to holders of stablecoins.

4256 Kenya Subsidiary Legislation, 2026 79—Identification, prevention, management and disclosure of conflicts of interest. 80—Redemption of stablecoins 81—Marketing and communication of stablecoin issuance. 82—Audits, review and reports. 83—Delisting or halting of stablecoin issuance. 84—Stablecoin issuers reporting requirements. PART IX— CAPITAL AND FINANCIAL REQUIREMENTS 85—Minimum financial and capital requirements. 86—Misrepresentation of capital position 87—Role of virtual asset manager in relation to capital position and use of funds. 88—Insurance coverage. 89—Accounting records. 90—Appointment of an external auditor. 91—Auditor’s report. 92—Reports by the licensee. 93—Reports by virtual asset exchange and token issuance platform provider. 94—Reports by virtual asset managers. 95—Financial year. PART X — CYBERSECURITY MEASURES AND SYSTEMS AND CONTROL 96—Cybersecurity strategy. 97—Systems and control. 98—Cybersecurity audit. 99—Reporting of cybersecurity risk. 100—Cybersecurity audit report. PART XI — SAFEKEEPING AND MANAGEMENT OF CONSUMER’S ASSETS 101—Safeguarding of consumer’s assets strategy. 102—Consumer protection. 103—Consumer service agreement. 104—Management and safe-keeping of consumer’s funds and assets. 105—Systems and controls to safe- keep consumer assets.

Kenya Subsidiary Legislation, 2026 4257 106—Protection from third party claims. 107—Records and accounts. PART XII — MARKET CONDUCT AND RELATED OFFENCES 108—Standards of conduct. 109—Consumers’ understanding of risk. 110—Addressing complaints by consumers. 111—Consumer care system. 112—Deterrence of market abuse. 113—Outsourcing agreements. Market conduct offences 114—Disclosure of insider information. 115—Market manipulation. 116—False trading and market rigging. 117—Fraudulently inducing trading in virtual assets. 118—Use of manipulative devices. 119—False or misleading statements inducing virtual assets transactions. 120—Front-running. 121—Churning. 122—Cold Calling. PART XIII — ADVERTISEMENTS AND PROMOTIONS OF VIRTUAL ASSETS AND PRODUCTS 123—Prohibition. 124—General requirements for advertisement. 125—Content of advertisement. 126—Performance information. 127—Fees, costs and commissions. 128—Risks and warning disclosures. 129—Duty of a person making advertisement. 130—Duties of third parties making advertisements. 131—Internet advertisement. 132—Prohibited internet advertising and marketing practices. 133—Record keeping. PART XIV — FREEZING AND SEIZURE ORDERS 134—Freezing and seizure of virtual assets.

4258 Kenya Subsidiary Legislation, 2026 135—General obligations of licensee relating to freezing and seizure orders. 136—Freezing orders: Obligations of licensee. 137—Seizure orders: obligations to licensee. 138—Preservation of value. 139—Custody and management of seized virtual assets. 140—Protection of uninvolved consumers. 141—Offence of failure to comply. PART XV— ENFORCEMENT ACTIONS AND GENERAL PROVISIONS 142—Administrative sanctions. 143—Criminal sanctions. 144—Recovery of penalties. 145—Establishment of the Forum. 146—Mandate of the Forum. 147—Conduct of business of the Forum. 148—Notice to penalise. 149—Voluntary liquidation. 150—Involuntary liquidation. 151—Appeals. FIRST SCHEDULE Fees payable SECOND SCHEDULE Forms THIRD SCHEDULE Contents of a business plan FOURTH SCHEDULE Fit and proper assesement FIFTH SCHEDULE Capital and liquidity requirements SIXTH SCHEDULE Membership of the Coordination Forum

Kenya Subsidiary Legislation, 2026 4259 THE VIRTUAL ASSET SERVICE PROVIDERS ACT (No. 20 of 2025) IN EXERCISE of the powers conferred by section 49 of the Virtual Asset Service Providers Act, the Cabinet Secretary for the National Treasury, on the advice of the relevant regulatory authorities makes the following Regulations — THE VIRTUAL ASSET SERVICE PROVIDERS REGULATIONS, 2026 PART 1—PRELIMINARY

1. These Regulations may be cited as the Virtual Asset Service Providers Regulations, 2026. Citation.
2. In these Regulations, unless the context otherwise requires— Interpretation. “Act” means the Virtual Asset Service Providers Act; No. 20 of 2025. “advertisement” means a representation for the purposes of directly or indirectly promoting virtual assets and virtual asset services through any medium and in any form; “AML/CFT/CPF” has the meaning assigned to it under section 2 of the Act; “authorised officer” means— (a) a police officer; (b) officer of an investigating authority; (c) any other officer, employee or agent of a competent authority who is appointed to perform any specific function, duty, or exercise any power conferred upon an authorised officer under these Regulations or any written law; “consumer” means a person who uses, has used, or intends to use directly or indirectly any of the products or services provided by a virtual asset service provider; “consumer assets” means any virtual assets owned by a consumer, including stablecoin; “core capital” means issued and fully paid-up ordinary share capital and disclosed reserves; “cybersecurity” means an approach or series of steps to prevent or manage the risk of damage to, unauthorized use of, exploitation of and, as needed, to restore electronic information and communications systems, and the information they contain, in order to strengthen the confidentiality, integrity, and availability of these systems; “cybersecurity event” means any act or attempt, successful or unsuccessful, to gain unauthorized access to disrupt, or misuse the electronic systems or information stored on such systems; “cybersecurity incident” means an occurrence that—

4260 Kenya Subsidiary Legislation, 2026 (a) jeopardizes without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (b) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use of policies; “cybersecurity risk” means the risk of financial loss, operational disruption or damage from the failure of the digital technologies employed for informational or operational functions introduced to an information system via electronic means from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system; “fiat currency” has the meaning assigned to it under section 2 of the Act; “fiat-referenced stablecoin” means a type of virtual asset that is designed to maintain a stable value by being pegged to a fiat currency; “forks” means changes to the software on which a distributed ledger technology protocol operates; “freezing order” means an order issued by a competent court or other lawful authority directing a virtual asset service provider to prohibit any dealing, transfer, conversion, withdrawal or disposal of a specified virtual asset; “liquid capital” means the amount which the liquid assets of a licensee exceed its liabilities; “liquid assets” means a resource or asset that can be readily converted into cash without experiencing a significant or no loss in value; “paid-up capital” means issued and fully paid-up ordinary shares paid by shareholders of the company; “promoter” has the meaning assigned to it under section 2 of the Act; “real-world asset” means a tangible or intangible asset representing existing forms of wealth which can be tokenized and brought into the blockchain ecosystem; “relevant regulatory authority” has the meaning assigned to it under section 2 of the Act; “reserve asset” means an asset that is held by a licensee to back the value of its stablecoin issued and held strictly for discharging liabilities arising from the issuance of stablecoin; “seizure order” means an order issued by a competent court or other lawful authority directing the taking of possession or control of specified virtual assets for purposes of preservation or forfeiture; “significant shareholder” means a person including a beneficial owner, other than the Government or public body, who holds, directly

Kenya Subsidiary Legislation, 2026 4261 or indirectly, or otherwise has a beneficial interest amounting to more than ten percent of the share capital of a company; “stablecoin” has the meaning assigned to it under section 2 of the Act; “shareholders funds” means the net worth of a company, calculated as total assets minus total liabilities; “tokenization” or “tokenize” means the process of converting real-world assets into digital tokens on a distributed ledger technology; “virtual assets” has the meaning assigned to it under section 2 of the Act; and “white paper” means a disclosure document published by or on behalf of a virtual asset offering provider prior to the offer, issue, or admission to trading of a virtual asset, containing such information as specified in these Regulations. 3. The object and purpose of these Regulations is to provide— Objects and purpose of these Regulations. (a) a framework for the licensing and regulation of persons offering virtual asset services in Kenya; (b) for the regulation of advertisements and promotions of virtual assets by licensed persons; (c) for the financial and capital requirements for the various types of virtual asset service providers; and (d) for the implementation of freezing and seizure orders of virtual assets. 4. (1) These Regulations shall apply to persons offering virtual asset services in or from Kenya. Application of the Regulations. (2) For purposes of subregulation (1), a person is deemed to be operating “in or from Kenya” where that person actively solicits or targets local consumers, or derives an economic benefit or income from Kenya, regardless of whether the person has physical presence in Kenya or not. 5. (1) The fees payable under these Regulations shall be as set out in the First Schedule to these Regulations. Fees payable. (2) The withdrawal of any application lodged under these Regulations shall result in the forfeiture of the application fee. PART II—LICENSING AND AUTHORIZATION REQUIREMENTS 6. (1) An application for a licence to offer one or more of the permissible activities under section 10(1) of the Act shall be made in the form set out in the Second Schedule. Application for a licence. (2) An application for a licence under subregulation (1) shall be accompanied by— (a) the personal details, qualifications, experience, business interests and occupation of the applicant’s—

4262 Kenya Subsidiary Legislation, 2026 (i) directors; (ii) senior officers; (iii) significant shareholders; (iv) beneficial owners; (b) a business plan prepared in accordance with the Third Schedule to these Regulations; (c) a duly filled fit and proper assessment form as provided for in the Fourth Schedule to these Regulations; (d) proof of source of funds; (e) a description of the systems and controls of the proposed virtual asset business; (f) the operational policies that shall guide the applicant’s activities, including— (i) the risk management policies; (ii) the AML/CFT/CPF policies; (iii) the data protection and privacy policy; (iv) the cybersecurity and information technology policy; (v) the complaints management policy; (vi) the market conduct policy; (vii) the consumer protection policy; (viii) the conflict of interest policy; (ix) a business continuity and disaster recovery plan; (g) copies of contracts and any arrangements for oversight of activities; (h) evidence of the paid-up capital and liquid capital at the amount specified in the Fifth Schedule; (i) the audited financial statements for three years prior to the submission of the application or in the case of a newly incorporated applicant the opening financial statements verified by an auditor, as applicable; (j) where the applicant is a subsidiary of a foreign incorporated parent entity, the audited consolidated financial statements of the parent entity for three years prior to the submission of the application; (k) evidence of the existence of human and technology resources as required under regulation 18; (l) an independent information systems audit report, including a vulnerability assessment and penetration test, prepared by a person who holds the relevant qualifications and competences; (m) full disclosure of cross-border operations, affiliates, and regulatory status in other jurisdictions;

Kenya Subsidiary Legislation, 2026 4263 (n) in the case of virtual asset exchange, token issuance platforms, virtual asset offerings and virtual asset wallet providers, the business rules of the applicant prepared in accordance with regulation 20; (o) evidence of the existence of systems and controls to maintain market integrity, including the avoidance of market abuse; (p) the class of virtual assets intended to be traded or available for subscription; (q) the details of the applicant’s principal business address and website; (r) a certified copy of the certificate of incorporation of the applicant; (s) up-to-date details of the directors and shareholders of the applicant issued by the Registrar of Companies; (t) a copy of the register of beneficial owners prepared and issued by the Registrar of Companies; and (u) proof of payment of the application fee specified in the First Schedule to these Regulations. (3) An applicant shall, upon the request of the relevant regulatory authority, participate in an interview, to obtain further information concerning its application or supporting information and records. (4) Within thirty days of receipt of all documents and information required under subregulation (2) and completion of due diligence on the applicant, the relevant regulatory authority shall determine the application and notify the applicant of its decision thereof. (5) The relevant regulatory authority may grant a licence to an applicant to offer more than one permissible activity where the relevant regulatory authority determines that such activities— (a) constitute distinct lines of business with independent risk profiles, infrastructure or operational control; (b) share common infrastructure, risk profiles or operational control. 7. Where an applicant meets the requirements of section 11 of the Act, the relevant regulatory authority may issue the applicant with a virtual asset service providers licence upon payment of licence fees specified under the First Schedule. Issuance of licence. 8. Upon grant of a licence under these Regulations, a licensee shall commence its virtual asset business within twelve months of the date of grant of the licence. Commencement of virtual asset business. 9. (1) An applicant for a licence under regulation 6 shall, within two days of the change, give written notice to the relevant regulatory authority of— Alteration of facts disclosed in application.

4264 Kenya Subsidiary Legislation, 2026 (a) any proposed alteration to the information in the original application; or (b) the occurrence of any material event that affects or may affect information provided to the relevant regulatory authority, in the application. (2) For purposes of subregulation (1)(b), “material event” includes— (a) failure or material degradation of a proposed critical third￾party service provider; (b) any litigation or dispute resolution activity undertaken or affecting the applicant; (c) insolvency, a material liquidity shortfall or credible threat to solvency; (d) an enforcement action, criminal investigation or sanction that affects the applicant; (e) a cybersecurity incident; (f) any intended change in ownership and actual change or control that is material to the applicant; (g) any change in business model, senior officers or risk profile; or (h) an action or incident that directly or indirectly affects the general business operations of the applicant. 10. The relevant regulatory authority may reject an application for a licence where— Grounds for rejection of an application. (a) the applicant fails to respond to requests for clarification or further information from the relevant regulatory authority concerning its application or any of the supporting information or records; (b) the applicant fails to comply with a request to participate in an interview made under regulation 6(3); (c) the applicant’s directors, senior officers or beneficial owners fail to meet the fit and proper criteria set out in section 18 of the Act; (d) the applicant has a record of regulatory breaches or non￾compliance with prudential, AML/CFT/CPF or other regulatory requirements, either in Kenya or other jurisdiction, in which the applicant is or has been licensed as a virtual asset service provider; or (e) the approval of the application poses a risk to the stability of the financial system. 11. (1) A licence granted under regulation 7 may, on expiry, be renewed on an annual basis. Renewal of licence.

Kenya Subsidiary Legislation, 2026 4265 (2) An application for the renewal of a licence shall be lodged with the relevant regulatory authority at least two months prior to the expiry of the licence. (3) An application for renewal of a licence shall be— (a) in the form set out in the Second Schedule to these Regulations; and (b) accompanied by the renewal fee set out in the First Schedule to these Regulations. 12. (1) A person shall not, in connection with an application submitted to the relevant regulatory authority for grant or renewal of a licence under these Regulations— False and misleading statements. (a) make a statement to the relevant regulatory authority which he or she knows or ought reasonably to know is false or misleading; or (b) omit to state any matter to the relevant regulatory authority where he or she knows or ought reasonably to know that, because of the omission, the application is misleading. (2) Any person who contravenes the provisions of subregulation (1) commits an offence and is liable, upon conviction, to a penalty specified in regulation 143. 13. (1) A licensee seeking to assign or transfer a licence issued under these Regulations shall, in writing and on payment of the fee set out in the First Schedule, make an application to the relevant regulatory authority for the assignment or transfer of the licence. Assignment and transfer of licence. (2) An application under subregulation (1) shall only be considered if the licensee— (a) has commenced virtual asset business and operated in accordance with any conditions imposed on the licence; (b) held the licence for a minimum period of thirty-six months from the date of commencement of business; and (c) has fully complied with provisions of these Regulations. (3) In determining an application for transfer or assignment of a licence under this regulation, the relevant regulatory authority shall consider whether— (a) the transferee meets all requirements for licensing under the Act and these Regulations; (b) the applicant has paid all outstanding fees and penalties, if any, relating to the licence; (c) the applicant has any outstanding non-compliance matters; (d) the transfer is necessary in the best interest of the business, its consumers or financial stability. (4) An assignment or transfer of a licence effected without the approval of the relevant regulatory authority under this regulation shall be void and constitute grounds for the revocation of the licence.

4266 Kenya Subsidiary Legislation, 2026 14. (1) A person seeking to transact the business of conversion of virtual assets to or from foreign currency shall, before commencing such conversion business, apply to the Central Bank of Kenya for authorisation. Authorisation for conversion of virtual assets. (2) An application under subregulation (1) shall be made in writing to the Central Bank of Kenya. (3) In considering an application under subregulation (1), the Central Bank of Kenya shall take into consideration the financial condition and history of the applicant. (4) Within ten days of making a determination of an application under this regulation, the Central Bank of Kenya shall notify the applicant of its decision. (5) An authorisation issued under this regulation shall, unless earlier revoked, be valid from the date it is issued and shall expire on the 31st December of the year it is issued. (6) A person who undertakes conversion business under sub regulation (1) without the authorisation of the Central Bank of Kenya shall be liable to the administrative sanction specified in regulation 142. 15. (1) An authorisation granted under regulation 14 may, on expiry, be renewed on an annual basis. Renewal of authorisation. (2) An application for the renewal of an authorization shall be lodged with the Central Bank of Kenya at least two months prior to the expiry of the authorisation. (3) An application for renewal under subregulation (1) shall be made in writing and determined in accordance with regulation 14. 16. (1) The Central Bank of Kenya may, by notice in writing, revoke or suspend an authorisation granted under regulation 14, if the authorised person— Revocation of authorisation. (a) ceases to carry on business in Kenya or goes into liquidation or is wound up, or is otherwise dissolved; (b) fails to comply with the provisions of these Regulations or any condition attached to an authorisation; or (c) conducts business in a manner that poses a risk to the stability of the financial system. (2) Before revoking or suspending an authorization under this regulation, the Central Bank of Kenya shall give an authorized person, at least fourteen days’ notice and shall consider any representations made to it in writing by the authorised person. PART III —PROVISIONS ON ONGOING REQUIREMENTS 17. (1) Every licensee shall ensure that its virtual asset services are conducted in a fair, transparent and efficient manner for the purpose Ongoing obligations.

Kenya Subsidiary Legislation, 2026 4267 of reducing any systemic or any other type of risk that may adversely affect fair and orderly provision of virtual asset services. (2) A licensee shall, in writing, submit to the relevant regulatory authority a report addressing matters affecting the virtual assets business. (3) The report referred to in subregulation (2) may include— (a) ongoing compliance by the licensee with the terms of the licence; (b) complaints received and resolutions reached; (c) disciplinary matters arising and dealt with; (d) the adequacy and performance of systems and controls; and (e) the financial matters concerning the operation of the virtual asset business. 18. (1) A licensee shall have sufficient human and technology resources to operate a virtual asset business. Human and technology resources. (2) For purposes of subregulation (1), a licensee shall— (a) employ fit and proper staff, appropriately trained for the duties to be performed; (b) appoint a management team with adequate levels of experience and expertise to supervise and monitor the operations of the virtual asset business; (c) establish and maintain technology resources in such a way as to ensure that they are secure and maintain the confidentiality of the data they contain; and (d) maintain details of systems and associated technologies adopted by the applicant. 19. A virtual asset service provider shall establish and operate proper markets that are conducive to the economic good of the country and that do not cause or promote financial instability. Virtual asset service provider to establish proper markets. 20. (1) A licensee dealing in virtual asset exchange shall have clear and fair business rules which are— Business and default rules. (a) legally enforceable by consumers; and (b) published and made freely available. (2) A licensee shall develop and maintain compliance procedures to ensure that— (a) the business rules in subregulation (1) are enforced; (b) the complaints relating to its virtual asset services and appeal procedures are available; (c) where appropriate, a disciplinary action resulting in financial and other types of penalties is available; and

4268 Kenya Subsidiary Legislation, 2026 (d) the procedure for detecting, preventing and reporting any form of market abuse is available. (3) The business rules under subregulation (1) shall be approved by the relevant regulatory authority. (4) The business rules in subregulation (1) shall specify the class of virtual assets traded on or available for subscription, and requirements relating to— (a) a licensee’s financial reporting including how regular reports are made and the applicable accounting standards; (b) the auditing standards; (c) the licencee’s track record in terms of profit or operating history; and (d) any restrictions that may exist on transferability for a virtual asset. (5) A virtual asset exchange or token issuance platform provider shall develop default rules which in the event of a purchaser or consumer being or appearing to be unable to fulfil its obligations in respect of one or more contracts, enables action to be taken with respect to unsettled virtual asset transactions to which the consumer is a party. (6) A virtual asset exchange or token issuance platform shall develop and submit to the relevant regulatory authority, business rules containing provisions relating to— (a) methods of access to its platform; (b) hours of operation, exchange availability and interruptions; (c) admission, suspension or delisting of virtual assets from trading on the exchange or platform; (d) the conditions governing dealings in virtual assets and investor protection measures; (e) asset custody arrangements; (f) prompt and real-time disclosure to all investors of material information; (g) order submission procedures, order minimums and order types; (h) market data, pre and post trade transparency; (i) prevention of market abuse and other prohibited conduct; (j) investigation into trading in virtual asset transactions and for conducting inspections; (k) suspension of trading for the protection of investors or for the conduct of orderly and fair trading; (l) the conduct of virtual assets trading and the form in which information relating to transactions is to be maintained and reported to the virtual asset exchange;

Kenya Subsidiary Legislation, 2026 4269 (m) dispute resolution mechanisms; (n) trading fees chargeable; (o) requirements on funding of accounts; (p) order matching and order matching priorities; (q) trade settlement and confirmation; (r) deposit and withdrawal procedures; and (s) the manner of undertaking due diligence in line with regulation 33(2) of these Regulations. 21. (1) A licensee shall develop and maintain formalised business continuity and incident response plans as approved by its board of directors. Business continuity and incident response plans. (2) The plans under subregulation (1) shall outline— (a) the resource requirements such as people, systems and other assets, and arrangements for obtaining these resources; (b) the recovery priorities for the licensee' operations; (c) communication arrangements for internal and external concerned parties; (d) identification of critical services, recovery time objectives and backup arrangements; and (e) maintaining of an incident response plan on detection, escalation, containment, recovery, and coordination. (3) A licensee shall annually review and test its business continuity and incident response plans to ensure that it is up-to-date. (4) A licensee shall make available its business continuity and incident response plans or its report depicting the results of its business continuity testing to the relevant regulatory authority. (5) Where a person contravenes the requirement of this regulation, the relevant regulatory authority shall impose the administrative penalty specified in regulation 142. 22. (1) Pursuant to section 44 of the Act, a licensee shall— Transaction information. (a) record the activity and transactions effected on or through its distributed ledger technology platform; (b) maintain the activity and transaction records for at least seven years; and (c) provide the relevant regulatory authority or any competent authority with such records, in a timely manner, as the relevant regulatory authority or competent authority may require. (2) The information referred to under subregulation (1) shall include technical and contextual metadata on transactions including wallet addresses, network or chain identifiers and interaction logs.

4270 Kenya Subsidiary Legislation, 2026 23. A licensee shall have appropriate procedures and protection measures for allowing employees to disclose any information to the relevant regulatory authority, competent authorities or comparable bodies involved in the prevention of market abuse, financial crime, money laundering, terrorism financing or proliferation financing. Disclosure of information by employees. 24. (1) A licensee shall make the following disclosures to its consumers in a clear and non-technical language prior to engaging in any transaction or providing any service— Disclosure of information to consumers. (a) full details of the current licence status, including the specific categories of virtual asset services for which it is licenced by the relevant regulatory authority; (b) the full legal name, physical address of the principal office in Kenya and their contact information; (c) a clear and up-to-date disclosure of any actual conflicts of interest from the licensee’s activities including a description of the mechanisms employed to identify, manage, or mitigate such conflicts; (d) a publicly accessible policy outlining the procedure for handling consumer complaints, including the maximum response time and the escalation path to the relevant regulatory authority; (e) an accurate description of the nature of virtual asset services offered, features, characteristics and limitations; (f) a comprehensive statement of the risks associated with the virtual asset and the services provided, including the market volatility, technology and cybersecurity risks associated with the investment; (g) any applicable fees, commissions or other charges in the provision of their services and the timing of payment for the fees; (h) the procedures for withdrawals, suspension and cancellation of transactions; (i) the security protocols employed for transaction execution, consumer authentication, and data protection; (j) the measures in place to ensure business continuity and recovery in the event of a system failure or cyber incident; and (k) any changes in business operations, ownership, management, terms of service or rates and charges. (2) In furtherance to subregulation (1), a licensee shall not, in any written communication or agreement, exclude or restrict— (a) any duty or liability to a consumer which it has under any law or under any regulations made by the relevant regulatory authority;

Kenya Subsidiary Legislation, 2026 4271 (b) any liability owed to a consumer for failure to exercise the degree of skill, care and diligence that may reasonably be expected of it in the provision of the service of a regulated activity; (c) any duty to act with skill, care and diligence that is owed to a consumer in connection with the provision to him of her of the service of a regulated activity. (3) A licensee may not charge the consumer for fulfilment of its disclosure and information obligations under these Regulations. 25. (1) A licensee shall seek information about the consumer and the consumer’s circumstances to ensure that the services provided are consistent with those circumstances. Consumer information. (2) Notwithstanding the generality of subregulation (1), a licensee shall — (a) when recommending investments to a consumer or where it has discretion to act on behalf of a consumer, take and document reasonable steps to the effect that the recommendation or discretionary action is suitable for the consumer, taking account of all the available alternatives; (b) not recommend, or where the licensee has discretion to act on behalf of a consumer, execute any sale or purchase that is unsuitable for the consumer. (3) A licensee shall ensure that it does not advice or effect a transaction, on behalf of a consumer, unless the advice or transaction is suitable for the consumer based on the facts disclosed by the consumer and any other relevant fact about the consumer that the licensee is or ought to be reasonably aware of. 26. (1) A licensee shall use systems which are able to provide an accurate and fully accessible audit trail of all transactions. Record keeping and submission of reports. (2) A licensee shall, on a monthly basis and by the tenth day of the following calendar month, submit reports to the relevant regulatory authority information regarding— (a) the volumes, values and geographic distribution of each virtual asset transfer or payment offered by it; (b) incidents of fraud, theft or robbery; (c) material service interruptions and major security breaches; (d) complaints reported, including remedial measures taken, those resolved and those outstanding. (3) Unless otherwise provided, the records kept under this regulation shall be retained and securely stored for a period of not less than seven years beginning from the date the transaction occurred.

4272 Kenya Subsidiary Legislation, 2026 27. The relevant regulatory authority may— Provision of information required by the relevant regulatory authority. (a) require an officer of the licensee to produce or furnish to the relevant regulatory authority or officer making an examination— (i) the books of accounts and documents in the custody or power of the licensee; (ii) statements or information relating to the affairs of licensee as may be required by the examining officer; (b) by notice, require a licensee to provide information to the relevant regulatory authority for the purposes of assessing compliance with these Regulations; (c) at any time, enter any premises where a licensee is carrying on business, or any premises where the relevant regulatory authority reasonably suspects that any business is carried out in contravention of these Regulations. 28. (1) A licensee shall maintain a register of interests disclosing any holdings, directorships, or beneficial interests of directors, senior officers, or associated parties in any virtual asset service provider. Register of interests. (2) The register shall be reviewed at least annually and made available to the relevant regulatory authority upon request. 29. (1) Pursuant to section 27 of the Act, where a person desires to directly or indirectly acquire, transfer or dispose— Ownership changes. (a) not more than ten percent of shares or an interest in a licensee, that person shall, in writing, notify the relevant regulatory authority prior to such acquisition, transfer or disposal; or (b) more than ten percent of shares or an interest in a licensee, that person shall seek the approval of the relevant regulatory authority of such acquisition, transfer or disposal. (2) An application under subregulation (1)(b) shall be made in writing and accompanied by the fees specified in the First Schedule and include such information as is necessary to enable the relevant regulatory authority to consider the proposed acquisition, transfer or disposal in relation to— (a) the nature of the proposed acquisition, disposal or transfer; (b) the identity of the proposed acquirer or acquiree and any person who has control or management of the proposed acquirer; (c) how the proposed acquisition, transfer or disposal is to be financed.

Kenya Subsidiary Legislation, 2026 4273 (3) In assessing a proposed acquisition, transfer or disposal, the relevant regulatory authority shall have regard to— (a) the suitability and character of the proposed acquirer; (b) the ability of the proposed acquirer to conduct the business of the licensee in the long term; (c) the reputation, knowledge, skills and experience of any person who will direct the business of the licensee as a result of the proposed acquisition, transfer or disposal; (d) the fitness and probity of any new directors, significant shareholders and senior officers appointed as a result of the proposed acquisition, transfer or disposal; (e) the financial soundness of the proposed acquisition, transfer or disposal; (f) the source of funds of the acquirer; (g) whether the licensee will be able to comply and continue to comply with the provisions of the Act and these Regulations; and (h) whether there are reasonable grounds to suspect that, in connection with the proposed acquisition, disposal or transfer, financial crime, money laundering, terrorism financing or proliferation financing is being or has been committed or attempted or could increase the risk thereof. (4) Within ten days of making a determination under this regulation, the relevant regulatory authority shall notify the applicant of the grant or refusal of the application. (5) Where a person — (a) reduces their direct or indirect shareholding or interest in a licensee to less than ten percent to avoid the requirement for approval under subregulation (1); or (b) exercises direct or indirect control of shareholding or interest in a licensee of more than ten percent through their associates or proxies, that person shall obtain the approval of the relevant regulatory authority of such transfer or disposal under this regulation. (6) For the purposes of this regulation, the relevant regulatory authority may consult the competent authorities responsible for mergers and acquisitions and AML/CFT/CPF in granting or declining its approval. 30. (1) A licensee shall— Conflict of interest. (a) identify and document the conflicts of interest that are likely to occur in the course of its regulated activity; (b) adopt and document appropriate policies to minimize those conflicts by identifying the instances where it would refuse

4274 Kenya Subsidiary Legislation, 2026 to act and, where this is not necessary, making arrangements to minimize the risk of any loss to the consumer; and (c) avoid any conflict of interest between itself and a consumer and where such a conflict exists, decline to act, or if it considers that the conflict can be managed, disclose it to the consumer and follow the policies developed to minimize damage to the consumer and to put the consumer’s interests ahead of its own. (2) A licensee shall not take advantage of information it obtained from providing services to a consumer for its own benefit or the benefit of its employees or the benefit of another consumer, and where such an eventuality is likely to occur, the licensee shall— (a) adopt and document procedures, including the erection of information barriers, barriers between information technology systems, physical barriers or even separate office locations, to minimise the possibility of information from one consumer being used for the benefit of another consumer, its employees or the licensee; (b) train employees in matters relating to the conflict of interest and the procedures developed to avoid them; and (c) obtain undertakings from employees that they will not use information gained from the consumers for their personal benefit. (3) Where a licensee has a material interest in a transaction to be entered into with or for a consumer, or a relationship which gives rise to a conflict of interest, the licensee shall not, knowingly, advise, or exercise discretion, in relation to that transaction unless it has— (a) disclosed the material interest or relationship that may give rise to a conflict, as the case may be, to the consumer; or (b) taken reasonable steps to ensure that neither the material interest nor relationship would adversely affect the interests of the consumer. (4) A licensee shall take reasonable steps to ensure that neither it nor any of its employees or agents offers or gives, or solicits or accepts, any inducement that is likely to conflict with any of the duties owed to consumers. 31. (1) A licensee shall, at the point of service, provide— Information at point of service. (a) a clear and understandable description of the services which it offers and the rates, terms, conditions and charges for such services; (b) clear terms of service to its consumers and agents; (c) the name of the licensee; (d) a telephone number or such other contact medium which provides access to its consumer care system.

Kenya Subsidiary Legislation, 2026 4275 (2) The information referred to under sub regulation (1) shall be published and displayed conspicuously at all points of service. 32. (1) A licensee shall perform customer due diligence prior to onboarding a consumer by identifying and verifying the identity details of the consumer for purposes of these Regulations. Performance of customer due diligence prior to onboarding. (2) The performance of customer due diligence under subregulation (1) shall be done in accordance with the obligations imposed under the Proceeds of Crime and Anti-Money Laundering. Cap. 59A. 33. (1) A virtual asset exchange or token issuance platform provider shall perform due diligence on all virtual assets before including them for trading on the exchange or platform. Performance of due diligence before admission for trading. (2) In the performance of due diligence under subregulation (1), the virtual asset exchange or token issuance platform provider shall take into consideration— (a) the regulatory status of the virtual asset and whether its regulatory status would also affect the regulatory obligations of the virtual asset exchange and token issuance platform provider; (b) the supply, demand, maturity and liquidity of a virtual asset; (c) the complexity and development of the virtual asset; (d) the risks associated with the virtual asset and its issuer; (e) the enforceability of any consumer rights relating to the virtual asset; (f) market capitalization and trading volume; (g) technical security audits, including smart contract reviews; (h) project fundamentals such as token distribution and community support; (i) legal and compliance assessments, including AML/CFT/CPF safeguards and avoidance of regulatory risks. (3) A virtual asset exchange or token issuance platform provider shall maintain a record of the due diligence assessment under subregulation (1) for the duration of the listing of the virtual asset on the exchange or platform. (4) A virtual asset exchange or token issuance platform provider shall continuously monitor each virtual asset admitted for trading on the exchange or the platform to determine the viability of that virtual asset to continue or cease trading. 34. A licensee shall, in respect of every contract for the exchange, purchase or sale of a virtual asset it has entered into, not later than the end of the trading day after the contract was entered into, make out and send to the consumer, a confirmation with respect to the transaction. Transaction confirmation.

4276 Kenya Subsidiary Legislation, 2026 35. A licensee shall give priority to client orders over its own proprietary orders when executing transactions in the same virtual asset. Fair allocation. (2) The service provider shall not execute, place, or arrange proprietary trades in a manner that disadvantages, delays, or is likely to disadvantage or delay the execution of client orders. 36.A licensee shall ensure that any transaction it executes are allocated to the consumers who gave the orders in a timely manner. Timely allocation. 37. A licensee shall report to the relevant regulatory authority all trades facilitated by the licensee in virtual assets dealt with otherwise than at a licensed virtual asset exchange or token issuance platform provider. Off-market transactions. 38.(1) Pursuant to section 35(1) of the Act, the relevant regulatory authority may conduct inspections and investigations including routine onsite and offsite inspections to assess compliance with the Act and these Regulations. Inspection and investigation. (2) Where the relevant regulatory authority exercises the powers under subregulation (1), the licensee shall— (a) grant full access to premises, systems, and records; (b) provide explanations, clarifications or data as requested; and (c) implement remedial measures within such period as the relevant regulatory authority may specify. (3) In furtherance of its powers under this regulation, the relevant regulatory authority shall maintain continuous surveillance of market conduct, transactional activity and systemic risk using data analytics and reporting tools. (4) The relevant regulatory authorities may jointly undertake compliance inspections and investigations to assess compliance with the Act and these Regulations. 39.The board of directors of a licensee shall appoint or designate a compliance officer who shall— Compliance officer. (a) monitor compliance with the regulatory requirements provided under the Act and these Regulations, and shall not be involved with any function that is the subject of compliance; (b) have sufficient authority to carry out such function; (c) have unfettered access to information; (d) have direct access to the board of directors; (e) take necessary action to rectify any non- compliance; (f) report any non-compliance issues that cannot be rectified to the board of directors; (g) report to the board of directors any material breaches of the regulatory requirements;

Kenya Subsidiary Legislation, 2026 4277 (h) submit an annual corporate governance report to the board of directors; and (i) ensure that conflict of interest is avoided in the performance of compliance function and other institutional functions. 40. (1) A licensee shall have a comprehensive risk management framework to identify, evaluate, monitor and control or mitigate all material risks in a manner commensurate with their size, complexity and risk profile. Risk management. (2) For the purposes of subregulation (1), a licensee shall comply with— (a) any technical standards issued by the relevant regulatory authority in accordance with section 6(1)(c) and (1)(d) of the Act; and (b) any applicable international standards and risk management guidelines which may be required by the relevant regulatory authority. PART IV—CORPORATE GOVERNANCE REQUIREMENTS 41. (1) A licensee shall establish effective, transparent and adequate governance arrangements to ensure continued integrity of its services. Governance arrangements. (2) The governance arrangements established under subregulation (1) shall include— (a) a board of directors consisting of persons who meet the fit and proper criteria set out in section 18 of the Act; (b) clearly defined and documented organisational structure including ownership, oversight and management structure; (c) segregation of duties and internal control arrangements; and (d) the separation of virtual asset business by the licensee in a separate business unit from its other business units, including maintaining a separate management structure and keeping separate books of account. (3) A licensee shall establish adequate operational arrangements for its services. (4) The operational arrangements established under subregulation (3) shall include— (a) rules and procedures setting out the rights and liabilities of the licensee and the consumer; (b) the risks the consumer may incur; (c) measures to ensure prudent management of the funds collected from consumers, including measures to ensure that such funds are available at all times for repayment to consumers;

4278 Kenya Subsidiary Legislation, 2026 (d) measures to ensure safety, security and operational reliability of the service, including contingency arrangements; and (e) the maintenance of separate records and accounts for provision of services from other business activities. 42. (1) The board of directors of a licensee shall consist of— Board of directors. (a) at least three members of whom one-third shall be independent directors; and (b) not more than one-third of the directors shall be related to any director. (2) The chairperson or a director of the board shall not be appointed as the chief executive officer of the licensee. (3) The board of a licensee shall specify the roles and responsibilities of the chairperson in writing. (4) For purposes of this regulation, an “independent director” means a person who— (a) has not been employed by the licensee in an executive capacity within the last five years; (b) is not associated to an adviser or consultant to the licensee or a member of the licensee’s senior management or a person employed by the licensee in an executive capacity within the last five years; (c) is not associated to a significant consumer or supplier of the licensee or has not had any business relationship with the licensee within the last five years; (d) does not have a contract of service with the virtual asset service provider, or a member of the licensee senior management; (e) is not a close relation of an adviser or consultant to the licensee or a member of the licensee senior management; (f) has not had any of the relationships described in paragraphs (a), (b), (c), (d) or (e) with any affiliate of the licensee. 43.(1) The board of directors of a licensee shall be collectively responsible for the conduct and governance of its virtual asset business and in particular shall— Role of the board of directors. (a) give strategic direction and provide effective oversight to a licensee; (b) ensure the integrity of the licensee’s accounting and financial reporting systems; (c) manage risks affecting the regulated activity and shall regularly review the effectiveness of the risk management process; and (d) ensure that the licensee complies with the Act and other relevant laws.

Kenya Subsidiary Legislation, 2026 4279 (2) The board of directors of a licensee may establish such committees, including an audit committee and a risk management committee, as it may consider necessary to assist it in the performance of its functions. (3) The board of directors of a licensee shall not be discharged from its duties and responsibilities for matters or authority delegated to committees of the board or to the management of a licensee. 44. A person shall qualify for appointment or designation as the chief executive officer of a licensee under section 30(1) of the Act, if that person— Chief executive officer. (a) meets the fit and proper requirements specified under section 18 of the Act; (b) possesses professional competence in virtual assets or other fields relevant to the operations of virtual asset business; and (c) is domiciled in Kenya. 45. The persons responsible for the management of finance function and the internal audit function in a licensee shall be members of good standing in the Institute of Certified Public Accountants of Kenya or an equivalent international professional body recognised by Institute of Certified Public Accountants of Kenya. Finance officers and internal auditors. PART V — INTERVENTION AND STATUTORY MANAGEMENT 46. (1) The relevant regulatory authority may intervene in the management of a licensee where a licensee fails to — Intervention in management. (a) meet its obligations to its customers; (b) meet its financial obligations to other licensees; (c) comply with a directive issued by the relevant regulatory authority; (d) comply with the provisions of the Act. (2) Where subregulation (1) applies, the relevant regulatory authority may— (a) appoint a statutory manager in accordance with regulation 47; (b) remove any officer or employee of a licensee who has caused or contributed to the contravention of any provision of the Act; (c) restrict the licensee from engaging in new virtual asset services; (d) prohibit the licensee from engaging any new agents or direct the licensee to terminate any agency arrangement. 47. (1) Where the relevant regulatory authority suspends or revokes a licence under section 15 of the Act, the relevant regulatory authority may, by notice in the Gazette, appoint a statutory manager to manage consumer assets for a period not exceeding twelve months. Statutory management upon suspension or revocation.

4280 Kenya Subsidiary Legislation, 2026 (2) The term of the statutory manager may be extended for a further term not exceeding twelve months with the approval of a competent court. 48. (1) The functions of a statutory manager shall include— Functions and powers of a statutory manager under regulation 47. (a) taking control of the assets of the licensee for purposes of safeguarding monies and virtual assets belonging to consumers; and (b) overseeing and administering the settlement of monies and virtual assets belonging to consumers. (2) A statutory manager shall have powers necessary for the performance of his or her functions under subregulation (1) and in particular shall have the power to declare a moratorium for purposes of safeguarding monies and virtual assets belonging to consumers. (3) The moratorium referred to in subregulation (2) shall be applied equally and without discrimination to all classes of creditors: Provided that the statutory manager may offset the liabilities owed by the licensed person to any creditor against any debts owed by that creditor to the licensed person. (4) Where the statutory manager has assumed control of a licensee, that statutory manager shall have the power to— (a) enter into any premises of licensee and take possession and control of the assets and require any person in the premises to account for and deliver up to the statutory manager possession and control of the assets; (b) sell or otherwise dispose of any asset that is subject to an agreement creating a security interest to any person who agrees to assume the obligation secured by the security interest; (c) subject to paragraph (b), sell or otherwise dispose of the assets and business undertaking of the licensee by private treaty or public sale or in such other manner and on such terms and conditions as the statutory manager deems appropriate; (d) arrange for the assumption of all or any part of the liabilities of a licensee by a person; (e) carry on the business of a licensee to the extent that the statutory manager deems necessary or beneficial; (f) sue for, defend, compromise and settle, in the name of the licensee, any claim made by or against it; (g) in the name of the licensee, do all acts and execute all receipts and other documents; and

Kenya Subsidiary Legislation, 2026 4281 (h) recover out of the assets of the licensee all the costs, charges and expenses, including remuneration, properly incurred by the statutory manager in the exercise of powers, in priority to all other claims. (5) Where the statutory manager exercises one or more powers under this regulation, the statutory manager shall not, by reason of the exercise of such powers, be held to have assumed or incurred any obligation or liability of the licensee for its own account. PART VI — REQUIREMENTS FOR OFFER OF INITIAL COIN OFFERINGS AND LISTINGS FOR VIRTUAL ASSET EXCHANGES 49. (1) Pursuant to section 34 of the Act, a person seeking to issue an initial coin offering shall make an application to the Capital Markets Authority for approval. Application for approval to issue initial coin offering. (2) In addition to the requirements under regulation 6, an application made under subregulation (1) shall be accompanied by— (a) a white paper with the information provided for under regulation 54(3); (b) governance structure of the issuer, including the board and senior management; (c) the policies and procedures for monitoring the cycle of the issuing and offering of an initial coin offering; (d) the information where the proceeds raised will be transferred or deposited; (e) the location where the information as required by these Regulations shall be retained and be accessible in Kenya; (f) the details and confirmation of the promoter; and (g) the application fee specified in the First Schedule to these Regulations. (3) An applicant may withdraw an application by giving written notice, including the reasons thereof, to the Capital Markets Authority, at any time before the determination of the application. 50. (1) Within ten days of making a determination of an application under regulation 49, the Capital Markets Authority shall notify the applicant of its decision. Determination of the application. (2) The Capital Markets Authority may reject an application where— (a) the application does not comply with the Act or these Regulations; (b) the criteria set out in section 34(4) of the Act is not met; (c) a white paper does not meet the requirements in regulation 54(3);

4282 Kenya Subsidiary Legislation, 2026 (d) the policies and procedures for monitoring the cycle of the issuing and offering of an initial coin are insufficient for mitigating possible market abuse, mis-selling or fraud risks. (3) Where an application under regulation 49(1) is approved, the Capital Markets Authority shall register the applicant’s details in accordance with regulation 59. (4) An initial coin offering approved under this Part shall be conducted through trading platforms or systems approved under regulation 53. 51. An approval of an offer of an initial coin offering shall be valid for a period not exceeding twelve months Validity of approval for offer of initial coin offering. 52. (1) Pursuant to section 34(3) of the Act, a licensee desiring to engage the services of a promoter of a virtual asset offering shall, in writing, apply to the Capital Markets Authority for approval. Approval of promoter. (2) In determining an application under subregulation (1), the Capital Markets Authority shall take into consideration— (a) the financial condition and history of the applicant; and (b) whether the promoter is an eligible person under section 34(2) of the Act. (3) Within ten days of making a determination under subregulation (2), the Capital Markets Authority shall notify the applicant of its decision. (4) The Capital Markets Authority may, by notice in writing, revoke or suspend an approval granted under this regulation if the licensee or promoter— (a) ceases to carry on business in Kenya, goes into liquidation, or is wound up, or is otherwise dissolved; (b) fails to comply with the provisions of these Regulations or any condition attached to an approval; or (c) conducts business in a manner that may pose a risk to the stability of the financial system. 53. (1) A person seeking to deploy a trading system or platform shall, in writing, apply to the Capital Markets Authority for approval. Approval of trading platforms. (2) In determining an application under subregulation (1), the Capital Markets Authority shall take into consideration the ability of the system or platform to — (a) enable real-time public access to trading information; (b) incorporate mechanisms for transparent and efficient price discovery; (c) maintain a complete and tamper-proof audit trail of all transactions;

Kenya Subsidiary Legislation, 2026 4283 (d) implement adequate cybersecurity, resilience and access control measures. (3) Within ten days of making a determination under subregulation (1), the Capital Markets Authority shall notify the applicant of its decision. (4) A trading system or platform approved under this regulation shall retain and securely store all trading and transaction records for at least seven years beginning from the date the transaction occurred. 54. (1) An applicant shall publish its white paper upon receipt of notice from the Capital Markets Authority that it has no objection to the proposed issuance or promotion. Publication of white paper for an initial coin offering. (2) The white paper referred to under sub regulation (1) shall provide full and accurate disclosure of information that will enable an investor to make an informed assessment before subscribing or investing. (3) The information referred to under subregulation (2) shall include— (a) brief description of the directors, senior officers and advisers of the issuer including their name, designation, nationality, address, professional qualifications, related experience and any involvement or participation in a previous similar offering; (b) the objective or purpose of initial coin offering including information on the project to be managed and operated by the issuer; (c) the key characteristics of the initial coin offering; (d) identification as to whether a virtual asset offering will have different classes of holders in relation to any benefits, rights or liabilities linked to the offering; (e) a detailed description of the sustainability of the project; (f) the business plan of the issuer; (g) the targeted amount to be raised through the project and subsequent use and application of the proceeds thereafter illustrated in a scheduled timeline for drawdown and utilization of proceeds; (h) any rights, conditions or functions attached to the offering, including any specific rights; (i) the details on the determination of the accounting and the valuation treatments for the offering, including all valuation methodology and reasonable presumptions adopted in such calculation; (j) the associated challenges and risks, as well as mitigating measures thereof;

4284 Kenya Subsidiary Legislation, 2026 (k) the information in respect to the distribution of the initial coin offering and, where applicable, the distribution policy of the issuer of initial coin offering; (l) policies on monitoring the cycle of the initial coin offering; (m) information about the person, if any, underwriting or guaranteeing the project; (n) any restrictions on the transferability of the investment made; (o) methods of payment to invest or subscribe; (p) details of refund mechanism or withdrawal rights; (q) the target market of the virtual asset including any restrictions relating to the type of investors; (r) the offer time table; (s) the minimum subscription level for the offer to be successful; (t) details of the authorized status of the promoter or issuer in Kenya; (u) the audited financial statements of the issuer for three years or in the case of a newly incorporated issuer, the opening financial statements verified by an auditor as applicable; (v) the name of any trading platform for virtual assets where admission to trading is or will be sought, and information about how investors can access such trading platforms and the costs involved; (w) information on the technology used, including distributed ledger technology, protocols and technical standards, allowing for the holding, storing, and transfer of virtual assets; (x) the issue price of the virtual asset being offered to the public, denominated in both Kenya shillings or other virtual assets. (4) The board of directors of an issuer shall be responsible for the information provided in the white paper. (5) A person who fails to comply with the requirements of this regulation is liable to the administrative sanction specified in regulation 142. 55. (1) An issuer of initial coin offering shall seek the approval of the Capital Markets Authority on any intended change of their business model likely to have a significant influence on the purchase decision of any holders or prospective holders of initial coin offering, which occurs after licensing or after the approval of the virtual asset white paper. Modification of published white paper for an initial coin offering. (2) The changes envisaged under subregulation (1) include any material modifications to—

Kenya Subsidiary Legislation, 2026 4285 (a) the governance arrangements, including reporting lines to the board of directors and risk management framework; (b) the rights granted to the holder’s virtual asset; (c) the functioning of issuers’ proprietary distributed ledger technology, where the virtual asset is issued, transferred and stored using such a distributed ledger technology; (d) the timetable for the offer; (e) the mechanisms to ensure the liquidity of virtual asset; (f) the arrangements with third-party entities, including for managing the reserve assets and the investment of the reserve, the custody of reserve assets, and, where applicable, the distribution of the virtual asset to the public; or (g) the complaints-handling procedures. (3) A request for approval under subregulation (1) shall be accompanied by a draft modified virtual asset white paper and ensure that the order of the information appearing therein is consistent with that of the original white paper. (4) An issuer of an initial coin offering shall not effect an intended change unless the approval sought under subregulation (1) is granted. 56. (1) An issuer of an initial coin offering may only commence advertising of an issuance or promotion following the date on which it receives notice from the Capital Markets Authority that it has no objection to the proposed issuance or promotion. Commencement and duration of advertising. (2) The issuer of an initial coin offering may only advertise the issuance or promotion for the duration specified in the application. (3) A person who fails to comply with the requirements of this regulation is liable to the administrative sanction specified in regulation 142. 57. (1) Where an issuer wishes to extend the issuance of an initial coin offering beyond the end date stated in its application, the applicant shall, in writing, submit to the Capital Markets Authority an application for extension of issuance and reasons thereof. Extension of issuance. (2) An application for an extension under subregulation (1) shall be submitted not later than three months before the expiry date of the end date stated in its application. (3) The Capital Markets Authority may reject an extension where— (a) prejudice would be caused or would ensue to the financial services industry or any part thereof; (b) the continued issuance is against public policy; or (c) the continued issuance is unlikely to meet the financial objectives stated in the original application.

4286 Kenya Subsidiary Legislation, 2026 (4) Within ten days of making a determination under this regulation, the Capital Markets Authority shall notify the applicant of the decision thereof. (5) An extension may only occur for a period of no more than six calendar months after approval under sub regulation (4). (6) Upon expiry of the extension under this regulation, any subsequent issuance of the initial coin offering shall be deemed to constitute a new offer to the public and the requirements for issuance of initial coin offering shall apply. 58. (1) Where a licensee seeks to change the promoter named in its application, the licensee shall, in writing, notify to the Capital Markets Authority and provide reasons for the change. Change of promoter. (2) A notification under subregulation (1) shall be submitted to the Capital Markets Authority not less than fifteen working days before the applicant proposes to effect the change. (3) The Capital Markets Authority may object to the change where— (a) the promoter is not an eligible person under section 34(2) of the Act; (b) prejudice would be caused or would ensue to the financial services industry or any part thereof. (4) A change of a promoter shall be effected where the relevant regulatory authority has no objection to the proposed change within a period of fifteen working days following receipt of notice under subregulation (1). (5) Where the Capital Markets Authority does not object to a proposed change of promoter under this regulation, the applicant shall, within five working days of the change taking effect, disclose the change to all consumers and subscribers who have participated in the initial coin offering as at the date of the change, specifying— (a) the identity and relevant background of the incoming promoter; (b) the reasons for the change; (c) information on any right of withdrawal available to the subscriber in consequence of the change, where applicable. (6) A person who fails to comply with the requirements of this regulation is liable to the administrative sanction specified in regulation 142. 59. The Capital Markets Authority shall maintain a register with the following information — Register. (a) the name and address of the issuer of initial coin offerings; (b) the date upon which the issuance is to start and to end; (c) any measures imposed by the relevant regulatory authority under the Act;

Kenya Subsidiary Legislation, 2026 4287 (d) whether the minimum total subscription disclosed in the approved white paper was achieved at the close of the offering; (e) the date on which the virtual assets offered were listed for trading on a licensed virtual asset exchange or token issuance platform; (f) any instance in which an approved initial coin offering did not proceed to listing, together with the reasons provided by the issuer or promoter. 60. (1) A virtual asset exchange or a token issuance platform provider shall maintain a list in respect of all virtual assets listed on the exchange or platform. Listing requirements for virtual asset exchanges and token issuance platforms. (2) The virtual asset exchange or a token issuance platform provider shall enter in the list the particulars of all virtual assets that have been approved for listing. (3) A virtual asset exchange or a token issuance platform provider shall only include a virtual asset in the list where the virtual asset has attained the minimum total subscription disclosed in the white paper approved by the Capital Markets Authority in respect of the initial virtual asset offering and listing of the virtual asset. (4) The list shall, where applicable, include the following particulars in respect of each listed virtual asset— (a) the name of the virtual asset; (b) the name of the issuer; (c) the total supply of virtual assets listed; (d) the listing date; (e) the trading commencement date. (5) A virtual asset exchange or a token issuance platform provider shall notify the Capital Markets Authority of each new listing or delisting decision, on a monthly basis and by the tenth of the following calendar month. (6) A virtual asset exchange shall not list any stablecoin unless that stablecoin has been approved by the Central Bank of Kenya and is issued by a duly licensed stablecoin issuer. (7) The Capital Markets Authority shall retain the power to direct the delisting of a virtual asset where a material risk to financial stability or consumer protection is identified. PART VII— PROVISIONS RELATING TO TOKENIZATION OF REAL-WORLD ASSETS 61. (1) A person seeking to undertake the activity of virtual asset tokenization shall make an application to the Capital Markets Authority for a licence. Application for virtual asset tokenization licence.

4288 Kenya Subsidiary Legislation, 2026 (2) In addition to the requirements under regulation 6, an application for a licence to undertake the activity of virtual asset tokenization shall be accompanied by— (a) rules of ownership, transferability, compliance, and profit distribution where the tokenization is based on distributed ledger technology; (b) an independent audit of the systems to be used in the tokenization of the real-world asset; (c) the application fee set out in the First Schedule to these Regulations. (3) Within thirty days of receipt of all documents and information required under subregulation (2) and completion of due diligence on the applicant, the Capital Markets Authority shall determine the application and notify the applicant of its decision thereof. 62. (1) Subject to subregulation (3), a person seeking to undertake a virtual asset offering of a tokenized real-world asset shall make an application to the Capital Markets Authority for approval. Requirements relating to issuance of tokenised real￾world assets. (2) An application under subregulation (1) shall be accompanied by— (a) a white paper with the information provided for under regulation 63; (b) governance structure of the issuer, including the board and senior management; (c) the policies and procedures for the monitoring the cycle of issuance and offering of tokenised real-world assets; (d) the information where the proceeds raised will be transferred or deposited; (e) a report by an independent valuer showing the real-world asset’s fair market value; (f) disclosure of the underlying technology; (g) evidence that the real-world asset can be tokenized and ownership can be established; (h) an agreement of the proposed custody arrangements, including the person holding the title and custody of the real￾world asset; (i) a report by an independent valuer showing the real-world asset’s fair market value; (j) evidence that the real-world asset is clear of any encumbrances; and (k) the application fee specified in the First Schedule to these Regulations.

Kenya Subsidiary Legislation, 2026 4289 (3) A real-world asset intended for tokenization under this regulation shall— (a) have clear legal rights; (b) be independently verifiable with respect to its valuation, existence and condition. 63. (1) The white paper for a virtual asset offering of a tokenised real-world asset shall provide full and accurate disclosure of information that will enable an investor to make an informed assessment before subscribing or investing. Contents of white paper for offering of tokenized real￾world asset. (2) The information referred to under subregulation (1) shall include— (a) brief description of the directors, senior management, key personnel and advisers of the issuer including their name, designation, nationality, address, professional qualifications, related experience and any involvement or participation in a previous similar offering; (b) the key information about the tokenized assets including their location; (c) a clear and accurate description of the rights or value that the token grants, or purports to grant, owners or holders of the token; (d) whether the token represents, or purports to represent, a direct right of ownership of the tokenized assets, or a fractional proportion thereof, and if so, a detailed description of how the right of ownership is established or such fractionalisation is structured; (e) if transactions in the tokenized assets are subject to legal or regulatory requirements; (f) a clear and detailed policy on the procedure for the creation and destruction of the tokens in public circulation and the consequence of such creation or destruction; (g) the custody arrangement of the tokenized assets including the custodians involved; (h) detailed assessments of risks relevant to the management, custody, investment or liquidation of the referenced real￾world asset including credit risk, market risk, counterparty risk and liquidity risk; (i) details on the determination of the accounting and the valuation treatments for the offering, including all valuation methodology and reasonable assumptions adopted in such calculation; (j) associated challenges and risks, as well as mitigating measures thereof; (k) information in respect to the distribution of the token offering;

4290 Kenya Subsidiary Legislation, 2026 (l) policies on monitoring the cycle of the token offering; (m) details of how tokens will be traded or transferred; (n) any restrictions on the transferability of the tokens; (o) methods of payment to invest or subscribe; (p) details of refund mechanism or withdrawal rights; (q) experience and track record of third-party vendors or service providers; (r) information on the adequacy of systems and controls in place to safeguard the operation of tokenised assets against cybersecurity related risks; (s) the interoperability between the distributed ledger technology networks and systems of issuers and other parties; (t) the information where proceeds raised will be transferred or deposited; (u) mechanisms of creating the tokens on a distributed ledger technology representing fractional ownership of real-world assets; (v) the redemption mechanism upon asset disposal or insolvency of licensee; (w) the timeline for distribution of proceeds to token holders; (x) the target market of the virtual asset including any restrictions relating to the type of investors; (y) the timetable for the offer; (z) the minimum subscription level for the offer to be successful; (za) a disclosure as to the target market of the virtual asset including any restrictions as regards to the target investors; (zb) secondary market trading mechanisms put in place in relation to the tokenization; (zc) the audited financial statements of the issuer for three years or in the case of a newly incorporated issuer, the opening financial statements verified by an auditor as applicable; (zc) the name of any trading platform for virtual assets where admission to trading is or will be sought, and information about how investors can access such trading platforms and the costs involved; (zd) information on the technology used, including distributed ledger technology, protocols and technical standards, allowing for the holding, storing, and transfer of virtual assets; (ze) the issue price of the virtual asset being offered to the public, denominated in both Kenya shillings or any other virtual assets;

Kenya Subsidiary Legislation, 2026 4291 64. (1) A person undertaking an offering of a tokenized real￾world asset shall seek the approval of the Capital Markets Authority on any intended change of their business model likely to have a significant influence on the purchase decision of any holders or prospective holders of initial coin offering, which occurs after licensing or after the approval of the virtual asset white paper. Modification of white paper for an offering of tokenized real￾world asset. (2) The changes envisaged under subregulation (1) include any material modifications to— (a) the governance arrangements, including reporting lines to the board of directors and risk management framework; (b) the rights granted to the holder’s virtual asset; (c) the functioning of issuers’ proprietary distributed ledger technology, where the virtual asset is issued, transferred and stored using such a distributed ledger technology; (d) the timetable for the offer; (e) the mechanisms to ensure the liquidity of virtual asset; (f) the arrangements with third-party entities, including for managing the reserve assets and the investment of the reserve, the custody of reserve assets, and, where applicable, the distribution of the virtual asset to the public; (g) the complaints-handling procedures. (3) A request for approval under subregulation (1) shall be accompanied by a draft modified virtual asset white paper and ensure that the order of the information appearing therein is consistent with that of the original white paper. (4) An issuer of an offering of a tokenized real-world asset shall not effect an intended change unless the approval sought under subregulation (1) is granted. 65. A person undertaking a virtual asset offering of a tokenized real-world asset shall— Listing of tokenized assets. (a) create the tokens on a distributed ledger technology platform, representing fractional ownership or rights to the real-world asset; (b) code the rules of ownership, transferability, compliance and profit distribution into distributed ledger technology platform based on smart contracts or equivalent mechanisms; (c) distribute the tokens through a primary offering; (d) list the tokens on a licensed token issuance platform to enable liquidity and investor exit options; (e) disclose issuance of additional tokens in respect of the real￾world asset; and (f) disclose the introduction of smart contracts or equivalent mechanisms affecting tokenized real-world asset.

4292 Kenya Subsidiary Legislation, 2026 PART VIII— PROVISIONS RELATING TO VIRTUAL ASSET WALLET PROVIDERS AND ISSUERS OF STABLECOIN 66. (1) A licensee providing virtual asset wallet provider services shall— Responsibilities of a virtual asset wallet provider. (a) segregate holdings of virtual assets on behalf of their consumers from their own holdings or property, and from other non-consumer virtual assets; (b) ensure that on the relevant distributed ledger, their consumers’ virtual assets are held on separate addresses from those on which their own virtual assets or other non￾consumer virtual assets are held; (c) with respect to any internal ledger accounts, maintain separate accounts for their consumers’ virtual assets and their own virtual assets or any other non-consumer virtual assets; (d) conduct, on a monthly basis, reconciliations of on-chain holdings against internal records and consume entitlements, and make such records available to the Central Bank of Kenya by the tenth day of the following calendar month; (e) obtain explicit consumer consent prior to holding virtual assets on behalf of such consumers in one or more omnibus accounts, or under any other arrangement where consumer assets are not held in separate accounts for each individual consumer under that consumer’s name; (f) maintain appropriate procedures to ensure that the virtual assets held in custody shall at all times be separate and insulated from the virtual asset service providers business; (g) not lend, use, hypothecate, pledge or otherwise use or encumber consumer assets that have been entrusted to it for safekeeping; (h) make its standard disclosures and standard consumer agreement readily accessible to consumers on its website and in a clear and non-technical language; (i) maintain in its custody, a sufficient amount of each type of virtual asset to meet its obligations to consumers; (j) ensure that necessary procedures are in place to return virtual assets held on behalf of their consumers or the means of access on demand to those consumers; (k) establish, maintain, enforce and regularly test reasonably designed written policies, procedures and arrangements in order to— (i) identify, in advance, the steps it intends to take in happening of events that could affect the custody of virtual assets;

Kenya Subsidiary Legislation, 2026 4293 (ii) enable the virtual asset service provider to seize or freeze virtual assets, when required; (iii) enable the transfer of virtual assets held by the virtual asset service provider to another appropriate person; (iv) remedy mistaken, fraudulent or otherwise unauthorised transactions; (v) ensure the continued safekeeping and accessibility of virtual assets in the event of unexpected disruptions to the control over its consumers’ virtual assets, the rights related to those virtual assets or the means of access to the virtual assets; (l) maintain an up-to-date register of positions which records each consumer’s rights to the virtual assets in the control of the virtual asset service provider; and (m) provide their consumers, at least once every three months and at each request of the consumer concerned, with a statement of holdings of the virtual assets recorded in the name of those consumers. (2) The consumer agreement referred to in subregulation (1)(h) shall include — (a) the general terms and conditions regarding custody of the consumer’s virtual assets; (b) how the virtual asset service provider segregates and accounts for the consumer’s virtual assets under subregulation (1)(a) to (1)(g); (c) the beneficial and equitable interests the consumer retains in their virtual assets; (d) the limitations on the use of custodied virtual assets by the virtual asset service provider. (3) For the purposes of subregulation (1)(l), the statement of position shall state at the minimum the virtual assets concerned, their balance, their value and the transfer of virtual assets made during the period concerned. (4) Where a licensee providing virtual asset wallet provider services holds virtual assets— (a) in one or more omnibus accounts; or (b) under any other arrangement where consumer assets are not held in separate accounts for each individual consumer under that consumer’s name, it shall maintain appropriate procedures and up-to-date records in order to identify, at all times, the virtual assets belonging to each consumer and to account for all consumer transactions.

4294 Kenya Subsidiary Legislation, 2026 67. (1) A person seeking to undertake a virtual asset offering of a stablecoin shall make an application to the Central Bank of Kenya for licence. Application for a stablecoin issuance licence. (2) In addition to the requirements under regulation 6, an application for licence under subregulation (1) shall be accompanied by — (a) the investment policies of the reserve assets and an assessment of how such investment policy can affect the value of reserve assets; (b) the issuer’s redemption policies; (c) a white paper containing the information specified under regulation 68; (3) Within thirty days of receipt of all documents and information required under subregulation (2) and completion of due diligence on the applicant, the Central Bank of Kenya shall determine the application and notify the applicant of its decision thereof. 68. (1) A white paper for a stablecoin shall contain the following information— Contents of a stablecoin white paper. (a) information about the issuer of the stablecoin; (b) information about the stablecoin; (c) information about the offer to the public of the stablecoin or its admission to trading; (d) information on the rights and obligations attached to the stablecoin; (e) information on the underlying technology; (f) information on the risks of the stablecoin; (g) information on the principal adverse impacts on the climate and other environment-related adverse impacts of the consensus mechanism used to issue the stablecoin; (h) the method and all factors used to calculate the value of reserve assets; (i) the initial value and composition of the reserve assets; (j) the conditions and the procedure to purchase stablecoins and redeem such stablecoins against reserve assets; (k) details of the stabilisation mechanism; (l) a summary of the investment policies referred to in regulation 67(2)(a) and an explanation of how such investment policy can affect the value of reserve assets; (m) details of the arrangements for custody and management of the reserve assets; (n) the rights provided to holders of the stablecoin; and (o) the date of its approval.

Kenya Subsidiary Legislation, 2026 4295 (2) In addition to the information referred to in subregulation (1), the white paper shall also contain the identity of the person other than the issuer that offers the stablecoin to the public or seeks its admission to trading, and the reason why that particular person offers that stablecoin or seeks its admission to trading. (3) The white paper shall contain a clear warning that the issuer of the stablecoin is solely responsible for the contents of the white paper. (4) The white paper shall contain a summary, which shall in a clear and non-technical language provide— (a) key information about the offer to the public of the stablecoin or the intended admission to trading of such stablecoin; (b) appropriate information about the characteristics of the virtual assets concerned in order to help prospective holders of the virtual assets to make an informed decision; (c) a warning that— (i) it should be read as an introduction to the white paper; (ii) the prospective holder should base any decision to purchase the stablecoin on the content of the white paper as a whole and not on the summary alone; (d) state that holders of the stablecoin have a right of redemption and at par value as well as the conditions for redemption; (e) clear and enforceable timelines for redemption, including— (i) standard settlement periods under normal market conditions; (ii) permissible extensions under stressed conditions, subject to prior approval by the Central Bank of Kenya; (f) ensure that redemption requests are processed in an orderly and timely manner, supported by adequate liquidity arrangements and operational capacity. (7) An issuers of stablecoins shall seek the approval of the Central Bank of Kenya under this regulation, at least ninety days before the date of their publication. (8) Any factor, mistake or inaccuracy that affects the assessment of the stablecoin shall be described in the modified white paper and, upon approval by the Central Bank of Kenya, be published on the issuers’ website. 69. (1) Upon approval by the Central Bank of Kenya under regulation 67 or 68, a stablecoin issuer shall publish on its website the approved white paper and, where applicable, the modified virtual asset white paper. Publication of the virtual asset white paper for stablecoins. (2) The issuer of a stablecoin shall—

4296 Kenya Subsidiary Legislation, 2026 (a) publish the white paper from the starting date of the offer to the public of the stablecoin or the admission to trading of that stablecoin; (b) ensure that the approved white paper and modified white paper remain accessible for the duration that the relevant stablecoin is held by the public; (c) publish on its website— (i) any changes to the information referred to in the white paper; (ii) any event that has or is likely to have a significant impact on the value of the stablecoin or on the reserve assets. 70. (1) A person shall not make an offer to the public or seek the admission to trading of a stablecoin, unless that person— Requirements for the offer to the public or admission to trading of stablecoin. (a) is licensed in accordance with these Regulations; (b) is the issuer of such stablecoin; (c) has obtained approval from the Central Bank of Kenya to publish the white paper; and (d) has published that white paper in accordance with regulation 69. (2) A person who contravenes the provisions of subregulation (1) shall be liable to the administrative sanction specified in regulation 142. 71. (1) A holder of a stablecoin shall have a claim against the issuers of the stablecoin. Issuance and redeemability of stablecoins (2) An issuer of stablecoin shall issue stablecoin at par value and on the receipt of funds. (3) A holder of a stablecoin may, at any time, redeem their stablecoin and the issuer of that stablecoin shall effect the redemption request within two working days and at par value, by paying the monetary value of the stablecoin held to the holder of the stablecoin. (4) An issuers of stablecoin shall prominently state the conditions for redemption in the white paper. 72. (1) An issuer of stablecoin shall not grant interest to holders of stablecoin. Prohibition of granting interest. (2) A licensee shall not grant interest when providing virtual asset services related to stablecoin. (3) Any remuneration or other benefit related to the length of time during which a holder of a stablecoin holds such stablecoin shall be treated as interest associated to the stablecoin.

Kenya Subsidiary Legislation, 2026 4297 73. (1) An issuer of stablecoin shall seek the approval of the Central Bank of Kenya on any intended change of their business model likely to have a significant influence on the purchase decision of any holders or prospective holders of stablecoins, which occurs after licensing or after the approval of the white paper. Modification of published stablecoin white paper. (2) The changes envisaged under subregulation (1) include any modification to— (a) the governance arrangements, including reporting lines to the management body and risk management framework; (b) the reserve assets and the custody of the reserve assets; (c) the rights granted to the holders stablecoin; (d) the through which a stablecoin is issued and redeemed; (e) the protocols for validating the transactions in stablecoin; (f) the functioning of issuers’ proprietary distributed ledger technology, where the stablecoin are issued, transferred and stored using such a distributed ledger technology; (g) the mechanisms to ensure the liquidity of stablecoin; (h) the arrangements with third-party entities, including for managing the reserve assets and the investment of the reserve, the custody of reserve assets, and, where applicable, the distribution of the stablecoin to the public; (i) the complaints-handling procedures. (3) A request for approval under subregulation (1) shall be made, in writing, accompanied by a draft modified white paper and ensure that the order of the information appearing therein is consistent with that of the original white paper. (4) Where the Central Bank of Kenya approves the modified white paper, it shall require the issuer of the stablecoin— (a) to establish mechanisms to ensure the protection of holders of the stablecoins, when a potential modification of the issuer’s operations can have a material effect on the value, stability, or risks of the stablecoin or the reserve assets; (b) to take any appropriate corrective measures to address concerns related to market integrity and financial stability. (5) An issuer of a stable coin shall not effect an intended changes unless the approval sought under subregulation (1) is granted. 74. (1) Where an issuer of a stablecoin has provided in its white paper or in a modified white paper, information that is misleading, that issuer and its directors, senior officers, and external auditors shall be liable to a holder of such stablecoin for any loss incurred due to that infringement. Liability of issuers of stablecoin for the information given in a stablecoin white paper.

4298 Kenya Subsidiary Legislation, 2026 (2) Any contractual exclusion or limitation of civil liability as referred to in subregulation (1) is not applicable. (3) For purposes of liability under subregulation (1), the holder of the stablecoin shall adduce evidence indicating that the issuer was responsible for provision of misleading information under subregulation (1) that impacted on the holder’s decision to purchase, sell or exchange that stablecoin. (4) The issuer and its senior officers, directors, significant shareholders shall not be liable for loss suffered as a result of reliance on the information provided in a summary, except where the summary— (a) is misleading, inaccurate or inconsistent when read with the other parts of the white paper; or (b) does not provide, when read with the other parts of the white paper, key information in order to aid prospective holders when considering whether to purchase such stablecoin. 75. (1) The issuer of a stablecoin shall— Stablecoin reserve assets. (a) fully back such stablecoin with reserve assets, such that the value of the reserve assets shall at all times be at least equal to the nominal value of all outstanding units of the stablecoin; (b) only issue stablecoin whose reserve assets consist of one or a combination of the following— (i) cash including Central Bank of Kenya reserve deposits and bank deposits; (ii) government securities with residual maturity of not more than ninety days; (iii) repurchase agreements with a maturity of not more than seven days backed by cash including central bank reserve deposits and bank deposits; (iv) other assets as may be approved by the Central Bank of Kenya; (c) ensure that reserve assets of each stablecoin are segregated from the operating assets of the issuer and the reserve assets of any other stablecoin; (d) make reserve assets available for examination and for verification of the issuer’s disclosures upon request by the Central Bank of Kenya. (e) ensure that the reserve assets are liquid to enable the issuer to fund redemption requests; (f) employ methods of calculating the valuation of reserve assets which are in accordance with generally accepted international standards on auditing or such standards as the Central Bank of Kenya may recognise;

Kenya Subsidiary Legislation, 2026 4299 (g) maintain appropriate procedures to ensure that the reserve assets shall at all times be separate and insulated from issuer’s estate such that creditors of the issuer have no recourse on the reserve assets held in custody, in particular, in the event of insolvency; (h) conduct quarterly stress testing on its reserve assets and submit the results thereof to the Central Bank of Kenya by the tenth day of the calendar month following the end of the quarter; (i) ensure that the reserve assets is composed and managed in such a way that— (i) the risks associated to the assets referenced by the stablecoin are covered; (ii) the liquidity risks associated to the permanent rights of redemption of the holders are addressed; (j) ensure that the reserve of assets is legally segregated from the issuers’ estate, as well as from the reserve of assets of other stablecoin, in the interests of the holders of stablecoin, so that creditors of the issuers have no recourse to the reserve of assets, in the event of insolvency. (2) Stablecoin issuers that offer two or more stablecoin to the public shall operate and maintain segregated pools of reserves of assets for each stablecoin and each of those pools of reserves of assets shall be managed separately. (3) A stablecoin issuer shall ensure that the issuance and redemption of stablecoin is always matched by a corresponding increase or decrease in the value of the reserve assets. 76. (1) A stablecoin issuer shall establish, maintain and implement custody policies, procedures and contractual arrangements that ensure at all times that— Custody of reserve assets. (a) the reserve assets are not encumbered nor pledged as financial collateral; (b) the reserve assets are held in custody in accordance with these Regulations; (c) they have prompt access to the reserve assets to meet any requests for redemption from the holders of stablecoin; (d) risk of concentration of custodians and reserve assets is avoided. (2) The reserve assets shall be held in custody by a custodian approved by the Central Bank of Kenya. (3) An issuer of stablecoin shall ensure that the reserve assets held in custody are protected against claims of the custodians’ creditors.

4300 Kenya Subsidiary Legislation, 2026 77. (1) A stablecoin issuer shall ensure that funds received in exchange for stablecoin complies with the following— Investment of funds received in exchange for stablecoin (a) at least thirty percent of the funds received is held in trust accounts in commercial banks in Kenya segregated for processing funds related to the issuance and redemption of stablecoin; (b) the remaining funds received are invested in Kenya in accordance with regulation 75; and (c) for fiat-referenced stablecoin, the reserve assets are denominated in the same official currency as the one referenced by the fiat-referenced stablecoin. (2) All profits or losses, including fluctuations in the value of the financial instruments referred to in sub-regulation (1), and any counterparty or operational risks that result from the investment of the reserve of assets shall be borne by the stablecoin issuer. 78. A stablecoin issuer shall, in a clear and non-technical language and in a publicly and easily accessible place on their website— Ongoing information to holders of stablecoin. (a) disclose the amount of stablecoin in circulation, and the value and composition of the reserve assets; (b) publish a summary of the audit report in relation to the reserve assets; (c) subject to the approval of the Central Bank of Kenya, disclose any event that has or is likely to have a significant effect on the value of the stablecoin or on the reserve assets. 79. (1) A stablecoin issuer shall implement and maintain effective policies and procedures to identify, prevent, manage and disclose conflict of interest between themselves and— Identification, prevention, management and disclosure of conflict of interest. (a) their shareholders or members; (b) any shareholder or member, whether direct or indirect, that has a significant shareholding in the issuers; (c) the members of their management body; (d) their employees; (e) the holders of stablecoin; (f) any third-party providing services to the stablecoin issuer. (2) A stablecoin issuers shall take all appropriate steps to identify, prevent, manage and disclose conflicts of interest arising from the management and investment of the reserve assets referred. (3) A stablecoin issuer shall, in a prominent place on their website and in a clear and non-technical language, disclose to the holders of their stablecoin the general nature and sources of conflict of

Kenya Subsidiary Legislation, 2026 4301 interest referred to in subregulation (1) and the steps taken to mitigate them. (4) The disclosure referred to in subregulation (3) shall be precise to enable the prospective holders of their stablecoin to make an informed purchasing decision about the stablecoin. 80. (1) The redemption of stablecoin shall be subject to the stablecoin issuer’s terms and conditions as approved by the Central Bank of Kenya. Redemption of stablecoins. (2) A stablecoin issuer shall establish a policy on consumers’ right of redemption setting out— (a) the conditions, including thresholds, periods and timeframes, for a holder of stablecoin to exercise such right of redemption; (b) the mechanisms and procedures to ensure the redemption of the stablecoin; (c) the valuation, or the principles of valuation, of the stablecoin and of the reserve assets when the right of redemption is exercised by the holder of stablecoin; (d) the conditions for settlement of the redemption; (e) measures that the stablecoin issuer takes to adequately manage increases or decreases in the reserve of assets in order to avoid any adverse impacts on the market of the reserve assets. (3) Where a stablecoin issuer, when selling a stablecoin, accepts payment in the Kenya Shilling, they shall always provide an option to redeem the stablecoin in the Kenya Shilling. (4) The redemption policies referred to in subregulation (2) shall — (a) be clear and conspicuous; (b) confer on any holder of a stablecoin, a right to redeem units of the stablecoin from the issuer on demand at par value of the underlying unit of the currency; (c) clearly disclose the meaning, timing and conditions of redemption. (5) Upon request by a holder of a stablecoin, a stablecoin issuer shall redeem the stablecoin by paying an amount in fiat, equivalent at par value. (6) The redemption of stablecoins shall be subject to a fee approved by the Central Bank of Kenya. (7) The business continuity plan of a stablecoin issuer shall include measures by the stablecoin issuer to restore compliance with the requirements applicable to the reserve of assets in cases where the issuer fails to comply with those requirements.

4302 Kenya Subsidiary Legislation, 2026 81. (1) Any marketing communication relating to an offer to the public of a stablecoin, or to the admission to trading of such stablecoin, shall comply with the following requirements— Marketing and communication of stablecoin issuance. (a) the marketing communication shall be clearly identifiable; (b) the information in the marketing communication shall be easily understandable and not misleading; (c) the information in the marketing communication shall be consistent with the information in the stablecoin white paper; (d) the marketing communication clearly state that a white paper has been published and clearly indicate the address of the website of the issuer of the stablecoin, a telephone number and an email address to contact the issuer. (2) In furtherance to the provision of subregulation (1), every marketing communication, including any modifications thereto, shall— (a) be published on the issuer’s website; (b) contain a clear and unambiguous statement that the holders of the stablecoin have a right of redemption against the issuer at any time and at par value; (c) be notified to the Central Bank of Kenya, upon request; (d) not be disseminated prior to the publication of the white paper but shall not affect the ability of the issuer of the stablecoin to conduct market soundings. 82. The issuer of a stablecoin shall appoint an approved auditor to— Audits, review and reports. (a) conduct an annual review of its systems, process and procedures and other internal controls with respect to its compliance with the requirements of these Regulations; (b) on a quarterly basis, conduct an independent audit of the issuer’s reserve assets relating to its compliance with these Regulations and provide proof of the independent audit report of the reserve assets to the Central Bank of Kenya by the tenth day of the calendar month following the end of the quarter; (c) conduct, on an annual basis, a review of the issuer's redemption policies to determine whether the policies are being complied with and meet the requirements of these Regulations. 83. (1) The Central Bank of Kenya may, in the interest of financial stability or consumer protection— Delisting or halting of stablecoin issuance. (a) require an issuer of a stablecoin licensed under these Regulations to suspend or limit the issuance or redemption of such stablecoin; (b) require a licensed virtual asset exchange, wallet provider or other intermediary to restrict, suspend or delist the trading or availability of a stablecoin within Kenya.

Kenya Subsidiary Legislation, 2026 4303 (2) Where a stablecoin is issued outside Kenya, the Central Bank of Kenya may exercise its powers under this regulation by directing licensed intermediaries operating in Kenya to restrict access to, or trading of, such stablecoin. 84. (1) An issuers of stablecoin shall, on a monthly basis and by the tenth day of the following calendar month, report to the Central Bank of Kenya, the following information— Stablecoin issuers reporting requirements. (a) the number of holders of stablecoin; (b) the value, circulation and peak values of the stablecoin; (c) the average number and average aggregate value of transactions per day during the relevant quarter; (d) the number of consumers and new account holders; (e) the composition of reserve assets in respect of the stablecoin; and (f) instances of de-pegging of the stablecoin. (2) In addition to the reports under subregulation (1), a licensee shall, on daily basis, submit to the Central Bank of Kenya reconciliation reports on the average number and average aggregate value of transactions per day, the stablecoin issued and the reserve assets. PART IX— CAPITAL AND FINANCIAL REQUIREMENTS 85. (1) A licensee shall, at all times, have capital and other financial requirements of such nature and amount that is commensurate to the scale, risk and the complexity of the licensee based on its authorised activities. Minimum financial and capital requirements. (2) In determining whether a licensee has adequate capital and other financial requirements under sub regulation (1), the relevant regulatory authority, where applicable, shall establish the ability of the licensee to have— (a) and maintain the paid-up capital and liquid capital at the amount specified in the Fifth Schedule; (b) a proper accounting record framework established, documented and maintained; (c) adequate financial reporting mechanisms; (d) and maintain the required insurance coverage. (3) A licensee shall, at the time of licensing and at all times thereafter, maintain core capital of not less than the paid-up capital prescribed in the Fifth Schedule to these Regulations. (4) The issued share capital shall be regarded as paid-up only where— (a) the consideration has been received in cash; or (b) the consideration has been received in other acceptable

4304 Kenya Subsidiary Legislation, 2026 consideration approved by the relevant regulatory authority, which shall be capable of objective valuation and immediate realization. (5) The following shall not constitute paid-up capital for the purposes of this regulation— (a) unpaid, partly paid or contingent capital commitments; (b) shareholder loans or advances; (c) capital raised through borrowed funds, whether directly or indirectly; or (d) revaluation reserves or internally generated intangible assets. (6) Where a licensee intends to or has been authorised to carry out more than one permissible activity, the licensee shall hold the amount of paid-up capital applicable to the highest-capital category and fifty percent of the paid-up capital for each additional activity to be undertaken. (7) The relevant regulatory authority may require a licensee to increase the paid-up capital required under this regulation depending on the risk profile of the virtual asset service provider. (8) The core capital maintained under these Regulations shall be unencumbered and shall not be— (a) pledged, charged, or otherwise subjected to any form of security; (b) subject to any contractual or legal restriction that impairs its availability to absorb loss; or (c) repayable, redeemable or callable at the initiative of any shareholder or third party. (9) The relevant regulatory authority may require a licensee to furnish evidence that its core capital is free from any encumbrance or obligation. (10) A licensee shall ensure that its core capital does not fall below the prescribed minimum at any time. (11) A licensee shall ensure that its shareholder funds does not fall below the prescribed minimum paid-up capital at all times. (12) A licensee shall at all times ensure that it maintains adequate liquid capital respectively set out in the Fifth Schedule. (13) Where the core capital of a licensee falls, or is likely to fall, below the prescribed minimum, the licensee shall— (a) immediately notify the relevant regulatory authority, in writing; and (b) submit a remedial capital restoration plan for approval by the relevant regulatory authority. (14) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified in regulation 142.

Kenya Subsidiary Legislation, 2026 4305 86. (1) A licensee shall not engage in any arrangement or transaction the effect of which is to temporarily inflate or misrepresent its capital position for purposes of meeting the requirements of this Act. Misrepresentation of capital position. (2) A person who contravenes the requirement of sub regulation (1) commits an offence and shall be liable, upon conviction, to a penalty specified in regulation 143. 87. (1) A virtual asset manager shall maintain, at all times, risk￾based capital to cover operational and technology-related risks. Role of virtual asset manager in relation to capital position and use of funds. (2) A virtual asset manager managing consumer funds shall appoint a custodian licenced in Kenya to safeguard the funds. (3) Where a virtual asset manager invests in or through a related company, that investment shall not exceed ten percent of the value of the total virtual assets under management, unless otherwise approved by the relevant regulatory authority. (4) For purposes of this subregulation (3), a “related company” means a holding company, subsidiary, or any entity under common control or substantially of the same shareholders. 88. (1) A licensee shall hold and maintain an insurance coverage for protection of consumers’ virtual assets, which shall be commensurate with the level of risks and the scale of the proposed virtual asset service. Insurance coverage. (2) Where the licensee has demonstrated that it has exhausted all means in obtaining the insurance coverage under sub regulation (1), the licensee shall submit, for approval to the relevant regulatory authority, a proposal in respect of an alternative means of insurance coverage to address the level of risks and the scale of the proposed business. (3) All insurance policies shall be held and maintained with an insurer licensed in Kenya or an insurer in a jurisdiction outside of Kenya which has been approved by the relevant regulatory authority, in consultation with the Insurance Regulatory Authority. (4) The insurance policies may be held in the name of another entity within the licensee’s group provided that the relevant insurance policy— (a) explicitly states that the licensee is an insured party; and (b) states the nature and the level of cover applicable to the licensee. (5) A licensee shall maintain appropriate insurance cover against cybersecurity risks, theft, loss of keys, or operational failure. (6) A licensed virtual asset investment advisor shall hold and maintain a professional indemnity cover of at least one million shillings. 89. (1) A licensee shall keep accurate accounting records which are able to show and explain its transactions, whether effected on its own behalf or on behalf of the consumers and that— Accounting records.

4306 Kenya Subsidiary Legislation, 2026 (a) disclose with reasonable accuracy, at any time, the financial position of the licensee at that time; and (b) enable the licensee to prepare a statement of comprehensive income and statement of the financial position as at any time and which comply with the requirements of these Regulations. (2) The accounting records shall, in particular, contain— (a) entries from day to day of all sums of monies and virtual assets, including initial coin offerings, received, exchanged, sold, transferred and held in custody; (b) details on administrative expenditures, receipts of commissions and charges imposed for transactions by the licensee; (c) a record of all assets and liabilities of the licensee including any commitments or contingent liabilities; (d) entries from day-to-day transactions of all virtual assets, including initial coin offerings, distinguishing those which are made by the licensee on its own account and those which are made by and on behalf of others; (e) entries from day-to-day of all consumers' monies, virtual assets, initial coin offerings which is paid into or out of a consumer's bank account or consumer's virtual asset, initial coin offerings and initial coin offerings account or any wallet; (f) record of balances on consumer's account. (3) The accounting records that a licensee is required to keep shall conform to the requirements of international accounting standards. (4) A licensee shall preserve, in original digital form, the accounting records that is required to be kept under this regulation for at least seven years from the date of completion of the transactions or operations to which they each relate. (5) The accounting records which are required to be kept under this regulation shall, at any time during the period in which they are required to be preserved, be produced for inspection to the relevant regulatory authority, or any person authorised by the relevant regulatory authority to receive the records, on demand at a reasonable time and place as may be specified by the relevant regulatory authority or the authorised person. 90. (1) A licensee shall, with the approval of the relevant regulatory authority, appoint an external auditor who shall be a member of good standing of the Institute of Certified Public Accountants of Kenya to carry out an audit of the transactions in its business. Appointment of an external auditor. (2) The relevant regulatory authority may require an auditor appointed under sub regulation (1) to—

Kenya Subsidiary Legislation, 2026 4307 (a) submit to the relevant regulatory authority such information or report as the relevant regulatory authority may require in relation to the audit carried out by the auditor; (b) extend the scope of an audit of the business and affairs of the virtual asset service provider and to submit a report to the relevant regulatory authority; and (c) carry out any examination or establish any procedure in any particular case. (3) A person appointed as an auditor under this regulation shall be appointed annually and may serve for a maximum period of four consecutive financial years. (4) The relevant regulatory authority may decline to approve, or revoke the appointment of an external auditor, if the external auditor has contravened the provisions of the Act. 91. Where the auditor's report is qualified on the grounds of the auditor's uncertainty as to the completeness or accuracy of the accounting records under regulation 89, the auditor shall, as soon as is practicable and in any event within seven days, report it in writing to the relevant regulatory authority and the licensee. Auditor’s report. 92. Every licensee shall submit to the relevant regulatory authority— Reports by the licensee. (a) quarterly financial statements by the tenth day of the calendar month following the end of the quarter; (b) monthly capital adequacy or liquidity reports; (c) audited annual financial statements within three months after the end of the financial year; (d) promptly disclose any event that could materially affect solvency, valuation of virtual assets or consumer protection. 93. Each virtual asset exchange or token issuance platform provider shall submit to the Capital Markets Authority, by the tenth day of the following calendar month, a report which shall include— Reports by virtual asset exchange and token issuance platform provider. (a) a summary of all virtual assets listed, suspended, or delisted during the period; (b) daily trading reports, including transaction volumes and price movements; (c) quarterly reports of all transactions, including off-platform trades and transfers; (d) an annual audited financial statement prepared in accordance with applicable accounting standards. 94. Every licensee undertaking virtual asset management shall submit to the Capital Markets Authority— Reports by virtual asset managers. (a) quarterly reports of assets under management by virtual asset

4308 Kenya Subsidiary Legislation, 2026 managers within fifteen days from the end of the quarter; (b) semi-annual financial statements of assets under management within fifteen days from the end of the reporting period; (c) annual audited financial statements of assets under management within three months from the end of the financial year. 95. The financial year of every licensed person shall be the period of twelve months ending on the 31st December in each year. Financial year. PART X — CYBERSECURITY MEASURES, SYSTEMS AND CONTROL 96. (1) Pursuant to section 28(1) of the Act, a licensee shall have in place cybersecurity measures for the establishment and maintenance of appropriate systems and controls for managing cybersecurity and operational risks. Cybersecurity strategy. (2) In giving effect to the provisions in subregulation (1), a licensee shall— (a) have in place organisational, human and technological resources to prevent system and process failures or in the event of such a failure, to identify them and undertake the necessary steps for prompt rectification; (b) ensure that it has in place arrangements for the continuity of operations in the event that a significant process or system becomes unavailable or is destroyed; and (c) ensure adequate monitoring mechanisms are in place to quickly detect and prevent cyber incidents and periodically evaluate the effectiveness of systems and controls. (3) In furtherance to the requirements provided for under subregulation (2), a licensee shall— (a) ensure that there is a chief information security officer or the equivalent with oversight over its cybersecurity systems with clearly defined roles, responsibilities and accountability for staff implementing, managing and overseeing the effectiveness of the licensee's cybersecurity strategy and policy; (b) ensure that the documentation of its internal processes and systems is maintained and distributed in managing operational and cybersecurity risk; and (c) ensure that all staff receive appropriate training in relation to cybersecurity on a periodic basis. (4) A licensee shall review its cybersecurity strategy and policy regularly, and at least annually, in response to changes in cybersecurity risks, as well as in response to a cybersecurity incident or to any issues or weaknesses identified and specific to the licensee operation.

Kenya Subsidiary Legislation, 2026 4309 (5) Further to subregulation (4), the licensee shall submit the results of its review of the cybersecurity strategy and policy, and any remedial actions needed, to its board of directors as soon as practicable and, in any event, no later than one month after the date of the review. (6) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified in regulation 142. 97. (1) A licensee shall ensure that its systems and controls are adequate and suitable for the performance of a virtual asset services and appropriate to the size and nature of its operations. Systems and control. (2) The systems and controls in subregulation (1) shall be in relation to the— (a) transmission of information to purchasers and consumers using its distributed ledger technology platform; (b) assessment and management of risks; (c) safeguarding and administration of assets which belong to purchasers or its consumers; and (d) the fitness and propriety of its employees and the adequacy of the technology resources. (3) In maintaining appropriate systems and controls under subregulation (1) and (2), a licensee shall have regard to— (a) confidentiality, including the safe storage of information and transmission of data in accordance with clear protocols, which may require firewalls within a system, as well as entry restrictions and compliance with relevant data protection laws; (b) accessibility of the system to authorized persons, employees of the licensee and as the case maybe, to authorized employees of the relevant regulatory authority; (c) integrity, including safeguarding the accuracy and completeness of information and data through its system and control; (d) maintenance of systems and infrastructure, including proper code version control, implementation of updates and resolution; (e) procedures to address updates to technological infrastructure, including forks. (4) The systems and control of a licensee shall include the following audit functions — (a) vulnerability assessment, risk assessment and penetration testing of those systems conducted on a bi-annual basis during the first year of licensing and at least once a year for subsequent years;

4310 Kenya Subsidiary Legislation, 2026 (b) audit trail systems that — (i) track and maintain information and data that allows for the complete and accurate reconstruction of all financial transactions and accounting; (ii) protect the integrity of data stored and maintained as a part of the audit trail from alteration or tampering; (iii) protect the integrity of hardware from alteration or tampering, including by limiting electronic and physical access permissions to hardware and maintaining logs of physical access to hardware that allows for event reconstruction; (iv) log system events, including access and alterations made to the audit trail systems and cybersecurity events; (v) maintain records produced as part of the audit trail; (vi) the effectiveness of the safe keeping, storage and accessibility of the virtual assets being kept by the licensee. (5) Subject to the approval of the relevant regulatory authority, a licensee shall appoint a qualified independent party to audit its systems and control, as and when may be required by the relevant regulatory authority, and provide a written opinion to the relevant regulatory authority that the licensee's program and controls are suitably designed and operating effectively to meet the licensee's obligations under these Regulations. (6) Further to subregulation (5), and in making an appointment, a licensee shall consider and state in the resolution making the appointment whether the independent party conducting the audit, as the case may be— (a) holds the required qualifications and competence, has proven experience and adequate resources to perform the appointee’s functions; and (b) is independent of the licensee in that the appointee or, in the case of a firm, any of its partners has no relationship with, or interest in, the licensee, any of its group of companies, nor has any connection with any director or significant shareholder of the licensee that could reasonably be perceived as materially affecting the exercise by the appointee of an independent mind and judgement in the performance of the appointee's duties. (7) A licensee shall carry out regular reviews of its systems and control. (8) A person who contravenes the provisions of this regulation shall be liable to the administrative sanction specified in regulation 142. 98. (1) The relevant regulatory authority may at any time— Cybersecurity audit.

Kenya Subsidiary Legislation, 2026 4311 (a) commission an audit of a licensee; or (b) call for an investigation of the licensee. (2) The relevant regulatory authority may— (a) require an officer of the licensee to produce or furnish to the relevant regulatory authority officer making an examination, within a reasonable time— (i) such books of accounts and other documents in the custody or power of the licensee; or (ii) statements or information relating to the affairs of the licensee as may be required by the examining officer; (b) at any time, enter any premises where a licensee is carrying on virtual asset services, or any premises where the relevant regulatory authority reasonably suspects that any virtual asset services is carried out in contravention of these Regulations. 99. (1) Where the licensee discovers a cybersecurity incident as a result of a cybersecurity event, the licensee shall notify the relevant regulatory authority within twenty-four hours of such discovery. Reporting of cybersecurity incident. (2) Further to subsection (1), the licensee shall provide a detailed report within five working days on whether the cybersecurity incident — (a) affects or has affected the services or network and information systems that support critical or important functions of the licensee; (b) affects or has affected services which the licensee has been authorized to provide; (c) constitutes or has constituted a malicious and unauthorized access to the network and information systems of the licensee. (3) The report under subsection (2) shall include the remedial actions to mitigate cybersecurity incident and prevent future cybersecurity event. (4) A licensee shall report any material cybersecurity incident, loss of keys, or unauthorised transaction within twenty-four hours and shall maintain appropriate insurance cover against theft, loss of keys, or operational failure. 100. (1) A cybersecurity audit report shall be prepared by a fit and proper person responsible for cyber security audit, containing— Cybersecurity audit report. (a) the functionality and integrity of the licensee's electronic systems; (b) any identified cybersecurity risk arising from any virtual asset service carried on or to be carried on, by the licensee; and (c) the cybersecurity program implemented and proposals for steps for the redress of any inadequacies identified.

4312 Kenya Subsidiary Legislation, 2026 (2) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified in regulation 142. PART XI — SAFEKEEPING AND MANAGEMENT OF CONSUMER’S ASSETS 101. Where a distributed ledger technology platform provides for the safeguarding and administration of assets belonging to consumers, and pursuant to section 31 of the Act, a licensee shall ensure that— Safeguarding of consumer’s assets strategy. (a) satisfactory arrangements are made for that purpose; and (b) clear terms of agreement exist between the consumers and the licensee in relation to the virtual asset. 102. (1) A licensee shall at all times provide safeguards to ensure consumer protection standards are upheld. Consumer protection. (2) Without prejudice to the generality of sub regulation (1), a licensee shall have business rules, procedures and an effective surveillance programme that ensure that a virtual asset service conducted on or through its distributed ledger technology platform or trading systems is conducted in a manner that provides protection to consumers, including monitoring conduct which may amount to market abuse, financial crime, money laundering, terrorism financing or proliferation financing. (3) In furtherance of the duty to protect the consumers assets under sub regulation (1), a licensee shall— (a) establish policies, systems and controls for the safekeeping and management of consumer assets; (b) make adequate arrangements to safeguard consumers' ownership rights, mitigate the risk of loss or diminution on the value of consumers’ assets; and (c) establish and maintain adequate organizational arrangements for transfer of consumer assets. (4) A licensee shall, as part of its policies, procedures and controls for the safekeeping and management of consumer assets, including the reconciliation of consumer assets, specify how consumer assets are protected against loss or misuse and how consumer assets are segregated so that they are not subject to the claims of the licensee's creditors as envisaged under section 31(d) of the Act. (5) A licensee shall make the policies referred to in sub regulation (3)(a) available in summarized form to its consumers in electronic format, upon request, no later than two working days from the date of receipt of the request. (6) A person who contravenes the requirements of this regulation (1) shall be liable to the administrative sanction specified under regulation 142. 103. (1) A licensee shall— Consumer service agreement.

Kenya Subsidiary Legislation, 2026 4313 (a) enter into a consumer service agreement with every consumer to which it renders services; and (b) submit to the relevant regulatory authority a copy of the standard consumer service agreement applicable to each service offered to the public. (2) A consumer service agreement under sub regulation (1)(a) shall, at minimum include— (a) a detailed description of the virtual asset services offered; (b) the registration requirements for account opening; (c) the procedures for maintaining a consumer account; (d) the privacy policy of the licensee; (e) the consumer account use and access responsibility; (f) the suspension, termination and freezing of accounts; (g) the dispute resolution and the governing law; (h) the warranties and liability; (i) the indemnity; (j) the exclusions or limitations of the virtual asset service; (k) disclosure, data retention and data transfer; (l) force majeure; and (m) details on how dormant accounts and accounts of deceased persons shall be handled. 104. (1) Pursuant to section 24(h) of the Act, a licensee shall open and operate all client account and licensees own accounts in a bank licensed in Kenya. Management and safe-keeping of consumer’s funds and assets. (2) A licensee shall ensure that the total amount and type of consumer assets held for consumers matches the aggregate entitlement of its consumers in accordance with its records and contractual obligations. (3) Any transfer undertaken of consumer assets shall be authorised or expressly permitted by the consumer. (4) A licensee shall, following the day on which consumers' funds, other than consumer assets, are received, place those funds by the end of the business day, with a bank or financial institution in accordance with these Regulations. (5) A licensee shall take all necessary measures to ensure that consumers’ funds, other than consumer assets, held in accordance with sub regulation (4), are held in an account separate to that which is used to hold funds belonging to the licensee. (6) Where a licensee holds virtual assets — (a) in one or more omnibus accounts; or;

4314 Kenya Subsidiary Legislation, 2026 (b) under any other arrangement where consumer assets are not held in separate accounts for each individual consumer under that consumer’s name, the licensee shall maintain appropriate procedures and up-to-date records in order to identify, at all times, the virtual assets belonging to each consumer and to account for all consumer transactions. (7) A licensee shall have adequate arrangements in place to safeguard the ownership rights of consumers over their consumer assets and prevent the use of those assets for their own account. (8) A licensee shall not use consumer assets for its own account or the account of any other person or consumer of the licensee. (9) A licensee shall take appropriate measures to prevent the unauthorized use of consumer assets for its own account or the account of any other person. (10) A licensee shall have procedures in place to ensure that consumers have a means by which to access their consumer assets. (11) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified in regulation 142. 105. (1) A licensee shall ensure that technology used for the purpose of holding consumer assets is reliable, resilient and compatible with the consumer assets being held, where applicable. Systems and controls to safe￾keep consumer assets. (2) A licensee, in complying with subregulation (1) shall have regard to— (a) the impact of the software architecture of the wallets used to hold consumer assets and the interoperability of systems used to hold them; and (b) the systems’ ability to ensure that security measures for access and use of private and public keys, hot and cold wallets storage, password protection and encryption, are reliable and effective. (3) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified under regulation 142. 106.(1) A licensee shall not grant any security interest, lien or right of set-off to another person over any consumer assets unless it applies directly to the clearing or settlement of such obligations as owed directly by the consumer to whom such security interest, lien or right of set-off claim is against. Protection from third party claims. (2) A licensee shall maintain records of any security interest, lien or right of set-off which it applies under subregulation (1), including any court order, legal proceeding or similar records served upon the licensee, the amount and nature of the consumer assets and the date upon which the obligation was applied.

Kenya Subsidiary Legislation, 2026 4315 (3) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified under regulation 142. 107.(1) In fulfilling its obligations under this Part, a licensee shall ensure that it maintains accurate and up to date records that are easily accessible by the consumer. Records and accounts. (2) A licensee shall make accessible at its office a register and enter in it the following information as appropriate to the relevant consumer— (a) the name of the consumer; (b) the consumers’ rights to its assets; (c) any movement of consumer asset with reference to instructions received from the consumer. (3) A licensee shall use the register referred to in sub regulation (2) to track, record transactions and ownership of consumer's assets and reconcile the consumer assets on a consumer-by-consumer basis, and to resolve any discrepancies taking into consideration any relevant off￾chain and on-chain records. (4) A virtual asset manager shall, on a monthly basis, provide to each consumer a written statement containing the following information— (a) the total value of virtual assets in a consumer’s account; (b) all transactions entered into between the licensee and the consumer in the reporting period; and (c) the change in quantity and valuation of virtual assets in a consumer’s account during the reporting period. (5) A licensee shall have in place valuation policies and procedures to ensure timely and accurate valuation of virtual asset holdings. (6) A virtual asset manager shall, on an annual basis, ensure that all assets under management are subjected to an independent valuation and the report of that valuation shall be submitted to the relevant regulatory authority within three months of the end of the financial year. PART XII — MARKET CONDUCT AND RELATED OFFENCES 108.(1) A licensee shall, when conducting a permissible activity— Standards of conduct. (a) observe a high standard of integrity and fair dealing; (b) act with due skill, care and diligence; and (c) observe high standards of market conduct. (2) A licensee shall provide to the relevant regulatory authority details of how it promotes and maintains professional conduct as required under sections 20 and 21 of the Act.

4316 Kenya Subsidiary Legislation, 2026 (3) For purposes of subregulation (2), a licensee shall— (a) take all the necessary steps to promote and maintain high standards of integrity and fair dealing in the carrying on of a virtual asset service on or through its distributed ledger technology platform or trading systems; and (b) cooperate with the relevant regulatory authority with regard to regulatory matters. 109. (1) A licensee shall not— Consumers’ understanding of risk. (a) recommend a transaction to a consumer, or effect a transaction with or for him, unless it has taken all reasonable steps to enable the consumer to understand the risks involved; (b) knowingly mislead a consumer on any advantages or disadvantages of a contemplated transaction; (c) promise a return on any investment. (2) A licensee shall give reliable information to the consumer to ensure that the consumer’s decisions are informed. (3) A licensee shall, when making recommendations to a consumer, take all reasonable steps to ensure that the consumer has a proper understanding of— (a) the nature of the investment; (b) the fees and charges associated with the investment; (c) sthe risks of the investment; (d) risks related to AML/CFT/CPF; (e) the factors that are likely to affect the performance of the investment; (f) the terms and conditions of the investment; (g) the consequences of departing from the terms and conditions of the investment. (4) Where a licensee— (a) after giving a consumer an explanation, in writing, is satisfied that the consumer understands the information required to be given under subregulation (3), the licensee shall retain a copy of such explanation in its records; (b) gives an explanation orally, it shall send a written note of the advice to the consumer and retain a copy of the explanation in the consumer’s file; (c) is of the opinion that an explanation is not required, because of the consumer’s existing knowledge, it shall document that opinion in its records.

Kenya Subsidiary Legislation, 2026 4317 (5) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified under regulation 142. 110. (1) A licensee shall establish and maintain procedures to address complaints by consumers of its virtual asset services. Addressing complaints by consumers. (2) The procedures referred to in subregulation (1) shall include— (a) effective arrangements for the investigation and resolution of complaints made against the licensee’s virtual asset services; (b) establishing and maintaining a register of complaints made against the licensee’s virtual asset services and resolutions reached with the consumer. (c) establishing and maintaining a consumer care system in accordance with regulation 111; (d) setting out the process for dealing with complaints, including– (i) the apportionment of responsibility for the actions that led to the complaint including to persons not specifically named in the complaint; (ii) the timeframe for dealing with a complaint; (iii) the timeframe within which to inform the complainant of progress in dealing with the complaint, which shall not be more than twenty-one days; (iv) the available remedial actions in respect of any complaints by the consumer; (v) the procedure for an appeal where the complaint cannot otherwise be resolved. (3) When addressing a complaint from a consumer, a licensee shall — (a) disclose to a consumer its procedures for handling of complaints. (b) address a complaint from a consumer in a fair, appropriate and timely manner; (c) inform the consumer of the outcome of their complaint; (d) provide appropriate restitution and address the weaknesses in its internal systems that led to the action causing the complaint. (4) A licensee shall keep and maintain the records of the complaints and action taken under this regulation for a minimum of seven years. 111. (1) Within six months after commencing the provision of virtual asset services, a licensee shall establish a consumer care system Consumer care system.

4318 Kenya Subsidiary Legislation, 2026 within which its consumers can make inquiries and complaints concerning its services. (2) Prior to establishing a consumer care system under sub regulation (1), the licensee shall— (a) put in place a clear mechanism to address consumer complaints; (b) provide adequate means for consumers to file complaints; (c) address such complaints within a reasonable period from the time receipt of the complaint; and (d) provide, at all points of service, easily understood information about their complaint handling procedure. 112. (1) A licensee shall have appropriate measures to identify, deter and prevent market abuse, financial crime and money laundering, terrorism financing or proliferation financing on and through its distributed ledger technology platform or systems and report to the relevant regulatory authority any market abuse. Deterrence of market abuse. (2) Pursuant to sub regulation (1), a licensee shall have rules and procedures to prohibit or prevent any— (a) transaction intended to create a false appearance of a trading activity or transaction; (b) improper execution of virtual asset transfer or exchange, stablecoin issuance, token issuance, or initial coin offering; (c) transaction intended to assist or conceal any potentially identifiable market abuse or financial crime. 113.(1) A licensee may enter into an agreement to outsource its operational functions of provision of virtual asset services. Outsourcing agreements. (2) A licensee who intends to outsource its functions under subregulation (1) shall obtain the approval of the relevant regulatory authority at least thirty days before such outsourcing agreement is implemented. (3) For the purposes of this regulation, a licensee shall not outsource its operational function in such a way as to impair— (a) the quality of internal control of the licensee; and (b) the ability of the relevant regulatory authority to monitor compliance of the licensee with the Act and these Regulations. (4) Where a licensee outsources a material operational function under this regulation, the licensee shall ensure that— (a) the outsourcing does not result in the delegation by senior officers of its responsibilities; (b) the relationship and obligations of the licensee to its consumers under this regulation is not altered;

Kenya Subsidiary Legislation, 2026 4319 (c) the outsourcing contract provides that the relevant regulatory authority can exercise its oversight and supervisory powers under this regulation in respect of the third parties to who functions are outsourced; and (d) the requirements which the licensee is required to comply in order to be licensed and remain so, including any conditions imposed by the relevant regulatory authority are not undermined. (5) For the purpose of subregulation (3), an operational function shall be regarded as material if a defect or failure in its performance would impair— (a) the continuing compliance of the licensee with the requirements of its licence under these Regulations; (b) its financial performance; or (c) the soundness or the continuity of its virtual asset services. Market conduct offences 114. (1) A person who possesses inside information in relation to a virtual asset shall not use that information to acquire or dispose of that virtual asset, or attempt to do so, or encourage or cause another person to deal in that virtual asset. Disclosure of insider information. (2) A person who contravenes the provisions of subregulation (1) commits an offence and shall be liable, on conviction, to the penalty specified under regulation 143. (3) For purposes of this regulation “inside information” means information, which has not been made public, but if made public, would reasonably affect the price of a virtual asset, the investment judgment of an individual in a transaction involving that virtual asset. 115. (1) No person shall enter into or carry out, directly or indirectly, two or more transactions in virtual assets, which by themselves or in conjunction with other transaction— Market manipulation. (a) increase, or are likely to increase the price with the intention of inducing another person to purchase, or subscribe for, or to refrain from selling virtual assets issued by the same company or a related company, or such other listed virtual assets; (b) reduce, or are likely to reduce, the price with the intention of inducing another person to sell, or to refrain from purchasing, virtual assets issued by the same company or a related company, or such other listed virtual assets; or (c) stabilize, or are likely to stabilize, the price with the intention of inducing another person to sell, purchase, or subscribe for, or to refrain from selling, purchasing or subscribing for, virtual assets issued by the same company or by a related company, or such other listed virtual assets.

4320 Kenya Subsidiary Legislation, 2026 (2) A person who contravenes the provisions of subregulation (1) commits an offence and shall be liable, on conviction, to the penalty specified under regulation 143. 116. (1) A person shall not create or do anything which is intended or likely to create a false or misleading impression— False trading and market rigging. (a) of active trading in virtual assets on a virtual asset exchange or token issuance platform; or (b) with respect to the market for, or the price for dealings in, virtual assets traded on the virtual assets exchange or token issuance platform. (2) Without prejudice to the generality of subregulation (1), a false or misleading impression of active trading in virtual assets is created if a person— (a) enters into or carries out, directly or indirectly, any transaction for the sale or purchase of a virtual asset which does not involve a change in the beneficial ownership of the virtual asset, or offers to do so; or (b) offers to sell a virtual asset at a price which is substantially the same as the price at which he has made or proposes to make, or knows that an associate of his has made or proposes to make an offer to buy the same or substantially the same number of virtual assets. (3) A person who contravenes the provisions of sub regulation (1) commits an offence and shall be liable, on conviction, to the penalty specified under regulation 143. 117. (1) A person shall not induce or attempts to induce another person to subscribe for, sell or purchase virtual assets by— Fraudulently inducing trading in virtual assets. (a) making or publishing any statement, promise or forecast that is false, misleading or deceptive; (b) concealing any material facts; (c) making or publishing any statement, promise or forecast which is misleading, false or deceptive; or (d) recording or storing in, or by means of, any mechanical, electrical or other device, information that is false or misleading. (2) A person who contravenes the provisions of subregulation (1) commits an offence and shall be liable, on conviction, to the penalty specified under regulation 143. 118. (1) A person shall not, directly or indirectly, in connection with any transaction involving the subscription, purchase or sale of virtual assets— Use of manipulative devices. (a) use any device, scheme or artifice to defraud the other person;

Kenya Subsidiary Legislation, 2026 4321 (b) engage in any act, practice or course of business which is fraudulent, deceptive or likely to defraud or deceive that other person (c) make any false statement in relation to a matter or omits to state a material fact that is necessary in order to make the statements made in the light of the circumstances under which they were made, not misleading. (2) A person who contravenes the provisions of sub regulation (1) commits an offence and shall be liable, on conviction, to the penalty specified in regulation 143. 119. No person shall, directly or indirectly, for the purpose of inducing the subscription for, sale or purchase of virtual assets by another person of any company, or of any other virtual assets, or to maintain, increase, reduce or stabilize the price of such virtual assets, make with respect to the virtual assets— False or misleading statements inducing virtual assets transactions. (a) any statement which is, at the time and in light of the circumstances in which it is made, false or misleading with respect to any material fact and which that person knows or reasonably ought to know is false or misleading; or (b) any statement which is, by reason of the omission of a material fact, rendered false or misleading and which that person knows or ought to know is rendered false or misleading by reason of omission of that fact. (2) A person who contravenes the provisions of sub regulation (1) commits an offence and shall be liable, on conviction, to the penalty specified in regulation 143. 120. (1) No person who has insider information on consumer orders with a price differential, or is aware of such orders, shall effect an own account transaction in the virtual assets concerned or in any related investments directly or through any person, to take advantage of the price differential before the consumer order is executed. Front-running. (2) A person who contravenes the provisions of subregulation (1) commits an offence and shall be liable, on conviction, to the penalty specified in regulation 143. 121. A licensee shall not – Churning. (a) deal or arrange a deal in the exercise of discretion for any consumer; or (b) advise a consumer to deal, if the dealing could in the circumstances be reasonably considered as too frequent or too large having regard to the trading activities, investment objectives, size and operations of such consumer. (2) A person who contravenes the provisions of subregulation (1) commits an offence and shall be liable, on conviction, to the penalty specified under regulation 143.

4322 Kenya Subsidiary Legislation, 2026 122.(1) A licensee shall not, for the purposes of soliciting business relating to a regulated activity, make unsolicited telephone calls or attend at any property, unless it has established and monitors the implementation of operational procedures to— Cold Calling. (a) maintain a Do-Not-Call list of prospects that is updated whenever any contacted person requests not to be called again; (b) train staff on the use of the Do-Not-Call list; (c) limit the making calls to between 8 a.m. and 5 p.m; (d) oblige the callers to state their first and last names at the commencement of the call; (e) oblige the callers to state the firm’s name and address and the fact that it is licensed by the relevant regulatory authority at the commencement of the call; (f) oblige the caller to provide a detailed offer view of any product being marketed by the licensee prior to soliciting any offer; (g) record and avail copies of all recordings to the relevant regulatory authority for inspection. (2) A person who contravenes the provisions of subregulation (1) commits an offence and shall be liable, on conviction, to the penalty specified under regulation 143. PART XIII — ADVERTISEMENTS AND PROMOTIONS OF VIRTUAL ASSETS 123. (1) A person shall not— Prohibition. (a) advertise or purport to advertise a virtual asset service; or (b) promote or purport to promote a virtual asset service, including initial coin offerings and non-fungible tokens, unless that person complies with the requirements of these Regulations. (2) Any person acting on behalf of a licensee shall comply with these Regulations, and the licensee shall be liable and responsible for such persons as if the licensee had undertaken the relevant advertising itself. (3) This Part shall not apply to the following persons and activities — (a) advertisement by ministry, department, authorities or agencies of the Government; (b) persons engaged in the business of printing commercial and promotional materials for licensees; and (c) persons responsible for securing the placement of an advertisement provided they are not responsible for the contents thereof.

Kenya Subsidiary Legislation, 2026 4323 (4) A person who contravenes the requirement of this regulation shall be liable to the administrative sanction specified in regulation 142. 124. (1) Advertisements shall— General requirements for advertisement. (a) be fair, clear, complete, concise, unambiguous and unbiased, and shall not be false, misleading nor deceptive; (b) contain information that is timely and consistent with any relevant virtual assets, including initial coin offerings or virtual asset services; (c) convey an equitable message in respect of the returns, benefits and risks associated with the relevant virtual asset, including initial coin offerings or virtual asset services; (d) be clearly identifiable and the media chosen for an advertisement shall be suitable for that advertisement with due consideration as to the target market or class of consumers; (e) not lure or induce consumers into malicious virtual asset services and offerings; (f) not facilitate illicit actors or high-risk virtual asset service providers in the offering of virtual assets, including initial coin offerings or virtual asset services; (g) be in plain language as to be capable of being clearly understood by prospective consumers or consumers that might reasonably be expected to see it; and (h) not state or imply that relevant virtual assets, including initial coin offerings and non-fungible tokens, or virtual asset services are suitable for a particular class of consumers or consumers unless designated as being a product advertisable to a particular class of individuals or persons. (2) Before selling any relevant virtual asset, including initial coin offerings or virtual asset services, a licensee shall ensure that consumers have received sufficient information, regarding such products or services, including the benefits and potential risks, so as to allow a consumer to make an informed decision. (3) Advertisements relating to the virtual asset services rendered by a licensee shall include such relevant information as to the type of service offered, including the terms and timeframes for consumer deposits and withdrawals, associated fees payable, a reference to where consumers can access full terms, conditions, fees, and timeframes for deposits and withdrawals and such other relevant terms under which the service is provided to consumers. (4) Where a person acts in contravention of this regulation, the relevant regulatory authority may impose the administrative sanction specified under regulation 142.

4324 Kenya Subsidiary Legislation, 2026 125. (1) A licensee or promoter shall avoid extensive use of technical, legal terminology or complex language in an advertisement which may not convey a clear message to the consumers or may be such as to cause confusion if the likely audience is unfamiliar with the concepts. Content of advertisement. (2) All advertisements shall— (a) include the details of the licensee or promoter, including its full name and tradename (if applicable), licence number and registered office; (b) include the details of the third party, where a known third party is issuing or causes the advertisement to be issued on behalf of the licensee or promoter of the virtual asset; (c) be accurate and up-to-date; (d) not omit any material relevant facts, and shall not make definitive statements that cannot be sustained; (e) use a design and presentation that shall be easily and clearly understood; (f) include, if relevant, any approved trademark, tradename, slogan or associated marker to the licensee or promoter; (g) always give a fair, balanced and clear indication of any relevant risks when referencing potential benefits; (h) include the contact details where consumers can make enquiries; (i) ensure that changes to original information about the virtual asset or virtual asset service are promptly notified and described, with the advertisement indicating the date the information contained therein was updated. (3) Where information is sourced externally, the licensee or promoter shall disclose it as being such, and shall ensure that the information is accurate, complete and up-to-date and include the original source. (4) An advertisement shall only make a comparison, reference to past performance or future performance where this can be provided clearly, accurate, fair, balanced and not misleading, and does not take unfair advantage of the recipient of the communication. (5) Any reference to the involvement of the relevant regulatory authority in the advertisement shall not be construed or imply that the relevant regulatory authority has approved the advertisement or taken the responsibility for the soundness of the virtual asset, including an initial coin offerings or virtual asset service, and shall be limited to reference as to licensing. (6) A licensee shall not make reference to the name of any regulator, including the relevant regulatory authority or government in a way that is misleading and shall not use the name of any regulator,

Kenya Subsidiary Legislation, 2026 4325 including the relevant regulatory authority, without seeking prior approval with the concerned regulator or the relevant regulatory authority. (7) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified in regulation 142. 126. (1) An advertisement shall — Performance information. (a) not contain any projection of performance returns based on borrowing plans where it cannot be evidenced and substantiated; (b) when referring to a comparison, ensure that— (i) the comparison is meaningful and presented in a fair and balanced way; (ii) the sources of the information used for the comparison are specified; and (iii) the key facts and assumptions used to make the comparison are included, with clear provision as to its being an assumption and not a guarantee; (c) when referring to past performance— (i) contain a clear and prominent statement that past performance is not an indicator of future performance; (ii) clearly state the reference period and the source of the information provided; and (iii) is based on objective, up-to-date and accurate information. (2) An advertisement that refer to future performance shall ensure that — (a) the information gives a balanced impression, covering both negative and positive scenarios; (b) it is clear as to the basis on which future performance is predicted; and (c) there is a clear and prominent statement that such forecasts are not a reliable indicator of future performance. (3) An advertisement shall not contain information on future performance if it is not able to obtain objective data to substantiate the advertisement. (4) Future performance shall not be based on nor refer to simulated past performance. (5) An advertisement shall advise that a consumer should undertake their own research and not rely solely on the information provided within the advertisement or other materials prepared. (6) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified in regulation 142.

4326 Kenya Subsidiary Legislation, 2026 127. Where a fee or cost is referred to in an advertisement, it shall give a realistic impression of the overall level of fees and costs a consumer is likely to pay with clear indication as to the fee or cost being an estimate, if applicable. Fees, costs and commissions. 128. (1) An advertisement shall adequately display and explain any risks associated with relevant virtual asset, including initial coin offerings or virtual asset service. Risks and warning disclosures. (2) Where the price of a relevant virtual asset, including initial coin offerings and non-fungible tokens, or virtual asset service, is denominated in a currency other than Kenya shillings, the consumer shall be warned that changes to the rates of exchange may have an effect on the value, price or income obtained from relevant advertisement. (3) Where a person contravenes the requirement of this regulation, the relevant regulatory authority may impose the administrative sanction specified in regulation 142. 129. (1) Any person making an advertisement shall, at all times— Duty of a person making advertisement. (a) act responsibly, with honesty, fairness, integrity and professionalism; (b) avoid aggressive or offensive sale practices; (c) avoid indecent images or phrases; (d) deal respectfully with the consumers and ensure sufficient disclosure is made for them to make informed decisions; (e) be transparent regarding the nature of his, her or its relationship with the licensee or promoter; (f) avoid any inaccurate, false, misleading or deceptive information; (g) preserve confidentiality of the consumer's information, and not take advantage of such information for personal or another person's gain in conformity with the data protection law. (2) A person who acts in contravention with this regulation shall be liable to the administrative sanction specified in regulation 142. 130. (1) Any person acting on behalf of a licensee or promoter, where appropriate, shall— Duties of third parties making advertisements. (a) always disclose his full and accurate identity, at the time of introduction with consumers; (b) always disclose to consumers before entering into any contract for relevant virtual asset, including initial coin offering and non-fungible tokens, or virtual asset service, all benefits that will be paid to him or her, whether by way of fees, commissions, dividends (directly or indirectly) or otherwise under such contract, based on his relationship and

Kenya Subsidiary Legislation, 2026 4327 interest that he or she may share with other parties which are associated with the relevant products or services; (c) always disclose if they are being paid to promote or feature such a promotion on personal, business or other web pages controlled by the person itself. (2) A person who acts in contravention with this regulation shall be liable to the administrative sanction specified in regulation 142. 131. An advertisement on the internet shall adhere to the following principles and standards — Internet advertisement. (a) electronic advertisements shall be identical to the most up￾to-date paper versions; (b) there shall be a prominent statement on the relevant web pages, which is capable of being seen and read with reasonable ease by the consumer accessing the electronic copies of such advertisements, to the effect that printed copies of the advertisements are also available, as well as where and how they can be obtained; (c) any advertisements on the relevant web pages shall remain available for as long as it is necessary for the consumers to have a reasonable opportunity to read or access them, or for such duration of validity period as may be relevant from time to time; (d) consumers shall be given the opportunity to retain the information through printing and downloading; and (e) downloadable advertisements shall contain the date by print or watermark or through a time stamp in the downloadable version of the triggered date that the download has occurred. 132. A licensee or promoter shall, inter alia, abstain from the following internet-based advertisement practices when making an advertisement over the internet— Prohibited internet advertising and marketing practices. (a) hiding essential information by the close proximity of promotional images or additional text; (b) reducing risk warnings in importance due to their location outside of the main advertisement border; (c) diminishing some statements through the use of small font sizes, hard-to-read coloring, being placed at non prominent positioning and unclear type styles so as to render difficult or ineligible to read; (d) hiding important information within, or in some cases absent from, the respective internet landing page and only accessed through significant scrolling down or multiple page links; (e) due to positioning, making risk warnings easy to overlook, resulting in consumers being taken directly to an application form by clicking onto a banner advertisement;

4328 Kenya Subsidiary Legislation, 2026 (f) publishing risk statements within a “pop-up” box that only appears on the consumer's initial visit to the relevant website; (g) providing minimal information on the risks associated to specific products being promoted; (h) obscuring key information or warnings, such as fees or exclusions, within the internet website or placed under a separate section or heading; (i) incentives such as bonuses and inducements published on the main web page, but which are subject to conditions within pages noted in paragraph (h), that are not explained at the outset of account opening, transfer of funds or virtual asset; (j) not taking into account the different-sized browsers of consumers when positioning risk information whereby it is necessary to scroll down to access the information; and (k) superimposing important information, statements or warnings across colored or patterned backgrounds which lessen their visual impact. 133. A licensee or promoter shall maintain adequate records of its advertisements, including details of who signed off each advertisement and when it was signed off, for at least seven years after the advertisement ceases to be available to consumers. Record keeping. PART XIV— FREEZING AND SEIZURE ORDERS 134. (1) A freezing order or seizure order under these Regulations shall be obtained in accordance with the procedures and evidentiary requirements set out under the Proceeds of Crime and Anti￾Money Laundering Act, the Anti-Corruption and Economic Crimes Act or any other relevant law relating to the identification, tracing, seizure, or forfeiture of proceeds of crime. Freezing and seizure of virtual assets. (2) The powers of investigation, preservation, seizure, production of records, compensation and forfeiture applicable under the Proceeds of Crime and Anti-Money Laundering Act, the Anti-Corruption and Economic Crimes Act or any other relevant law shall, apply to virtual assets and virtual asset service providers. (3) Nothing in these Regulations shall be construed as limiting the competent authority to seek orders under the Proceeds of Crime and Anti-Money Laundering Act, the Anti-Corruption and Economic Crimes Act or any other relevant law for the recovery of virtual assets that constitute proceeds of crime or unexplained assets. 135.(1) Every licensee shall comply with any freezing order and seizure orders. General obligations of licensee relating to freezing and seizure orders (2) The compliance envisaged under sub regulation (1) shall include— (a) responding promptly to lawful requests for information, documents, records, or other materials relevant to any investigation or proceedings;

Kenya Subsidiary Legislation, 2026 4329 (b) providing access to virtual asset transaction records, consumer identification data, beneficial ownership information, and any other data maintained pursuant to these Regulations; (c) producing documents, records, or information as specified in the freezing or seizure order; (d) maintaining systems and procedures to enable timely and effective responses to competent authority’s requests; (e) cooperating in the execution of court orders, warrants, directives, or other lawful instruments issued by competent authorities. 136. (1) A licensee served with a freezing order shall— Freezing orders: obligations to licensee. (a) immediately freeze the specified virtual assets; (b) prevent withdrawal, transfer or conversion related to the frozen assets; (c) preserve all records relating to the frozen assets, including consumer information, transaction logs, wallet addresses, keys and any other relevant data; (d) ensure that any internal or third-party custodian, sub￾custodian, exchange partner or distributed ledger technology￾infrastructure provider engaged by the licensee also complies with the order to the extent that they maintain control over the assets; (e) comply with competent authorities and provide all documents, records, data, or technical information required in the freezing order, including— (i) addresses or accounts; (ii) consumer identification records; (iii) transaction histories, logs, consumer records and meta￾data; (iv) wallet identifiers, addresses, and associated credentials; and (v) transaction histories. 137. A licensee served with a seizure order shall— Seizure orders: Obligations of licensee. (a) immediately surrender control of the specified virtual assets to the competent authority; (b) provide full access to relevant wallets, addresses or accounts, digital records or as may be specified in the order; (c) transfer the virtual assets to a designated, secure digital wallet controlled by the competent authority;

4330 Kenya Subsidiary Legislation, 2026 (d) provide transaction histories, logs, consumer records and technical information necessary for enforcement of the order; (e) grant an authorised officer access to any premises where the virtual asset devices are suspected to be and the authorised officer may seize and detain any physical device, hardware wallet, seed phrase backup or electronic system necessary to access the virtual assets. 138.(1) An authorised officer shall take all reasonable measures to maintain the value and integrity of seized virtual assets. Preservation of value. (2) The authorised officer may, upon approval of the competent court, convert virtual assets into fiat currency to preserve value. 139.(1) All seized virtual assets shall be transferred to a secure wallet controlled by the relevant government agency. Custody and management of seized virtual assets. (2) The competent authority shall— (a) maintain a detailed chain-of-custody record, including transaction hashes and transfers executed pursuant to the seizure order; and (b) monitor the value of the seized virtual assets. 140.A freezing or seizure order issued under this Part shall— Protection of uninvolved consumers. (a) target specific consumer accounts or specific virtual assets held in custody by the licensee; (b) make provision for the licensee to seek clarification or variation of the order where compliance would affect assets of uninvolved consumers. 141.A licensee that fails to comply with a freezing or seizure order commits an offence and shall be liable, on conviction, to the penalty provided under regulation 143. Offence of failure to comply.

Kenya Subsidiary Legislation, 2026 4331 PART XV— ENFORCEMENT ACTIONS AND GENERAL PROVISIONS 142.(1) A person who contravenes the provisions of these Regulations as envisaged in regulation 14(6), 21(5), 54(5), 56(3), 58(6), 70(2), 85(14), 96(6), 97(8), 100(2), 102(6), 104(11), 105(3), 106(3), 109(5), 123(4), 124(4), 125(7), 126(6), 128(3), 129(2) or 130(2) is liable— Administrative sanctions. (a) in the case of an individual, to an administrative fine not exceeding three million shillings; or (b) in the case of a company, to an administrative fine not exceeding five million shillings. (2) In addition to the penalties provided under subregulation (1), the relevant regulatory authority may take any of the following administrative enforcement actions— (a) suspend or revoke a licence, approval or authorisation issued in accordance with these Regulations; or (b) issue a direction to the person to take remedial action or make specific arrangements to remedy the contravention. 143.A person who commits an offence under these Regulations as envisaged in regulation 12(2), 86(2), 114(2), 115(2), 116(3), 117(2), 118(2), 119(2), 120(2), 121(2), 122(2) or 141 is liable, upon conviction— Criminal sanctions. (a) in the case of an individual, to a fine not exceeding five million shillings or to imprisonment for a term not exceeding five years, or to both; or (b) in the case of a company, to a fine not exceeding eight million shillings. 144.The financial penalties set out under in these Regulations shall be recoverable summarily by the relevant regulatory authorities as civil debt. Recovery of penalties. 145.(1) In furtherance of section 6(1)(g) of the Act, there is established a forum to be known as the Virtual Assets Services Coordination Forum, hereinafter referred to as the “Coordination Forum”. Establishment of the Coordination Forum. (2) The Coordination Forum shall consist of representatives nominated from the agencies specified in the Sixth Schedule. 146.The Coordination Forum shall act as forum for— Mandate of the Forum.

4332 Kenya Subsidiary Legislation, 2026 (a) consultation and co-operation on matters related to virtual asset services; (b) considering any issues raised by the relevant regulatory authorities on matters affecting the implementation of the Act and these Regulations; (c) timely sharing and exchange of risk-based information; (d) harmonizing approaches and resolving cross-sectoral issues affecting the provision of virtual asset services; (e) supporting relevant regulatory authorities in undertaking risk assessments, where appropriate. 147. (1) The Coordination Forum shall meet at least once every quarter and may hold special meetings as required. Conduct of business of the Coordination Forum. (2) The Coordination Forum may establish such sub-committees as it may consider necessary to assist in the performance of its functions. (3) The Coordination Forum shall determine its own procedures. (4) The Coordination Forum shall prepare and submit to the Cabinet Secretary at least once in every year reports of its activities. (5) All members of the Coordination Forum shall comply with confidentiality obligations under section 42 of the Act when sharing information through the Coordination Forum. (6) The Coordination Forum shall be supported by a Secretariat consisting of persons nominated by the relevant regulatory authorities. 148.The relevant regulatory authorities may jointly undertake supervisory and licensing activities under the Act and these Regulations. Joint supervisory and licensing activities. 149. (1) Subject to the Insolvency Act, a licensee may, with the approval of the relevant regulatory authority, voluntarily liquidate itself if it is unable to meet all its liabilities. Voluntary liquidation. (2) An application for approval for the purposes of subregulation (1) shall be made in writing to relevant regulatory authority. (3) The relevant regulatory authority may, upon receipt of an application under subregulation (2), approve the application if satisfied as to the insolvency of the licensee. (4) Where the relevant regulatory authority approves an application by a licensee under this regulation, such licensee shall immediately cease all its operations except the activities that are

Kenya Subsidiary Legislation, 2026 4333 incidental to the orderly realisation, conservation and preservation of its assets and settlement of its obligations. (5) A licensee, where it holds consumer funds, shall discharge its liability to its consumers as soon as practicable after the commencement of the liquidation and shall then rank all other creditors in accordance with the Insolvency Act. 150.(1) The relevant regulatory authority may make an application to the court for the liquidation of a licensee in accordance with Part VI of the Insolvency Act. Involuntary liquidation. (2) If an application for the liquidation of a licensee is presented by a person other than the relevant regulatory authority, the applicant shall serve a copy of the application to the relevant regulatory authority, and the relevant regulatory authority shall be entitled to be a party to the proceedings. 151.A person aggrieved by any decision of the relevant regulatory authority under these Regulations may appeal against that decision in accordance with section 43 of the Act. Appeals.

4334 Kenya Subsidiary Legislation, 2026 FIRST SCHEDULE (rr. 5(1), 6(2)(u), 7, 11(3)(b), 13(1), 29(2), 49(2)(g); 61(2)(c), 62(2)(h)) FEES PAYABLE

1. APPLICATION AND LICENCE FEES No. Types Application Fee (KSh.) Licence Fee (KSh.)
2. Virtual Asset Wallet Provider 100,000 500,000
3. Virtual Asset Exchange 100,000 1,000,000
4. Virtual Asset Payment Processor 100,000 200,000
5. Virtual Asset Broker 100,000 100,000
6. Virtual Assets Investment Advisor 10,000 50,000
7. Virtual Asset Manager 50,000 200,000
8. Virtual Asset Offering Provider - Initial Coin Offering 100,000 500,000
9. Virtual Asset Offering Provider - Virtual Asset Tokenization 100,000 500,000
10. Virtual Asset Offering Provider - Token Issuance Platform 100,000 500,000
11. Virtual Asset Offering Provider - Stablecoin Issuance 100,000 2,000,000
12. RENEWAL FEES No. Types Renewal Fee (KSh.)
13. Virtual Asset Wallet Provider 500,000 or 0.15% of gross turnover, whichever is higher
14. Virtual Asset Exchange 500,000 or 0.5 % of the gross revenue of the previous year, whichever is higher
15. Virtual Asset Broker 100,000
16. Virtual Assets Investment Advisor 50,000
17. Virtual Asset Manager 0.05% of assets under management, subject to a minimum of Kshs.200,000 and a maximum of Kshs.5,000,000

Kenya Subsidiary Legislation, 2026 4335 No. Types Renewal Fee (KSh.) 6. Virtual Asset Offering Provider - Initial Coin Offering 500,000 or 0.15% of gross turnover, whichever is higher 7. Virtual Asset Offering Provider - Virtual Asset Tokenization 500,000 or 0.15% of gross turnover, whichever is higher 8. Virtual Asset Offering Provider - Token Issuance Platform 500,000 or 0.15% of gross turnover, whichever is higher 9. Virtual Asset Offering Provider - Stablecoin Issuance 2,000,000 or 0.15% of gross turnover, whichever is higher 10. Virtual Asset Payment Processor Threshold (Gross transaction value per annum in Kshs.) Renewal Fee (Kshs) Zero (0) – one billion 20,000 One billion and one – Ten billion 100,000 Ten billion and one– Fifty billion 500,000 Fifty billion and one – one hundred billion 1,000,000 one hundred billion and one– five hundred billion 5,000,000 five hundred billion and one – one trillion 10,000,000 Above one trillion 15,000,000 3. APPROVAL FEES No. Fee Type Fee payable to the relevant regulatory authority (KSh.)

1. Approval of initial coin offering 0.25 % of the value of the successful offer, subject to a minimum of Kshs.200,000 and a maximum of Ksh. 30 million
2. Approval of virtual asset tokenisation 0.25 % of the value of the successful offer, subject to a minimum of Kshs.200,000 and a maximum of Ksh. 30 million

4336 Kenya Subsidiary Legislation, 2026 4. OTHER FEES No. Description of fee Amount (KSh.)

1. Approval fee for proposed acquisition, transfer or disposal of shares in a licencee 0.25 % of the transaction value or Ksh.50,000, whichever is higher.
2. Approval fee for assignment or transfer of a licence Licence fee for the license category

Kenya Subsidiary Legislation, 2026 4337 SECOND SCHEDULE FORMS APPLICATION FORM FOR VIRTUAL ASSET SERVICE PROVIDER LICENCE (rr. 6(1) & 11(3)(a)) The relevant parts of this Form are to be completed by applicants and shall be submitted with any additional information that is required to the relevant regulatory authority. PART A: APPLICANT’S GENERAL INFORMATION

1. Name of Applicant ................................................................................................... ...................................................................................................................................
2. Trading name(s) of applicant
3. Any other commercial name by which applicant is known or operating as: ........... ...................................................................................................................................
4. Former name(s) (if any) by which the virtual asset service provider has been known .............................................................................................................. ...................................................................................................................................
5. Date of Incorporation ...............................................................................................
6. Certificate Reg. No. .................................................................................................. Full Business Contact Details of Applicant
7. Physical office in Kenya: L.R. No: ............................................... Street: .............................................................. Building:......................................................................................................................... Town/City: ....................................................................................................................
8. Postal Address and Postal Code: ..............................................................................
9. Geolocation Address / Google Maps location pin: ..................................................
10. Telephone No: ..........................................................................................................
11. KRA P.I.N.: ..............................................................................................................
12. E-mail address ..........................................................................................................
13. Website: .................................................................................................................... 14.Location of other offices in Kenya: County Physical Address Telephone Number Email Address

4338 Kenya Subsidiary Legislation, 2026 15. Countries of operation: Country Name Trade Name Regulator (where applicable) Products and services provided Physical Address of Offices Telephone Number Email Address 16. Parent company: Name Trade Name Regulator (where applicable) Virtual asset services provided Physical Address of Offices Telephone Number Email Address 17. Registered subsidiaries: Name Trade Name Regulator Products and services provided Physical Address of Offices Telephon e Number Email Address PART B: TYPE OF VIRTUAL ASSET ACTIVITIES 18. Specify the type(s) of virtual asset activities for which the Applicant is applying for a license as specified in the First Schedule of the Act ............................................................................................................................................ ............................................................................................................................................ ............................................................................................................................................ ............................................................................................................................................

Kenya Subsidiary Legislation, 2026 4339 PART C: PARTICULARS OF SHAREHOLDERS, DIRECTORS, AND SENIOR OFFICERS 19. Provide full details of Shareholders, Directors, and Senior Officers in the format below. 19.1 Particulars of shareholding: Note: If more than 10 shareholders, attach a list. Name Nationality Individual/ Corporate Percentage (%) Shareholding 1 2 3 4 5 6 7 8 9 10 19.2 Particulars of Directors Name of Propos ed Directo r Age and Nationali ty Proposed Capacity (Executiv e /Non￾Executive ) ID No./ Passpo rt No. Qualificatio n (academic and professional ) Postal and Email address Tele￾phone contacts Experienc e / previous employme nt Other Current Director ship (s) 1. 2. 3. 4.

4340 Kenya Subsidiary Legislation, 2026 19.3 Particulars of Senior Officers Na me of Pro pos ed Sen ior Off ice r Age and Nation ality Propos ed Design ation ID No./ Pass port No. Qualific ation (academ ic and professi onal) Post al and Ema il addr ess Teleph one contac ts Experie nce /previo us employ ment Curr ent Posit ion 1. 2. 3. 4. PART D: CAPITAL STRUCTURE AND APPLICANT OPERATIONS 20. Details of the Applicant’s capital structure i. Nominal capital (KSh.) ...................................................................................... ii. Number of shares: .............................................................................................. iii. Paid up capital (KSh.):....................................................................................... 21. Evidence that the Applicant has adequate insurance in accordance with regulation 29. Insurance policy/proposal coverage: __________________ 22. Provide names and addresses of principal bankers for the virtual asset business. Name of bank: ............................................................................................................. Branch name: .............................................................................................................. Account name: ............................................................................................................ Account number: ........................................................................................................ Bank Address: ............................................................................................................. I/we enclose an original letter from my/our bank confirming the above. Note: If there is more than one bank account for the virtual asset business, provide

Kenya Subsidiary Legislation, 2026 4341 full details. 23. Provide a list of your proposed virtual asset custodians, virtual asset service providers offering any other services to you, and other service and technical providers, as applicable. Description Services Provided 24. For virtual asset wallet providers, indicate the types and amounts of virtual assets which the applicant proposes to hold on behalf of consumers and reasons for facilitating the safekeeping of these virtual assets....................................................... ..................................................................................................................................... ..................................................................................................................................... ..................................................................................................................................... 25. For virtual asset exchanges, provide a list of virtual assets to be listed on the exchange. ..................................................................................................................................... ..................................................................................................................................... ..................................................................................................................................... 26. Operational Capabilities Provide a detailed description of the Applicant’s operational capabilities, including the physical premises, cybersecurity protocols, data management systems, data protection systems, risk management systems,, virtual clearing, virtual custody arrangements (including segregation of consumer virtual assets), communication capabilities, business continuity plans, disaster recovery plans, and recovery and redemption plans, as applicable. ........................................................................................................................................ ........................................................................................................................................ ........................................................................................................................................ 27. Policies and Procedures Provide a summary of the applicant’s written audit, internal controls and risk management policies and procedures, including: (a) Virtual asset management (b) Information and Communications Technology (ICT)

4342 Kenya Subsidiary Legislation, 2026 (c) Cybersecurity (d) Data protection (e) Outsourcing (f) Operational controls (g) AML/CFT/CPF policies and controls (h) Reporting policies (i) Corporate governance (j) Code of conduct (k) Market conduct (l) Consumer protection (Attach a complete copy of these policies and procedures. 28. Financial Statements Provide the audited financial statements, for the two years immediately preceding the year of application or the opening financial statement verified by an auditor (as applicable). 29. Funding The existing and/or intended sources of funds to be utilised in the virtual asset business are as follows: Type of Funding Approximate Percentage Own funds Borrowed funds Donor funds Any other (please specify) 30. Contact Person of the Applicant Give the name, business telephone number, and email address of a senior officer of the Applicant who is knowledgeable about the application and who may be contacted to discuss it. Name: .......................................................................................................................... Telephone Number: .................................................................................................... Email Address: ............................................................................................................ PART E: DECLARATION DECLARATION: To be signed and submitted by two directors of the applicant. We, the undersigned, declare that we are duly authorised to make this application. We confirm that we have read and understood the provisions of the Virtual Asset Service

Kenya Subsidiary Legislation, 2026 4343 Providers Act and the Regulations made under it and the Proceeds of Crime and Anti￾Money Laundering Act and the Regulations made under it, and we declare that the business in respect of which this application is made will be conducted in accordance with the law. We declare the information provided in the application to be accurate in all material aspects to the best of our knowledge and belief. We affirm that to the best of our information, knowledge and belief, the applicant is currently in compliance with all the applicable provisions of the Act; and the contents of this form and any attachments provided with this form are true, correct and not misleading. Certification and signature of at least two directors DIRECTOR: (Name and signature) DIRECTOR: (Name and signature) Date: WITNESSED BEFORE ME: COMMISSIONER FOR OATHS/MAGISTRATE Name: ................................................................................................................................... Signature: ............................................................................................................................. Address: ................................................................................................................................ Date and Stamp: ................................................................................................................... REQUIRED ATTACHMENTS I/We enclose the following: Non-refundable application fee as per the schedule.

1. Identity documents, including passports and proof residence for each natural person in Part B.
2. A certified copy of the applicant’s Memorandum and Articles of Association, or equivalent incorporation documents by which the applicant is constituted.
3. Certificate of Incorporation from Registrar of Companies.
4. CR12 and BOF1 form.
5. Copy of PIN tax compliance certificate for the Applicant.
6. A copy of any other registration or licensing certificate (if applicable).
7. Copy of the latest financial statements of the business (if already conducting a virtual asset business) or statement of financial position (if the applicant has not commenced operations).

4344 Kenya Subsidiary Legislation, 2026 8. Copy of the applicant’s detailed and up to date business plan, inclusive of financial and operational projections, staffing requirements, a description of the products and services offered, target market and technological requirements as per the Regulations. 9. Copy of the applicant’s written supervisory, internal controls and risk management policies and procedures. 10. Evidence that the applicant has adequate insurance and minimum base capital in accordance with regulation 4. 11. Organisational structure, including job descriptions for each office bearer. 12. A schedule of proposed fees for services rendered by the virtual asset business. 13. Copy of the applicant’s written policies and procedures, including: (a) Virtual asset management (b) Information and Communications Technology (ICT) (c) Cybersecurity (d) Data protection (e) Outsourcing (f) Operational controls (g) AML/CFT/CPF policies and controls (h) Reporting policies (i) Corporate governance (j) Code of conduct (k) Market conduct (l) Consumer protection 14. The annual accounts, for the two years immediately preceding the year of application of each corporate shareholder holding more than ten per cent of the applicant’s issued share capital or total voting rights. 15. A statement indicating whether the applicant intends to provide any other services which are regulated under the Act and these Regulations. 16. Evidence that the applicant has adequate insurance and regulatory capital. 17. Evidence of the applicant’s registration with any other regulatory authority, if applicable. 18. Completed Fit and Proper forms as per the Regulations in respect of each significant shareholder, beneficial owner, director and senior officer of the Applicant. 19. Names and addresses of service providers – (i.e., banks, audit firms, attorneys, and custodians, etc.) 20. Copies of outsourcing or service level agreements (if applicable). 21. An organizational chart of the company ownership structure.

Kenya Subsidiary Legislation, 2026 4345 22. A declaration by the individual significant shareholders and directors on the sources of funds. The declaration should be certified by an Advocate or a Commissioner for Oaths 23. All additional information as to be provided in the Application form above. 24. Provide a copy of any agreement, contract or disclosure which will be used during the provision of virtual asset custody services, outlining all information that will be provided to the owners of the virtual assets including, but not limited to, fees, compensation structures, recourse available to the owners of the assets in event of loss and the method by which the owners may access the virtual assets. 25. Provide information about contracts with affiliates or any other third parties regarding any services related to the provision of virtual asset custody services which will be outsourced or provided by a third party. 26. Indicate where physical hardware supporting the trading platform will be located. 27. Provide standard consumer agreements and terms by which each specific virtual asset will be listed, traded or exchanged, or which consumers will be presented with. 28. Provide a detailed outline of the applicant’s measures to identify and prevent conflicts of interest, insider trading or price manipulation. 29. Provide a statement outlining the proposed clearing and settlement process which will be utilized by the trading platform in order to perfect trades and exchanges.

4346 Kenya Subsidiary Legislation, 2026 APPLICATION FORM FOR RENEWAL OF VIRTUAL ASSET SERVICE PROVIDER LICENCE (r. 11(3)(a)) The relevant parts of this Form are to be completed by licensees and shall be submitted with any additional information that is required to the relevant regulatory authority. PART A: LICENSEE’S GENERAL INFORMATION

1. Name of Virtual Asset Service Provider .......................................................................
2. Physical address: L.R. No: ................................................... Street: .......................................................... Building:......................................................................................................................... Town/City: ....................................................................................................................
3. Postal Address and Postal Code: ...................................................................................
4. Geolocation Address / Google Maps location pin: . ...................................................... .
5. Telephone No: ..............................................................................................................
6. E-mail address ...............................................................................................................
7. Website: ........................................................................................................................
8. Date of incorporation ....................................................................................................
9. Certificate of incorporation No. .....................................................................................
10. Number and date of issue of previous licence Licence Number: ........................................................................................................... Date issued: ...................................................................................................................
11. Licensed virtual asset activities ............................................................................................................................................. ............................................................................................................................................. ............................................................................................................................................. .............................................................................................................................................
12. Location of other offices in Kenya: County Physical Address Telephone Number Email Address

Kenya Subsidiary Legislation, 2026 4347 13. Countries of operation: Country Name Trade Name Regulator (where applicable) Products and services provided Physical Address of Offices Telephon e Number Email Address 14. Parent company: Name Trade Name Regulator (where applicable) Virtual asset services provided Physical Address of Offices Telephone Number Email Address 15. Registered subsidiaries: Name Trade name Regulator Products and services provided Physical Address of Offices Telephone number Email Address

4348 Kenya Subsidiary Legislation, 2026 PART C: PARTICULARS OF SHAREHOLDERS, DIRECTORS, AND SENIOR OFFICERS 16. Provide full details of Shareholders, Directors, and Senior Officers in the format below. Particulars of shareholding: Note: If more than 10 shareholders, attach a list. Name Nationality Individual/ Corporate Percentage (%) Shareholding 1 2 3 4 5 6 7 8 9 10 Particulars of Directors

Name of Propos ed Direct or Age and Natio nality Proposed Capacity (Executiv e /Non￾Executive ) ID No. / Passp ort No. Qualification (academic and professional) Postal and Email address Tele￾phone contacts Experience / previous employment Other Current Director ship (s) 1. 2. 3. 4.

Kenya Subsidiary Legislation, 2026 4349

Particulars of Senior Officers Name of Propose d Senior Officer Age and National ity Propose d Designa tion ID No./ Passpo rt No. Qualificatio n (academic and professional ) Postal and Email address Telepho ne contacts Experien ce /previous employm ent Curren t Positio n 1. 2. 3. 4. Particulars of shareholding: Name of Proposed Senior Officer Age and Nati onal ity Propos ed Designatio n ID No ./ Pa ssp ort No . Qualificati on (academic and profession al) Postal and Email addre ss Tele phon e conta cts Experie nce / previou s employ ment Curr ent Position 1. 2. 3. PART D: LICENSEE’S OPERATIONS 17. Insurance service provider: ………………………………………………… 18. Insurance policy coverage: ………………………………………………… 19. Provide names and addresses of principal bankers for the virtual asset business. Name of bank: ............................................................................................................. Branch name: .............................................................................................................. Account name: ............................................................................................................ Account number: ........................................................................................................

4350 Kenya Subsidiary Legislation, 2026 Bank Address: ............................................................................................................. Note: If there is more than one bank account for the virtual asset business, provide full details. 20. Provide a list of your virtual asset custodians, virtual asset service providers offering any other services to you, and other service and technical providers, as applicable. Description Services Provided 21. For virtual asset wallet providers, indicate the types and amounts of virtual assets which the licensee holds on behalf of consumers and reasons for facilitating the safekeeping of these virtual assets. ..................................................................................................................................... ..................................................................................................................................... ..................................................................................................................................... 22. For virtual asset exchanges, provide a list of virtual assets listed on the exchange. ..................................................................................................................................... ..................................................................................................................................... ..................................................................................................................................... 23. Contact Person of the Licensee Give the name, business telephone number, and email address of a senior officer of the licensee who is knowledgeable about the application for licence renewal and who may be contacted to discuss it. Name: ................................................................................................................................... Telephone Number: .............................................................................................................. Email Address: ..................................................................................................................... PART E: DECLARATION DECLARATION: To be signed and submitted by two directors of the licensee. We, the undersigned, declare that we are duly authorised to make this licence renewal application. We confirm that we have read and understood the provisions of the Virtual Asset Service Providers Act and the Regulations made under it and the Proceeds of Crime and Anti-Money Laundering Act and the Regulations made under it, and we declare that the business in respect of which this application is made will be conducted in accordance with the law. We declare the information provided in the application to be accurate in all material aspects to the best of our knowledge and belief.

Kenya Subsidiary Legislation, 2026 4351 We affirm that to the best of our information, knowledge and belief, the institution is currently in compliance with all the applicable provisions of the Act; and the contents of this form and any attachments provided with this form are true, correct and not misleading. Certification and signature of at least two directors DIRECTOR: (Name and signature) DIRECTOR: (Name and signature) Date: WITNESSED BEFORE ME: COMMISSIONER FOR OATHS/MAGISTRATE Name: ................................................................................................................................... Signature: ............................................................................................................................. ....................................................................................................................... Address: ............................................................................................................................... . Date and Stamp: ................................................................................................................... REQUIRED ATTACHMENTS I/We enclose the following:

1. Non-refundable licence renewal fee as per the schedule.
2. CR12 and BOF1 form.
3. Copy of the latest financial statements of the business.
4. Names and addresses of service providers – (i.e., bankers, audit firms, attorneys, and custodians, etc.)
5. An organizational chart of the company ownership structure.
6. An organizational structure chart showing the governance, management, and reporting lines of the company.

4352 Kenya Subsidiary Legislation, 2026 THIRD SCHEDULE (r. 6(2)(b)) CONTENTS OF A BUSINESS PLAN Please provide a business plan ensuring that the following details are included in the sequence provided below. Any additional information is encouraged.

1. Executive Summary § Overview of the proposed VASP business § Vision and mission statement § Rationale for market entry
2. Corporate Governance Structure § Proposed board structure and committees § Board charter, including roles and responsibilities of the Board and its committees
3. Operational Plan § Staffing and organisational structure § Powers and duties of senior officers § Premises and facilities § Outsourcing arrangements (if any)
4. Description of Virtual Asset Services to be Offered § Nature and scope of activities § Operating model and service delivery channels § Consumer onboarding and due diligence procedures § Terms, conditions and charges for virtual asset services
5. Technology and Security Infrastructure § Description of the ICT systems, cybersecurity controls, network architecture diagram, data flow diagram, interactions with other key components, and the standards they conform to. § Trading systems § Wallet infrastructure and addresses (hot/cold storage) § Data protection and privacy measures
6. Risk Management Framework § Risk register identifying key risks (market, operational, technology, liquidity, custody, fraud, etc.) and risk mitigation strategies. § Business continuity and disaster recovery plan.
7. Compliance and Internal Controls § AML/CFT/CPF framework § Compliance monitoring plan

Kenya Subsidiary Legislation, 2026 4353 8. Financial Projections § Revenue model and cost structure § Capital adequacy and liquidity plans § 3- to 5-year financial projections including Income Statements, statement of financial position and Cash Flow statement projections. 9. Market Analysis § Target market segmentation § Competitor landscape § Expected market share and growth strategy § Identification of market needs 10. Fees and Charges Structure § Trading fees § Transfer fees § Commissions § Management fees § Other charges 11. Consumer Assets and Safeguarding Arrangements § Segregation of consumer and firm assets § Insurance/compensation arrangements § Mechanisms put in place to protect consumers’ funds in the eventuality of system failure, revocation/suspension of license/insolvency of the entity/discontinuation of business. 12. Implementation Plan § Timelines for rollout of virtual asset services § Key milestones § Resource allocation § Indicate envisioned rollout plan for the first three years: Year Number of Consumers Value Volume Year 1 Year 2 Year 3

4354 Kenya Subsidiary Legislation, 2026 FOURTH SCHEDULE (r. 6(2)(c)) FIT AND PROPER ASSESEMENT FIT AND PROPER FORM FOR DIRECTORS, CHIEF EXECUTIVE OFFICER AND SENIOR OFFICERS NB: This form should be duly completed, accompanied by the complete set of documents required under the Regulations and submitted to the relevant regulatory authority.

1. VIRTUAL ASSET PROVIDER Name of Virtual Asset Service Provider: ............................................................................. ............................................................................................................................................... Proposed position: ................................................................................................................
2. PERSONAL INFORMATION (a) Surname……........................ Other Names....................................... (b) Previous Names (if any) by which you have been known: ……….. Reasons for change of names ........................................................................................ (c) Year and Place of birth: …………………………………………… (d) Nationality and how acquired …………………………………….. (e) Personal Identification Number (PIN) ................................................................... (f) Identification Card number and date of issue ........................................................ (g) Passport number, place and date of issue .............................................................. (h) Postal Address: ...................................................................................................... (i) Physical Address: ................................................................................................... (j) Email address: ........................................................................................................ (k) Telephone numbers: ...............................................................................................
3. EDUCATIONAL QUALIFICATIONS Qualifications Year Obtained Examining Body Grade Obtained

Kenya Subsidiary Legislation, 2026 4355 4. PROFESSIONAL QUALIFICATIONS AND YEARS OBTAINED Qualifications Year Obtained Examining Body Grade Obtained 1. 2. 3. 5. NAME (S) OF YOUR BANKERS DURING THE LAST 5 YEARS: ............................................................................................................................................... ............................................................................................................................................... ............................................................................................................................................... 6. RESPONSIBILITIES OF PROPOSED POSITION ............................................................................................................................................... ............................................................................................................................................... ............................................................................................................................................... 7. EMPLOYMENT/ BUSINESS RECORD Period Name of Employer/ Business Position Held & Dates Responsibilities Reasons for Leaving (where applicable)

8. DESCRIPTION OF PAST AND PRESENT ACTIVITIES IN KENYA AND ABROAD 8.1 Shareholding (Directly Owned Or Through Nominees) In The Past 5 Years Company’s Name Certificate of registration No. Number of Shares held % of Significant Shareholding Name and address of Beneficial Owner of shares Past Shareholding

4356 Kenya Subsidiary Legislation, 2026 8.2 Directorships In The Past 5 Years Company’s Name Certificate of registration No. Executive or Non-executive Position held Date of appointment Reasons for leaving

8.3 Membership To Professional Bodies Name of the institution Membership No. Position held Current status of membership Reasons for leaving

9. HISTORY 9.1 Have you ever defaulted in your financial obligations in the last five years? ............................................................................................................................................... ............................................................................................................................................... ............................................................................................................................................... If yes, give details ............................................................................................................... 9.2 Have you at any time been convicted of any offence involving dishonesty or fraud or contravened any law designed to protect members of the public arising from dishonesty, incompetence, malpractice, misconduct in any jurisdiction. If so, give particulars of the court and case number in which you were convicted, the offence, the penalty imposed and the date of conviction ………... ........................................................................................................................................ ........................................................................................................................................ ........................................................................................................................................ 9.3 Do you confirm that if appointed as a director of the Company that you will undertake your role diligently, in accordance with the duties of a director under the law and that you will do so without reservation? If so give particulars ........................................................................................................................................ ........................................................................................................................................ ........................................................................................................................................ 9.4 Do you confirm that if you have the knowledge and understanding of the legal and professional obligations to be assumed or undertaken with your position? If so, give particulars?

Kenya Subsidiary Legislation, 2026 4357 ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... 9.5 Have you ever been disqualified, under any legislation or regulation from acting as a director or serving in a managerial capacity? ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... 9.6 Have you, in any country, ever been dismissed from any office or employment, or been asked to resign or resigned from employment or position of trust or fiduciary appointment? If so give particulars ..................................................................................................................................... ..................................................................................................................................... ..................................................................................................................................... 9.7 Have you ever been adjudged bankrupt?.............................................. If so, give particulars ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... 9.8 Have you ever been convicted of fraud or theft by a court of law in any country? If so, give particulars ..................................................................................................................................... ..................................................................................................................................... ..................................................................................................................................... 9.9 Have you ever been convicted of offences under any virtual assets law in any country? If so, give particulars ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... 9.10 Has any entity with which you were associated as a director, shareholder or manager in any country been in financial distress, made any compromise or arrangement with its creditors, been wound up or otherwise ceased business either while you were associated with it or within three years after you ceased to be associated with it? If so, give particulars ....................................................................................................................................... ....................................................................................................................................... .......................................................................................................................................

4358 Kenya Subsidiary Legislation, 2026 9.11 Indicate the names, postal and e-mail addresses, telephone numbers and positions of at least three individuals of good standing who would be able to provide a reference on your personal and professional integrity. The referees must not be related to you, and should have known you for at least five years. Name of Referee Postal Address E-mail address Tel no. (s) Position (where applicable) Relationship with applicant 1. 2. 3. 9.12 Is there any additional information which you consider relevant for the consideration of your suitability or otherwise for the position(s) held / to be held? The omission of material facts may represent the provision of misleading information ............................................................................................................................................ ............................................................................................................................................ ............................................................................................................................................ 10. DECLARATION I am an adult of sound mind. I am aware that it is an offence to knowingly provide any information, which is false or misleading. I am also aware that omitting material information intentionally shall be construed to be an offence. I certify that the information given above is complete and accurate to the best of my knowledge, and that there are no other facts relevant to this application of which the relevant regulatory authority should be aware. I undertake to inform the relevant regulatory authority of any material changes to the information provided herein: NAME..................................................................................................................................... POSITION HELD ..................................................................................................................... DATE AT ...................................................... THIS DAY OF.................................................. SIGNED.. ................................................................................................................................ (Applicant) (This declaration must be signed in the presence of the witness named below) WITNESSED BEFORE ME: COMMISSIONER FOR OATHS/MAGISTRATE Name: .................................................................................................................................. Signature: ........................................................................................................................... Address: .............................................................................................................................. Date and Stamp: .................................................................................................................

Kenya Subsidiary Legislation, 2026 4359 Attachments:

1. Curriculum Vitae and certified copies of academic and professional certificates.
2. Certified copies of National Identity Card and Personal Identification Number (PIN) certificate.
3. Current credit rating report from a credit reference bureau.
4. Total number and the percentage of shares to be acquired and evidence of the consideration given or to be given for the same.
5. For shareholders, provide a declaration witnessed by an advocate indicating that none of the funds the shareholder, beneficial owners, or directors seeks to invest are from proceeds of crime.
6. Current credit rating report from a credit reference bureau.
7. CR12 and BOF1 for corporate shareholders

4360 Kenya Subsidiary Legislation, 2026 FIT AND PROPER FORM FOR BENEFICIAL OWNERS NB: This form should be duly completed, accompanied by the complete set of documents required under Part III and submitted to the relevant regulatory authority.

1. VIRTUAL ASSET PROVIDER Name of Virtual Asset Service Provider: Proposed position .........................................................................................
2. PERSONAL INFORMATION (a) Surname ……........................... Other Names ....................................................... (b) Previous Names (if any) by which you have been known: .................................... Reasons for change of names ................................................................................. (c) Year and Place of birth: . ........................................................................................ (d) Nationality and how acquired ................................................................................ (e) Personal Identification Number (PIN) ................................................................... (f) Identification Card number and date of issue ........................................................ (g) Passport number, place and date of issue................................................................ (h) Postal Address: ...................................................................................................... (i) Physical Address: ................................................................................................... (j) Email address: ........................................................................................................ (k) Telephone numbers: ............................................................................................... (l) Name(s) of your bankers during the last 5 years: ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... (m) Responsibilities of proposed position ...................................................................................................................................... ...................................................................................................................................... ......................................................................................................................................
3. DESCRIPTION OF PAST AND PRESENT ACTIVITIES IN KENYA AND ABROAD 3.1 SHAREHOLDING (DIRECTLY OWNED OR THROUGH NOMINEES) IN THE PAST 5 YEARS Company’s Name Certificate of registration No. Number of Shares held % of Significant Shareholding Name and address of Beneficial Owner of shares Past Shareholding

Kenya Subsidiary Legislation, 2026 4361 3.2 DIRECTORSHIPS IN THE PAST 5 YEARS Company’s Name Certificate of registration No. Executive or Non￾executive Position held Date of appointment Reasons for leaving

4. HISTORY 4.1 Have you ever defaulted in your financial obligations in the last five years? If yes, give details ....................................................................................................... ........................................................................................................................................ ........................................................................................................................................ 4.2 Have you at any time been convicted of any offence involving dishonesty or fraud or contravened any law designed to protect members of the public arising from dishonesty, incompetence, malpractice, misconduct in any jurisdiction. If so, give particulars of the court and case number in which you were convicted, the offence, the penalty imposed and the date of conviction ............................................................................................................................................... ............................................................................................................................................... ............................................................................................................................................... 4.3 Do you confirm that if appointed as a director of the Company that you will undertake your role diligently, in accordance with the duties of a director under the law and that you will do so without reservation? If so give particulars ........................................................................................................................................ ........................................................................................................................................ ........................................................................................................................................ 4.4 Do you confirm that if you have the knowledge and understanding of the legal and professional obligations to be assumed or undertaken with your position? If so, give particulars? .................................................................................................................... ........................................................................................................................................ ........................................................................................................................................ 4.5 Have you ever been disqualified, under any legislation or regulation from acting as a director or serving in a managerial capacity? .................................... ........................................................................................................................................ ........................................................................................................................................ 4.6 Have you, in any country, ever been dismissed from any office or employment, or been asked to resign or resigned from employment or position of trust or fiduciary appointment? If so give particulars ........................................ ........................................................................................................................................ ........................................................................................................................................

4362 Kenya Subsidiary Legislation, 2026 Have you ever been adjudged bankrupt? ....................................................................... If so, give particulars ........................................................................................................ ............................................................................................................................................... ............................................................................................................................................... 4.7 Have you ever been convicted of fraud or theft by a court of law in any country? If so, give particulars ............................................................................................................................................... ............................................................................................................................................... ............................................................................................................................................... 4.8 Have you ever been convicted of offences under any virtual assets law in any country? If so, give particulars ........................................................................................................................................ ........................................................................................................................................ ........................................................................................................................................ 4.9 Has any entity with which you were associated as a director, shareholder or manager in any country been in financial distress, made any compromise or arrangement with its creditors, been wound up or otherwise ceased business either while you were associated with it or within three years after you ceased to be associated with it? If so, give particulars .................................................................... ........................................................................................................................................ ........................................................................................................................................ 4.10Indicate the names, postal and e-­mail addresses, telephone numbers and positions of at least three individuals of good standing who would be able to provide a reference on your personal and professional integrity. The referees must not be related to you, and should have known you for at least five years. Name of Referee Postal Address E-mail address Tel no. (s) Position (where applicable) Relationship with applicant 1. 2. 3. 4.11Is there any additional information which you consider relevant for the consideration of your suitability or otherwise for the position(s) held/to be held? The omission of material facts may represent the provision of misleading information ............................................................................................................................................... ............................................................................................................................................... ...............................................................................................................................................

Kenya Subsidiary Legislation, 2026 4363 5. DECLARATION I am an adult of sound mind. I am aware that it is an offence to knowingly provide any information, which is false or misleading. I am also aware that omitting material information intentionally shall be construed to be an offence. I certify that the information given above is complete and accurate to the best of my knowledge, and that there are no other facts relevant to this application of which the relevant regulatory authority should be aware. I undertake to inform the relevant regulatory authority of any material changes to the information provided herein: NAME….....…………………….............. POSITION HELD ................................................... DATED AT …........................... THIS DAY OF ...................................................................... SIGNED................................................................................................................................... (Applicant) (This declaration must be signed in the presence of the witness named below) WITNESSED BEFORE ME: COMMISSIONER FOR OATHS/MAGISTRATE Name: ................................................................................................................................... Signature: ............................................................................................................................ Address: ............................................................................................................................... Date and Stamp: ................................................................................................................. Attachments:

1. Curriculum Vitae and certified copies of academic and professional certificates.
2. Certified copies of National Identity Card and Personal Identification Number (PIN) certificate.
3. Current credit rating report from a credit reference bureau.
4. Total number and the percentage of shares to be acquired and evidence of the consideration given or to be given for the same.
5. For shareholders, provide a declaration witnessed by an advocate indicating that none of the funds the shareholder, beneficial owners, or directors seeks to invest are from proceeds of crime.
6. Current credit rating report from a credit reference bureau.
7. CR12 and BOF1 for corporate shareholders

4364 Kenya Subsidiary Legislation, 2026 FIT AND PROPER FORM FOR OTHER PERSONS NB: This form should be duly completed and submitted accompanied by the complete set of documents provided under Regulations.

1. VIRTUAL ASSET PROVIDER Name of Virtual Asset Service Provider: ........................................................................ Proposed position: ...........................................................................................................
2. INFORMATION (a) Name of the corporate body/individual ................................................................. (b) Previous names (if any) by which you have been known ...................................... (c) Date of incorporation/birth ..................................................................................... (d) Country of incorporation/birth ............................................................................... (e) Registration No./Identification No./Passport No. .................................................. (f) Personal Identification No./Tax Registration No. .................................................. (g) Contacts details ...................................................................................................... (h) Name(s) of your bankers over the last 5 years ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... .......................................................................................................................................
3. DESCRIPTION OF PAST AND PRESENT ACTIVITIES IN KENYA AND ABROAD 3.1 SOURCES OF FUNDS Please provide details of the actual source(s) of funds that you, as a shareholder, would like to invest or use in the acquisition of shares in the virtual asset service provider. (a) ...................................................................................................................... (b) ...................................................................................................................... (c) ...................................................................................................................... 3.1 DECLARATION ON THE SOURCES OF FUNDS Please provide a sworn statement that the funds that you, as a shareholder, would like to invest or use in the acquisition of shares in the virtual asset service provider are not from proceeds of crime. 3.2 Have you or any entity with which you are associated as director, shareholder or senior officer, ever held or applied for a license or equivalent authorisation to carry on any business activity in any country? If so, give particulars. If any such application was rejected or withdrawn after it was made or any authorisation revoked, give particulars. ....................................................................................................................................... ....................................................................................................................................... .......................................................................................................................................

Kenya Subsidiary Legislation, 2026 4365 3.3 Have you, or any entity with which you have been involved, been censured, disciplined, warned as to future conduct, or publicly criticized by any regulatory authority or any professional body in any country? If so, give particulars 3.4 Have you at any time been convicted of any criminal offence in any jurisdiction? If so, give particulars of the court and case number in which you were convicted, the offence, the penalty imposed and the date of conviction ..................................................................................................................................... ..................................................................................................................................... ..................................................................................................................................... 3.5 Have you, or has any entity with which you are, or have been associated as a director, shareholder or senior officer, been the subject of an investigation, in any country, by a government department or agency, professional association or other regulatory body? If so, give particulars ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... 3.6 Have you failed to satisfy debt adjudged due and payable by you on order of court, in any country, or have you made any compromise arrangement with your creditors within the last 10 years? If so, give particulars ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... 3.7 Have you ever been declared bankrupt by a court in any country or has a Bankruptcy petition ever been served on you? If so, give particulars ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... 3.8 Have you ever been disqualified, under any legislation or regulation from acting as a director or serving in a senior managerial capacity? ..................................................................................................................................... ..................................................................................................................................... ..................................................................................................................................... 3.9 Have you, in any country, ever been dismissed from any office or employment, or been asked to resign or resigned from employment or position of trust or fiduciary appointment? If so give particulars ....................................................................................................................................... ....................................................................................................................................... ....................................................................................................................................... 3.10 Have you ever been convicted of offences under any virtual assets law in any country? If so, give particulars ..................................................................................................................................... ..................................................................................................................................... .....................................................................................................................................

4366 Kenya Subsidiary Legislation, 2026 3.11 Has any entity with which you were associated as a director, shareholder or manager in any country been in financial distress, made any compromise or arrangement with its creditors, been wound up or otherwise ceased business either while you were associated with it or within three years after you ceased to be associated with it? If so, give particulars .................................................................................................................................... .................................................................................................................................... .................................................................................................................................... 4. DECLARATION I am aware that it is an offence to knowingly provide any information, which is false or misleading. I am also aware that omitting material information intentionally shall be construed to be an offence. I certify that the information given above is complete and accurate to the best of my knowledge, and that there are no other facts relevant to this application of which the relevant regulatory authority should be aware. I undertake to inform the relevant regulatory authority of any material changes to the information provided herein NAME: .................................................................................................................................... DATED AT:………………. THIS…………… DAY OF……....…… 20.................................... WITNESSED BEFORE ME: SIGNED ................................................................................................................................ (Applicant) COMMISSIONER FOR OATHS/MAGISTRATE NAME: .................................................................................................................................. SIGNATURE: .......................................................................................................................... ADDRESS: ............................................................................................................................. MADE ON ………………….……………… 20..................................................................... Attachments:

1. Curriculum Vitae and certified copies of academic and professional certificates.
2. Certified copies of National Identity Card and Personal Identification Number (PIN) certificate.
3. Current credit rating report from a credit reference bureau.
4. Total number and the percentage of shares to be acquired and evidence of the consideration given or to be given for the same.
5. For shareholders, provide a declaration witnessed by an advocate indicating that none of the funds the shareholder, beneficial owners, or directors seeks to invest are from proceeds of crime.
6. Current credit rating report from a credit reference bureau.
7. CR12 and BOF1 for corporate shareholders

Kenya Subsidiary Legislation, 2026 4367 FIFTH SCHEDULE (rr. 6(2)(h), 85(2)(a), 85(3), 85(12)) CAPITAL AND LIQUIDITY REQUIREMENTS Virtual Asset Service Paid up Capital (KSh.) Liquid capital (KSh.)

1. Virtual Asset Wallet Provider 150,000,000 30,000,000 or 100% of current liabilities for at least 30 days, whichever is higher
2. Virtual Assets Exchange 100,000,000 20,000,000 or 8% of the total liabilities, whichever is higher.
3. Virtual Asset Payment Processor 10,000,000 100% of current liabilities for at least 30 days.
4. Virtual Asset Broker 10,000,000 2,000,000 or 8% of its total liabilities, whichever is higher
5. Virtual Asset Investment Advisor NIL NIL
6. Virtual Asset Manager 20,000,000 4,000,000 or 8% of its total liabilities, whichever is higher.
7. Virtual Asset Offering Provider - Initial Coin Offering 20,000,000 4,000,000 or 8% of its total liabilities, whichever is higher.
8. Virtual Asset Offering Provider - Virtual Asset Tokenization 10,000,000 2,000,000 or 8% of its total liabilities, whichever is higher.
9. Virtual Asset Offering Provider - Token Issuance Platform 20,000,000 4,000,000 or 8% of its total liabilities, whichever is higher.
10. Virtual Asset Offering Provider - Stablecoin Issuance 300,000,000 60,000,000 or 100% of current liabilities for at least 30 days, whichever is higher.

4368 Kenya Subsidiary Legislation, 2026 SIXTH SCHEDULE MEMBERSHIP OF THE COORDINATION FORUM (r. 145(2))

1. The National Treasury (Chairperson)
2. Central Bank of Kenya
3. Capital Markets Authority
4. Asset Recovery Agency
5. Ethics and Anti-Corruption Commission
6. Financial Reporting Centre
7. Directorate of Criminal Investigation
8. National Intelligence Service
9. Nairobi International Financial Centre Authority
10. National Computer and Cybercrimes Coordination Committee
11. Office of the Data Protection Commissioner
12. Office of the Director of Public Prosecutions
13. Kenya Revenue Authority
14. Office of the Attorney General
15. Communications Authority of Kenya
16. National Counter Terrorism Centre
17. Sacco Societies Regulatory Authority
18. Insurance Regulatory Authority
19. Retirement Benefits Authority
20. Any other agency as the Cabinet Secretary may designate. Made on the 3rd July, 2026. JOHN MBADI NG’ONGO, Cabinet Secretary to the National Treasury. PRINTED AND PUBLISHED BY THE GOVERNMENT PRINTER, NAIROBI