Kenya's new crypto capital rules could protect customers and price startups out at the same time

Kenya's virtual-asset industry now has something it spent years asking for: a formal regulatory framework.

The difficult part is paying for the privilege of entering it.

The Virtual Asset Service Providers Regulations, 2026 create different capital requirements depending on the activity a business performs. Stablecoin issuers sit at the top with KSh 300 million in minimum paid-up capital. Wallet providers require KSh 150 million, while virtual-asset exchanges require KSh 100 million.

Several other categories have lower thresholds, while investment advisers have no minimum paid-up capital requirement under the final framework.

Existing providers also face an important date: November 4, 2026, when the transition period under the new regime reaches its deadline.

For a large financial institution, these numbers can look like ordinary prudential regulation.

For a young Kenyan startup, they can determine whether the business gets to remain Kenyan at all.

The rules are no longer a draft debate

Kenya's virtual-asset framework moved from years of policy discussion into formal regulation.

The final rules go well beyond a simple capital table.

They address areas including:

• Licensing
• Governance
• Cybersecurity
• Consumer protection
• Data protection
• Anti-money-laundering controls
• Segregation of customer assets
• Record keeping
• Marketing conduct
• Risk management

That depth is important.

Virtual-asset failures rarely happen because a company lacked a polished application.

They happen when customer assets, governance, security, liquidity and accountability are weak.

Capital requirements are intended to ensure that a licensed company has enough financial substance to absorb ordinary operational shocks without immediately transferring losses to customers.

The capital thresholds are steep for startup economics

The final framework differentiates between activities.

Among the important categories being discussed:

• Stablecoin issuer: KSh 300 million
• Virtual-asset wallet provider: KSh 150 million
• Virtual-asset exchange: KSh 100 million
• ICO provider: KSh 20 million
• Token issuance platform: KSh 20 million
• Virtual-asset manager: KSh 20 million
• Tokenisation provider: KSh 10 million
• Payment processor: KSh 10 million
• Virtual-asset broker: KSh 10 million
• Investment adviser: Nil

Paid-up capital is not necessarily the complete cost of compliance.

A company may also need legal work, auditors, cybersecurity controls, qualified compliance staff, insurance, governance processes, local management and operating reserves.

A founder should therefore not treat the table as a one-time licence fee.

Why regulators want real capital behind a licence

A wallet or exchange can hold or move customer value at scale.

That creates risk.

A regulator wants a provider capable of funding:

• Cybersecurity
• Qualified staff
• Incident response
• Customer protection
• Liquidity management
• Business continuity
• Compliance systems

The principle is not unusual.

Banks, insurers and other financial institutions operate with capital requirements because their failure can harm people beyond shareholders.

The argument becomes harder when the same principle reaches a young technology sector in which many companies are still raising seed or Series A funding.

The startup funding loop

A startup may need a licence to convince investors that the business has regulatory certainty.

It may need investors to raise the capital required for the licence.

That creates a circular problem.

The November deadline adds time pressure.

Institutional fundraising can take months. Due diligence, valuation, documentation and regulatory structuring rarely happen on a founder's preferred timetable.

A company can therefore have a working product, users and revenue while still failing the balance-sheet test for regulated entry.

That does not automatically mean the rule is wrong.

It means Kenya is making a policy choice about which risks should be filtered out before a provider can operate.

The risk of pushing companies offshore

High thresholds can improve market quality by filtering out underfunded operators.

They can also change where companies incorporate.

A Kenyan founder can build for Kenyan customers while locating the regulated entity elsewhere.

That would weaken some of the benefits Kenya wants from formalisation:

• Skilled jobs
• Tax revenue
• Local accountability
• Product development
• Institutional knowledge

The worst outcome would be a framework that removes compliant local startups while Kenyan consumers remain able to access large offshore platforms with weaker local accountability.

Regulation should bring activity into the light, not merely move company registration outside the country.

Consultation has already changed the rules

Earlier proposals contained different thresholds and structures.

The final framework reduced some of the capital demands discussed during consultation and differentiated activities more clearly.

That is evidence that calibration is possible.

A stablecoin issuer controlling customer value should not necessarily be treated like a consultant giving investment advice.

The final structure acknowledges that different businesses create different kinds of risk.

Industry groups will continue arguing about whether the distinctions go far enough.

What operators need to understand before November

This is not legal advice, but the practical preparation questions are clear.

A provider needs to establish:

1. Which regulated activity or activities it performs.
2. Which regulator has jurisdiction.
3. The relevant paid-up and liquid-capital requirements.
4. Whether more than one licence is needed.
5. Whether governance satisfies the rules.
6. Whether cybersecurity and AML controls are documented and operational.
7. Whether customer assets are segregated correctly.
8. Whether marketing and disclosures comply.
9. What fundraising or restructuring must happen before the transition ends.

Waiting until November to answer those questions would be an expensive strategy.

The tecMAMBO take

Kenya is right to insist that companies handling digital assets cannot behave as if financial infrastructure were simply another software category.

Customer money deserves safeguards.

But capital regulation is a blunt instrument.

Set the threshold too low, and fragile providers can expose users to losses.

Set it too high, and the rule becomes an entry fee that only banks, foreign platforms and heavily funded companies can afford.

The success of Kenya's crypto framework should therefore be measured by more than the number of licences issued.

It should be measured by whether the country creates a safer market without accidentally exporting its own innovators.