Kenya's virtual asset regulatory framework has moved from legislative development to implementation. The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025, while the Virtual Asset Service Providers Regulations, 2026 were gazetted on 22 July 2026 as Legal Notice No. 134 of 2026. Together, they establish the licensing, governance, prudential, conduct and compliance framework for virtual asset service providers operating in or from Kenya.
For VASPs, one of the most important implementation priorities is the development of an effective anti-money laundering and countering the financing of terrorism and proliferation (AML/CFT/CPF) programme.
This is not simply a licensing document. A functioning programme should connect the firm's risk assessment, governance, customer due diligence, sanctions controls, transaction monitoring, suspicious transaction reporting, record keeping, training, testing and remediation into a coherent control framework.
This guide sets out a practical framework for building that programme, using Kenya's new regime and the FATF's risk-based standards as the principal reference points.
1. Start With the Regulatory Perimeter
Before designing an AML/CFT programme, a VASP needs to establish exactly what activities it conducts and which regulatory requirements apply to those activities.
Kenya's framework regulates different categories of virtual asset activity and assigns supervisory responsibilities according to the nature of the service. The VASP Act provides the statutory foundation, while the 2026 Regulations provide the operational framework for licensing and ongoing requirements. The Capital Markets Authority currently lists the 2026 VASP Regulations within its regulatory framework.
The Regulations apply to persons offering virtual asset services in or from Kenya. They also deem a person to be operating in or from Kenya where the person actively solicits or targets Kenyan consumers or derives economic benefit or income from Kenya, regardless of whether the person has a physical presence in Kenya.
This makes regulatory scoping the first implementation task.
The implementation test
Before drafting policies, document:
- What virtual asset services does the business provide?
- Which products and transaction flows are involved?
- Does the business custody customer assets?
- Does it facilitate exchange or conversion?
- Does it operate a trading platform?
- Does it provide brokerage or investment-related services?
- Does it issue or facilitate token offerings?
- Does it provide payment-related virtual asset services?
- Does it operate across more than one regulatory category?
- Does it target or serve Kenyan customers from outside Kenya?
The output should be a regulatory perimeter and activity-mapping document.
Do not start with an AML policy. Start by determining what the business actually does.
2. Conduct an Enterprise-Wide ML/TF/PF Risk Assessment
A risk assessment should be the foundation of the programme.
FATF's risk-based approach requires VASPs to identify, assess and understand their money laundering and terrorist financing risks and apply controls proportionate to those risks. FATF's July 2026 targeted update reinforces that risk assessments must translate into effective mitigation rather than remain theoretical documents.
For a VASP, a conventional financial-services risk assessment may not be sufficient.
The assessment should consider at least:
Customer risk
Consider:
- customer type;
- beneficial ownership;
- occupation or business activity;
- source of funds and, where appropriate, source of wealth;
- PEP exposure;
- sanctions exposure;
- expected transaction activity;
- geographic exposure; and
- use of higher-risk products or services.
Product and service risk
Assess risks associated with:
- spot trading;
- custodial wallets;
- brokerage;
- virtual asset conversion;
- token issuance;
- stablecoins;
- payment services;
- staking or similar products where relevant;
- P2P functionality;
- transfers to or from unhosted wallets; and
- interactions with DeFi arrangements.
FATF's 2026 work specifically identifies stablecoins, P2P transactions involving unhosted wallets and DeFi as areas requiring increased attention.
Geographic risk
Consider:
- customer jurisdictions;
- source and destination jurisdictions;
- jurisdictions subject to sanctions;
- jurisdictions identified as higher risk by FATF;
- cross-border corridors;
- locations associated with known financial-crime typologies; and
- exposure to offshore VASPs.
Delivery-channel risk
Assess the risks created by:
- remote onboarding;
- mobile applications;
- API-based transactions;
- third-party payment providers;
- agents or intermediaries;
- automated trading functionality; and
- other technology-enabled access channels.
The output
The risk assessment should not end with a risk score.
It should identify:
Risk → Control → Control owner → Monitoring method → Evidence → Review frequency.
That creates the foundation for the rest of the AML/CFT programme.
3. Establish Governance and Accountability
AML/CFT responsibility ultimately sits with the organisation's governance structure.
The board should approve the AML/CFT framework, understand the material financial-crime risks facing the business and receive appropriate reporting on the effectiveness of controls.
Kenya's 2026 Regulations require a licensee to have a compliance officer, with defined responsibilities around regulatory compliance. The wider framework also establishes governance, board and senior-management requirements.
The compliance function should therefore be designed around authority and independence, not merely job title.
A practical structure should define:
- board responsibility;
- senior-management accountability;
- compliance/MLRO responsibilities;
- first-line business ownership;
- operational compliance responsibilities;
- internal audit or independent testing;
- escalation routes; and
- reporting frequency.
Avoid the “licence-name” compliance officer
One of the most common weaknesses in growing financial businesses is appointing a junior employee as the compliance officer simply to satisfy a formal requirement.
That creates a structural problem.
If the individual lacks access to information, authority to escalate concerns or sufficient independence from the functions being monitored, the organisation may technically have a compliance officer while lacking an effective compliance function.
The compliance officer should be able to identify deficiencies, require remediation and escalate material issues to the appropriate governance body.
4. Build a Risk-Based Customer Due Diligence Framework
Kenya's 2026 Regulations expressly require customer due diligence before onboarding a consumer, with the CDD process tied to obligations under POCAMLA. The VASP Act also brings VASPs within Kenya's reporting-institution framework.
CDD should therefore be treated as a lifecycle rather than a one-time onboarding event.
A practical framework should cover:
Identification and verification
Establish procedures for identifying and verifying customers using reliable and appropriate information.
Beneficial ownership
For legal persons and arrangements, establish who ultimately owns or controls the customer.
PEP and sanctions screening
Screen customers and relevant parties against applicable sanctions and PEP datasets and establish procedures for reviewing potential matches.
Source of funds and source of wealth
Apply enhanced information requirements where the customer's risk profile, transaction activity or circumstances justify them.
Customer risk rating
Develop documented risk factors and scoring or classification methodology.
The methodology should be sufficiently granular to distinguish genuinely different levels of risk.
Ongoing due diligence
Customer information should be reviewed when:
- risk changes;
- unusual activity occurs;
- material information changes;
- periodic review becomes due; or
- regulatory or internal triggers require reassessment.
A customer who passed onboarding six months ago should not automatically remain low risk if their subsequent activity tells a different story.
5. Add VASP-Specific Counterparty Due Diligence
A VASP does not operate in isolation.
Customers may send or receive virtual assets through other exchanges, custodians, brokers, payment providers and other VASPs.
Counterparty risk should therefore form part of the AML/CFT framework.
Where relevant, assess:
- whether the counterparty is licensed or registered;
- its regulator and jurisdiction;
- the quality of its AML/CFT framework;
- sanctions exposure;
- ownership and control;
- adverse regulatory history;
- reputation and enforcement history;
- transaction-risk controls; and
- the nature of the relationship.
This becomes increasingly important as offshore VASPs operate across borders.
FATF's March 2026 report specifically identified offshore VASPs as a regulatory and illicit-finance risk where providers operate across jurisdictions without effective oversight.
For an exchange, “another VASP” should therefore not automatically mean “low risk.”
6. Build Transaction Monitoring Around Actual Typologies
Transaction monitoring should be designed around the VASP's actual products and risk profile.
A useful architecture can combine:
Customer risk + transaction behaviour + blockchain intelligence + contextual information.
Depending on the business model, monitoring scenarios may address:
- unusual transaction velocity;
- rapid movement of assets after deposit;
- structuring or transaction splitting;
- significant deviations from expected activity;
- rapid movement through multiple wallets;
- exposure to high-risk services or addresses;
- interaction with mixers or other obfuscation mechanisms;
- unusual P2P activity;
- sudden activity after prolonged dormancy;
- exposure to sanctioned or restricted entities; and
- transaction patterns inconsistent with the customer's stated profile.
Blockchain analytics can provide valuable information about transaction provenance and wallet relationships.
But analytics software is not an investigation.
The programme should establish a documented workflow:
Alert → Triage → Investigation → Escalation → Decision → Documentation.
Investigators should record why an alert was closed, escalated or linked to a suspicious transaction report.
This evidence becomes particularly important during supervisory review.
7. Establish Suspicious Transaction Reporting Procedures
A mature AML/CFT programme needs a clear process for identifying, investigating and reporting suspicious activity to the Financial Reporting Centre (FRC) where the applicable legal threshold is met.
The procedure should define:
- who can raise an internal suspicion;
- who investigates;
- who makes the final reporting decision;
- what information must be gathered;
- how decisions are documented;
- how reports are submitted;
- who can access the case;
- how tipping-off risks are controlled; and
- how post-report monitoring is handled.
Do not treat the submission of a suspicious transaction report as the end of the process.
The underlying investigation and supporting evidence should be retained in accordance with applicable record-keeping requirements.
A strong programme should be able to answer a simple supervisory question:
Why did the business decide to report or not report this activity?
The answer should exist in the case record.
8. Address Wallet and Blockchain-Specific Risk
Virtual assets create risks that traditional AML frameworks do not always capture adequately.
A VASP should establish policies for activity involving:
- unhosted wallets;
- newly created wallets;
- high-risk wallet clusters;
- mixers and obfuscation services;
- bridges and chain-hopping;
- privacy-enhancing technologies;
- sanctioned addresses;
- P2P counterparties; and
- DeFi arrangements.
FATF's latest work identifies P2P transactions involving unhosted wallets and DeFi as continuing areas of regulatory concern.
The appropriate response should be risk-based, not an automatic assumption that every interaction with an unhosted wallet is illicit.
The VASP should determine:
- what information can reasonably be obtained;
- what level of verification is required;
- what transaction limits or controls may be appropriate;
- when enhanced due diligence is required;
- what activity requires escalation; and
- when a transaction should be rejected or restricted.
The policy should be documented before difficult cases arise.
9. Build Controls for Sanctions and PEP Risk
Sanctions screening should extend beyond the customer onboarding process.
Depending on the VASP's activities, controls may need to address:
- customers;
- beneficial owners;
- directors and controllers;
- counterparties;
- wallet addresses;
- transactions;
- jurisdictions; and
- relevant blockchain exposure.
The VASP should establish procedures for:
Identification → Alert → Investigation → Escalation → Restriction/Action → Documentation.
Potential matches should not simply be automatically cleared or automatically blocked without an appropriate review process.
The compliance framework should also clearly define who has authority to make the final decision and how the decision is recorded.
10. Implement Transaction and Record-Keeping Controls
Record keeping is part of the control framework, not an administrative afterthought.
The VASP should be able to reconstruct relevant customer and transaction activity and provide records when required by a competent authority.
The Act requires VASPs to maintain records of client and own transactions for at least seven years, while the Regulations contain corresponding record-keeping requirements.
The records architecture should therefore cover:
- customer identification records;
- beneficial ownership information;
- risk assessments;
- transaction records;
- wallet information;
- investigation records;
- suspicious transaction reports;
- sanctions investigations;
- training records;
- compliance reviews;
- policies and procedures;
- board and management reporting; and
- remediation records.
The objective is simple:
If a transaction occurred, the VASP should be able to reconstruct what happened, who was involved, what controls were applied and what decision was made.
11. Integrate the AML/CFT Programme With Technology
A VASP's compliance framework cannot be separated from its technology architecture.
At minimum, the compliance team should understand how the following systems interact:
Customer onboarding → KYC/KYB → Risk scoring → Sanctions screening → Wallet screening → Transaction monitoring → Case management → Reporting → Record retention.
Technology selection should therefore begin with requirements rather than vendors.
Before purchasing a screening or blockchain analytics platform, define:
- what risks the system must detect;
- what data it needs;
- expected transaction volumes;
- alert thresholds;
- integration requirements;
- case-management requirements;
- audit-trail requirements;
- reporting requirements; and
- system availability and security requirements.
A sophisticated tool that produces thousands of alerts without adequate investigation capacity is not a mature control environment.
It is an unmanaged workload.
12. Establish Training and Competence Requirements
AML/CFT training should be role-specific.
A developer, customer-support officer, investigator and board member do not require identical training.
Customer-facing teams
Should understand:
- suspicious customer behaviour;
- escalation procedures;
- CDD requirements; and
- tipping-off risks.
Compliance investigators
Should understand:
- transaction typologies;
- blockchain analytics;
- sanctions;
- PEP risk;
- investigation methodology;
- suspicious transaction reporting; and
- evidence documentation.
Technology teams
Should understand:
- compliance-related system requirements;
- relevant transaction data;
- Travel Rule or transfer-information requirements where applicable;
- audit trails; and
- data integrity.
Board and senior management
Should understand:
- the firm's financial-crime risk profile;
- material compliance deficiencies;
- regulatory exposure;
- risk appetite; and
- remediation progress.
Training should be recorded and periodically assessed for effectiveness.
13. Test the Programme Independently
A programme is not effective simply because its policies exist.
Independent testing should examine both:
Design effectiveness
Does the control address the identified risk?
Operating effectiveness
Did the control actually operate as intended?
Testing may include:
- sample-based CDD reviews;
- sanctions-screening testing;
- transaction-monitoring scenario testing;
- investigation-file reviews;
- suspicious transaction reporting reviews;
- access-control testing;
- record-retention testing;
- training reviews; and
- remediation validation.
The findings should be documented, assigned to responsible owners and tracked until closure.
Where deficiencies are identified, the VASP should be able to demonstrate:
Finding → Root cause → Remediation → Owner → Deadline → Validation.
That evidence is often more valuable than another policy document.
14. Create an AML/CFT Evidence File
One of the most useful implementation practices is to maintain a central AML/CFT evidence repository.
A supervisory or licensing review may require the VASP to demonstrate not only that a control exists, but that it operates.
The evidence file should therefore contain, as applicable:Control Area and Evidence
- Enterprise risk assessment - Approved risk assessment and methodology
- Governance - Board approvals, minutes and committee reports
- Compliance officer - Appointment, role description and reporting structure
- CDD - KYC/KYB procedures and sample files
- Risk rating - Methodology and customer-risk records
- Sanctions - Screening configuration and investigation records
- Transaction monitoring - Scenarios, thresholds and alert records
- Blockchain analytics - Monitoring methodology and investigation files
- STR process - Internal escalation and reporting records
- Record keeping - Retention policy and system controls
- Training - Training plan, attendance and assessments
- Independent testing - Audit/review reports and remediation tracker
- Policies - Current approved AML/CFT/CPF policies
- Management information - Periodic compliance reporting
- Remediation - Issues register and closure evidence
This changes the compliance programme from a collection of documents into an auditable control environment.
A Practical Implementation Roadmap
Implementation should not be treated as a rigid sequence in which one workstream waits for another. Several activities should run in parallel.
Phase 1 — Regulatory and Risk Foundation
Priority activities:
- map the VASP's activities;
- identify the applicable regulatory authority or authorities;
- conduct the enterprise-wide ML/TF/PF risk assessment;
- identify applicable Kenyan AML/CFT obligations;
- establish the risk appetite;
- approve the AML/CFT/CPF framework.
Key output: Regulatory perimeter + enterprise risk assessment + approved compliance framework.
Phase 2 — Governance and Customer Controls
Priority activities:
- appoint the compliance officer;
- establish reporting lines;
- implement CDD/KYB procedures;
- establish beneficial-ownership procedures;
- implement PEP and sanctions screening;
- develop customer-risk methodology;
- establish EDD procedures.
Key output: Documented customer-risk management framework.
Phase 3 — Transaction and Investigation Controls
Priority activities:
- define transaction-monitoring scenarios;
- deploy appropriate blockchain analytics;
- establish alert thresholds;
- build case-management procedures;
- establish escalation procedures;
- document STR decision-making;
- implement wallet-risk controls.
Key output: Operational transaction-monitoring and investigations framework.
Phase 4 — Transfer, Counterparty and Technology Controls
Priority activities:
- establish controls for transfers involving other VASPs;
- develop counterparty VASP due diligence;
- establish an unhosted-wallet policy;
- assess DeFi and P2P exposure where relevant;
- integrate compliance systems;
- test data flows and audit trails.
Key output: Integrated transaction and counterparty risk framework.
Phase 5 — Testing and Regulatory Readiness
Priority activities:
- conduct independent testing;
- remediate control weaknesses;
- refresh the enterprise risk assessment;
- test incident and escalation procedures;
- review board reporting;
- assemble the regulatory evidence file.
Key output: Demonstrable compliance and an inspection-ready evidence pack.
Common Implementation Failures
Several mistakes repeatedly undermine otherwise sophisticated compliance programmes.
1. Starting with technology
Buying blockchain analytics or screening software before completing the risk assessment often produces expensive systems that do not address the firm's actual risk.
2. Treating CDD as an onboarding exercise
A customer can become higher risk after onboarding. Ongoing monitoring and periodic or event-driven review are therefore essential.
3. Using uniform customer risk ratings
A single low/medium/high framework without meaningful risk factors creates the appearance of risk-based compliance without the substance.
4. Ignoring counterparty risk
The fact that another business calls itself a VASP does not establish that it is properly licensed, supervised or financially crime-compliant.
5. Over-relying on automated alerts
Automation identifies potential risk. It does not replace investigation, judgement or documented decision-making.
6. Writing policies that operations cannot execute
A policy requiring controls that the business's systems, people or budget cannot actually deliver will fail when tested.
7. Treating the compliance officer as the entire compliance function
Financial-crime risk is a business-wide responsibility. Compliance can oversee and challenge the framework, but first-line teams must own the risks generated by their activities.
8. Failing to retain evidence
A control that cannot be demonstrated is difficult to defend during regulatory scrutiny.
What “Implementation Ready” Looks Like
A VASP should consider its AML/CFT programme implementation-ready when it can demonstrate, rather than merely state, that:
- its regulatory perimeter has been documented;
- its ML/TF/PF risks have been assessed;
- the board understands and oversees those risks;
- the compliance function has appropriate authority and access;
- customers are risk-rated before onboarding;
- CDD and EDD are documented;
- sanctions and PEP screening operates effectively;
- transactions are monitored using appropriate controls;
- blockchain exposure can be investigated where relevant;
- suspicious activity can be escalated and reported;
- records can be retrieved;
- employees understand their responsibilities;
- compliance deficiencies are identified and remediated; and
- independent testing has assessed whether controls actually work.
That is the difference between having an AML/CFT programme and operating one.
Conclusion
Kenya's VASP framework moves virtual asset businesses into a more structured regulatory environment. The VASP Act, 2025 provides the statutory foundation, while the 2026 Regulations establish detailed licensing and ongoing requirements. The framework also places VASPs within Kenya's broader AML/CFT architecture.
For operators, the immediate task is therefore not simply to produce an AML policy for a licence application.
It is to build a system in which risk identification, customer due diligence, transaction monitoring, investigation, reporting, governance and independent testing work together.
That approach is consistent with the direction of international standards. FATF's July 2026 assessment found continued progress in VASP regulation globally but also significant gaps in translating regulatory frameworks into effective licensing, supervision, risk mitigation and enforcement.
For Kenyan VASPs, the practical standard should be straightforward:
If a control is important enough to be in the programme, the business should be able to demonstrate that it operates.
Existing operators that fall within the transitional provisions should work backwards from 4 November 2026, when the relevant transition period expires. New entrants should establish their regulatory position and licensing requirements before commencing regulated activity rather than relying on the transitional period applicable to existing operators.
The strongest AML/CFT programmes will not be the ones with the longest policy manuals. They will be the ones that can demonstrate a clear connection between risk, control, decision and evidence.
Key Sources
- Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025) — Kenya Law.
- Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026) — Capital Markets Authority regulatory framework.
- Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), as amended.
- Financial Action Task Force, Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs, July 2026.
- Financial Action Task Force, Understanding and Mitigating the Risks of Offshore Virtual Asset Service Providers, March 2026.
- Financial Action Task Force, Targeted Report on Regulatory Challenges from Decentralised Finance, July 2026.
This article is for general informational purposes only and does not constitute legal, regulatory, compliance or other professional advice. VASPs and other virtual asset businesses should obtain advice specific to their activities, structure, jurisdiction and regulatory position before relying on the information contained in this article.