The Virtual Asset Service Providers Bill, 2025 (2)

SPECIALISSUE

Kenya Gazette SupplementNo.53 (National Assembly BillsNo.15)

REPUBLICOFKENYA

KENYA GAZETTESUPPLEMENT

NATIONALASSEMBLYBILLS,2025

NAIROBI,17th March,2025

CONTENT

| Bill for Introduction into theNational Assembly- | Bill for Introduction into theNational Assembly- | |----------------------------------------------------|----------------------------------------------------| | | PAGE | | The Virtual AssetService Providers Bill,2025 | 279 |

THEVIRTUALASSET SERVICEPROVIDERS

BILL,2025

ARRANGEMENT OFCLAUSES

Clause

PARTI-PRELIMINARY

• 1-Short title.
• 2-Interpretation.
• 3—Meaning of virtual asset service provider.
• 4-Object of the Act.
• 5-Scope of application.

PARTII-DESIGNATION OFREGULATORY AUTHORITIES

• 6-Regulatory authorities.
• 7-Functions of the relevant regulatory authorities.
• 8—Guiding principles of the relevant regulatory authority.

PARTIII-LICENSINGREQUIREMENT

• 9-Prohibition.
• 10-Permissible activities.
• 11-Virtual asset service provider license.
• 12-Decision by the relevant regulatory authority to
• license.
• 13—Conditions attaching to license.
• 14-Duration of a license.
• 15-Assignment and transfer of license.
• 16—Suspension, varying or revocation of license.
• 17-Surrender of license.
• 18—Register of licensees.

PARTIV-GENERALOBLIGATIONS FOR

• VIRTUALASSETSERVICEPROVIDERS

• 19-Fit and proper assessment.
• 20-Registered office and activities of a virtual asset
• service provider.
• 21-Business to be conducted in prudent manner.
• 22—Business to be conducted with integrity.
• 23-Capital,solvency and insurance requirements.
• 24-Conflict of interest.
• 25—Additionalrequirements.
• 26—Ongoing notifications.
• 27-Material changes to business.
• 28-Ownership changes.
• 29-Cyber security.
• 30—Duty to prepare annual audited financial statements.
• 31—Appointment of chief executive officer.
• 32—Duty to protect customer assets.

PARTV-PREVENTION OF MONEY LAUNDERING,TERRORISMFINANCING AND PROLIFERATIONFINANCINGBYVIRTUAL ASSETSERVICEPROVIDER

• 33—Powers of relevant regulatory authority for antimoney laundering and counter terrorism finance purposes.
• 34Penalties forviolationsrelating tomoney
• laundering,terrorismfinancing.

PART VI-VIRTUALASSET OFFERING

• 35—Issuers of virtual asset offering

PARTVII-INVESTIGATIONAND

EXAMINATION

• 36—Compliance,inspection and investigation.
• 37—Appointment or designation of examiner.
• 38-Powers to access information.

• 39-Additionalpowers.

PARTVIII-ENFORCEMENTACTIONS

• 40-Administrative enforcement action.
• 41-Criminal offencesand penalties.
• 42-Liability of individuals.

PARTIX-MISCELLANEOUSPROVISIONS

• 43-Confidentiality.
• 44-Appeals.
• 45-Access to and maintenance of client transaction
• records.
• 46-Protectionfrom liability.
• 47-Compliance to the Data Protection Act.
• 48-Transitional and savingprovisions.
• 49-Consequential amendments.

PARTX-PROVISIONS ONDELEGATED

POWERS

• 50-Regulations.

FIRST SCHEDULE Virtual asset activities

SECOND SCHEDULE Consequential amendments.

THEVIRTUALASSETSERVICEPROVIDERS BILL,2025

ABill for

AN ACT of Parliament to provide for the legal framework to license and regulate the activities of virtual asset service providers,and for connected purposes.

ENACTED by theParliament ofKenya,asfollows-

PARTI-PRELIMINARY

• 1.This Act may be cited as the Virtual Asset Service Short title. Providers Act,2025.

Interpretation.

Cap59A

• 2.Inthis Act unless, the context otherwise
• requires-

"anti-money laundering and counterterrorism finance"has the meaning assigned to it under the Proceeds of Crime and Anti-Money laundering Act;

"anonymity-enhancing services" meansoffering, facilitating or executing transactions in digital assets, with the effect or intention of concealing information;

"beneficial owner" has the meaning assigned to it

under section 2 of the Companies Act;

"Cabinet Secretary"means the Cabinet Secretary for the time being responsible for matters related to the

National Treasury;

"chief executive oficer" means the person appointed

or designated as such under section 31(l) of this Act;

"closed ecosystemmeans an ecosystem where the use of the virtual asset is restricted to a specific platform, application or network;

"competent authority" means a relevant regulatory

authority or any other body designated as such by the Cabinet Secretary by notice in the Gazette;

"custodial wallet"means a wallet in which the private keys to the subject's virtual assets are held and managed by

a third party for proof of ownership and facilitation of transactions;

Cap.486.

"custodial wallet provider" means a person providing custodial wallet services under this Act;

"distributed ledger technology"means a decentralized

digital system for recording transactions where the data is simultaneously shared,replicated,and synchronized across computernetworks;

"e-money" has the meaning assigned to it under regulation 2 of the National Payment Systems Regulations, 2014;

"fiat currency"means currency that is issued by the relevant body in a country or by a government, that is designated as a legal tender in its country of issuance

through legislation;

"investigating authority" meansan authority established by law with criminal or civil investigation

functions;

"issuer" means a person who is authorised to issue a

virtual asset offering under this Act;

"license"means a virtual asset service provider license

granted in section 1l of this Act;

"licensee"means a legal person licensed to operate as

a virtual asset service provider conducting one or more permissible activities under this Act;

"mixer or tumbler services"means cryptographic

facilitiesor services thatmix different stream ofpotentially traceable virtual assets,concealing the origin of funds of a particular virtual asset;

""non-fungible token"means a digital representation of unique and non-interchangeable ownership rights or assets that are recorded on a distributed ledger technology,where each token is individually identifiable and cannot be

substituted for another token of equivalent value;

"promoter"in relation to a virtual asset offering, means any person who causes the preparation or the distribution of an offering document;

""relevant regulatory authority"means an entity

designated as such under section 6 of this Act;

L.N.No.109of

2014.

"senior officer"means the chief executive officer or any other person who holds a position of seniority with responsibility to manage key controlling functions in a

licensee;

"stablecoinmeans a virtual asset designed to or that aims to have its value fixed or pegged relative to one or more reserve assets,including fiat currency,commodities, or other virtual assets, for the primary purpose of maintaining a stable value of the stablecoin;

"supervisory bodies" has the meaning assigned to it

under section 2 of the Proceeds of Crimes and Anti-Money Laundering Act;

"virtual asset" means a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes and does not include digital representation of fiat currencies,securities and other

financial assets;

"virtual asset offering" means a method of raising

funds whereby an issuer issues virtual assets and offers them in exchange for funds;

"virtual asset services"means the virtual asset services

listed under the First Schedule to this Act;

"virtual asset service provider"has the meaning

assigned to it under section 3 of this Act;

"virtual service token"means a digital representation of value which is not transferable or exchangeable with a third party at any time and includes digital tokens whose sole function is to provide access to and application of service or to provide a service or function directly to its owner;and

"virtual asset trading platform" means a digital

platform-—

• (a) which facilitates the exchange and trading of virtual assets for fiat currency or other virtual assets on behalf of third parties for a fee, commission or other benefit;and

(b) which- Cap.59A

• (i) holds custody or controls virtual assets on behalf of its clients to facilitate an exchange; or
• (ii) purchases virtual assets from a seller when transactions or bids and offers are matched in order to sell them to a buyer.
• 3.(l) For the purposes of this Act, a person isa
• virtual asset service provider,if that person is-
• (a)alocal company incorporated underthe
• Companies Act;or
• (b)a foreign company issued with a certificate of
• compliance under the Companies Act,

and is licensed to conduct or offer one or more of the

services listed under the First Schedule to thisAct.

• (2) For the purposes of this Act,virtual service tokens arenot virtual assets and a person or legal arrangement that provides services that involve virtual service tokens only are not required to have a license under this Act.

Object of theAct.

• legislative framework to license and regulate the activities of virtual asset service providers in and from Kenya.
• 4.The main object of this Act is to provide for the
• 5.(1) This Act shall apply to virtual asset service
• providers offering virtual asset services in Kenya.
• (2) For avoidance of doubt, this Act shall not apply to-
• (a) digital representations of value or rights that
• operatessolelywithin a closed ecosystem of the issuer, including those that meet the following criteria-
• (i)
• non-transferable outside a closed ecosystem;
• (ii) non-exchangeable with real world goods, services,discounts,purchased outsidea
• closed ecosystem;
• (ii) non-tradeable onwards and non-saleable on the secondary market outside of theclosed
• ecosystem;

Scope of application.

Meaning of

virtual asset serviceprovider

Cap.486.

Cap 486.

• (iv) solely usable for purposes defined by the issuer and non-usable for payment or investment purposes; and
• non-exchangeable for fiat currency or virtual
• assets.
• (b) digital representation of fiat currencies, issued by the Central Bank of Kenya or any other jurisdiction;
• (c)a non-fungible token which is not used for payment,investment or any other financial purposes;
• (d)a non-fungible token which by its nature and function rather than the designation given by its issuer,is not used for payment or investment purposes, and is not a digital representation of any of financial asset;or
• (e) any other digital representations of value or rights sought to be expressly excluded by the relevant regulatory authority.

PARTII-DESIGNATION OFREGULATORY

AUTHORITIES

• 6.The following entities shall be the relevant
• regulatory authorities for the purposes of this Act-
• (a)the Capital Markets Authority established under
• section 5 of the Capital Markets Act;
• (b) the Central Bank of Kenya established under Article231(1)of the Constitution;or
• (C) any other public body established under a written law that the Cabinet Secretary may,by notice in the Kenya Gazette,designate as such.
• 7.(l) The relevant regulatory authorities shall, in relation to virtual asset service providers,have the following functions-
• (a) to license virtual asset service providers in accordance with the services listed in the First Schedule to this Act;

Regulatory authorities.

Cap.485A.

Functions of the relevant regulatory

authorities.

• (b) to regulate,supervise and monitor promoters of a virtual asset offering;
• (c) to issue directions, directives and take such enforcement actions, as may be deemed necessary, for non-compliance with this Act;
• (d) to issue and publish notices,guidelines,guidance notes and any other similar instrument regarding the implementation of this Act,regulations or code issued under this Act;
• (e) to provide feedback to virtual asset service providers to assist them in detecting and reporting suspicious activities,preventing tipping off and application of anti-money laundering and counter terrorism finance measures in connection with the conduct ofvirtual asset services and promotion of virtual asset offerings;
• (f) to ensure financial soundness and stability of the financial system in respect of matters falling under
• this Act;
• (g)to advise the Cabinet Secretary on all matters relating to virtual asset services in theirrespective
• sectors;
• (h) to cooperate with supervisory bodies,competent
• authorities and investigating authorities on sharing and exchange ofrelevant information;and
• (i) to do orperform such other function necessary for the proper performance of its respective mandate
• under this Act.
• (2) The relevant regulatory authority may engage the this Act.
• 8.The relevant regulatory authorities shall,in exercising their powers and in performing their functions under this Act,be guided by the following principles-
• (a) to ensure financial stability in Kenya;
• (b) to ensure market integrity in Kenya;

Guiding principles of therelevant regulatory authorities.

• (c) to foster innovation and maintain fairness, transparency and efficiency in the virtual assets sector in Kenya;and
• (d) to prevent, detect and restrain conduct that causes ormay cause damage to the financial reputation of Kenya.

PARTIII-LICENSING REQUIREMENT

• 9.(1) A person shall not carry on, or purport to carry on,the business of virtual asset services,or hold itself out as carrying on that business,in or from Kenya,unless that person is licensed to do so by the relevant regulatory authority under this Act.
• (2) For the avoidance of doubt,a natural person shall not carry on, or purport to carry on,in or from within Kenya,the business of virtual asset services.
• (3) A person who contravenes subsection (1) or (2) of this section commits an offence and is liable,upon conviction,to a fine or imprisonment,or to both,as specified under section 41(3) to this Act.
• 10.(l) An eligible person may apply for a license to operate as a virtual asset service provider conducting or
• offering one or more of the virtual asset services listed in theFirst Schedule to this Act.
• (2) The relevant regulatory authority may issue guidelineswith respect to the virtual asset services listed in the First Schedule to this Act.
• (3) For avoidance of doubt, only the persons specified under section 3(1) are eligible to be licensed to undertake virtual asset services under this Act.
• (4) The Cabinet Secretary may,by notice in the Kenya Gazette,amend the First Schedule to this Act.
• 11.(l)A person intending to carry on the business of virtual asset services shall submit an application for a license to the relevant regulatory authority in compliance with such requirements as may be prescribed and accompanied by the prescribed application fee.
• (2) The relevant regulatory authority may,in relation to an application received under subsection (1),either-

Prohibition.

Permissible

activities.

Virtual asset service provider license.

• (a) grant a license with or without such conditions; or
• (b) reject an application where an applicant fails to
• meet the applicable licensing requirements.
• (3) Where a relevant regulatory authority rejects an application under subsection (2)(b), that regulatory authority shall,in writing,inform the applicant of its decision and the reasons for the rejection.
• (4) An application under this section shall include such other information as may be prescribed in the Regulations that enables the relevant regulatory authority to
• make a determination.
• (5) In determining whether to approve the application
• from a person in subsection (l),the relevant regulatory authority shall consider matters set out in section 12,and whether the applicant-
• (a) is an eligible person as specified under section 3(1));
• (b) has personnel with the necessary skills, knowledge
• and experience;
• (c) satisfies the relevant regulatory authority that it is able to meet the requirements specified in this Act;
• (d) satisfies the relevant regulatory authority that it is capable of complying with consumer protection and data protection requirements as provided for in the relevant laws;
• (e) satisfies the relevant regulatory authority that,if licensed, it is capable of complying with any financial obligations,inclusive of insurance, capital and solvency requirements;
• (f) satisfies the relevant regulatory authority that its directors,senior officers and any other person are fit and proper in accordance with section 19 of this
• Act;
• (g)meets the prescribed cyber security measures as provided for under the Computer Misuse and
• Cybercrimes Act;

• (h) has specified physical premises or data solutions that the relevant regulatory authority has deemed suitable for accessing and retaining records and
• other documents;
• 1) satisfies the relevant regulatory authority that an approval is in the public interest having regard to the size,scope and complexity of the applicant;
• and
• (j)has complied with anyother requirements provided under this Act or any Regulations made thereunder.
• (6)Where therelevantregulatory authority has granted a license under this section,it shall,within thirty daysfrom the date of grant,publish a notification of such grant in the Kenya Gazette.
• (7) An applicant for a license in this section shall notify the relevant regulatory authority within fourteen
• days of any changes to the information provided.
• (8) A person who, in connection with a license application,supplies the relevant regulatory authority with information he or she knows is misleading or false or should reasonably know is false or misleading,that person commits an offence and is liable,upon conviction,to a fine or imprisonment,or to both,as is specified under section
• 41(2).

12. In making a decision to grant a a virtual asset service provider license,the relevant regulatory authority shall consider the following-

• (a) the size,scope and complexity of the virtual asset
• service,underlying technology,method of delivery of the service and virtual asset utilisation;
• (b) the knowledge,expertise and experience of the
• applicant;
• (c) the procedures that the applicant has in place to combat money laundering,terrorist financing and proliferation financing;
• (d) the internal safeguards and data protection systems being utilised by the applicant;

Decision by the relevant regulatory authority to license.

• (e) the risks that the virtual asset service may pose to
• clients,other licensees or to the financial systems in Kenya;
• (f) the net worth, source of funds,capital reserves and
• financial stability of the applicant;
• (g) the impact that the virtual asset service may have
• on the financial services in Kenya;
• (h) the likelihood that the service shall promote innovation, competition and benefits to consumers;
• (i)if the applicant's directors,senior officers are fit and proper persons to hold the respective positions;
• (j)if the applicant'sbeneficial owners are fit and proper persons to have such ownership or control;
• (k) if the applicant is already operating in a regulated sector,a no-objection shall be required from the relevant regulator;and
• (l) any other consideration that the relevant regulatory
• authority may require.
• 13.(1)Therelevantregulatory authority may
• impose-—
• (a) regulatory requirements on a virtual asset service provider as the relevant regulatory authority considers necessary based on-
• (i) its assessment of the virtual service provided by the licensee;
• ii) the nature of supervision required for the
• virtual service;
• (iii) the safety and soundness of the method by which the virtual service is offered to the public;
• (iv) where applicable,any license held under
• another regulatory law;and
• (b) further restrictions or prohibitions on the use of technology or practices that,in the opinion of the relevant regulatory authority,may disrupt or prejudice-

Conditions attaching to license.

• (i) the financial services in Kenya;
• (ii) the functions of the relevant regulatory
• authority;or
• (ii) the interests of the public.
• (2) A licensee shall,at all times,keep its license on display at its principal place of business and the license shall include the following-
• (a) the date upon which the license was issued;
• (b) the associated license number;
• (c) any other business or trade name by which the
• licensee is known;
• (d) the conditions attached to the license;
• (e) the activities for which the license has been issued;
• (f) the address of its principal place of business in Kenya.
• (3) Notwithstanding subsection (1),it shall be deemed to be a condition of every license that the licensee bears the obligation-
• (a) not to modify the activity listed in its license without priornotice to and approval of the relevant regulatory authority;and
• (b) to cooperate actively with the relevant regulatory authority-
• (i)byprovidinganyrelevant information requested by the relevant regulatory authority, or that to the licensee's knowledge,ought to be disclosed to the relevantregulatory authority; and
• (ii) byfurnishingnecessaryand reasonable facilities to enable the relevant regulatory authority to carry out its regulatory functions and to take any corrective action required by the relevantregulatory authority.
• (4) The relevant regulatory authority may,by written notice to the holder of the license,amend or revoke any of the conditions imposed based on subsection (l) or attach
• new conditions:

Provided that the relevant regulatory authority shall

not impose such conditions without first giving the licensee an opportunity tobeheard.

• (5) Any person who contravenes the provisions of

2. subsection (2) or (3),that person shall be liable to the administrative penalty specified under section 40(2)(f). 3. 14.A license issued under this Act shall be valid from the date it is issued and shall expire on the 3lst December 4. of the year it is issued. 5. 15.(l) A license granted under this Act shall not be transferred or assigned without prior written approval of the relevant regulatory authority.

• (2) Any person who contravenes the provisions of

7. subsection (l),that person shall be liable to the administrative penalty specified under section 40(2)(f). 8. 16.(1) The relevant regulatory authority may suspend, vary or revoke a virtual asset service provider license 9. where itis of the opinion that 10. (a) the licensee has failed to comply with an obligation imposed on it by this Act; 11. (b) the licensee is carrying on business in a manner that is not permitted by the license; 12. (c) the relevantregulatory authority has been provided with false,misleading or inaccurate information by 13. or on behalf of the licensee; 14. (d) the virtual asset service or product is being marketed or advertised in a manner that is fraudulent or misleading; 15. (e) the interests of the clients or potential clients of the 16. licensee are threatened.

• (2) The relevant regulatory authority shall, before

18. suspending,varying or revoking the license,give written notice to the licensee providing the grounds upon which it intends to suspend,vary or revoke the license.

• (3) Where the relevant regulatory authority suspends, varies or revokes a license, that relevant regulatory authority shall publish in the Kenya Gazette and on its

20. website-—

Duration of a

license.

Assignment and

transfer of license.

Suspension, revocationof

variation or license.

• (a) the name of the licensee;
• (b) the effective date of the suspension or revocation;
• (c) in the case of a suspension, the period of the suspension.
• (4) Without prejudice to subsection (1), the relevant regulatory authority may for the purposes of varying a
• license-—
• (a) remove or impose additional license conditions; or
• (b) extend or reduce the permitted activities under the
• license.

17. (1) A licensee may surrender its license by giving

• a prior notice for surrender accompanied by the following information-
• (a) the board resolution legitimizing the decision;
• (b) a plan depicting the winding up process, if any;
• (c) the arrangement to be made in respect of client
• assets;
• (d) the notification to be send to clients as to the
• surrender;
• (e) declaration as to all liabilities having been
• discharged; and
• (f) such other information as the relevant regulatory authority may deem necessary.
• (2) Upon approval of the request to surrender a license under this section,the relevant regulatory authority-
• (a) shall supervise the execution of the surrender; and
• (b) may give directions to the licensee to protect the interest of the customers ormembers of the public.
• 18.(l) Each relevant regulatory authority shall keep and maintain a register of licensees it has issued,which shall contain-
• (a) the name and address of the licensee;
• (b) the type of virtual asset services authorised;
• (c) the date of issuance of the license;

Surrender of license.

Register of licensees.

• (d) the status of the license;and
• (e) any other relevant information.
• (2) The relevant regulatory authority shall publish an
• updated copy of the register referred to in subsection (1) on its website.

PART IV-GENERAL OBLIGATIONS FOR

VIRTUALASSETSERVICEPROVIDERS

• 19.(1) A licensee shall not appoint a director,senior
• officer or such other person or allow any of them to continue to act in such capacity unless that person is fit and proper as determined by the relevant regulatory authority.
• (2) In determining whether a person is fit and proper under subsection (1), the relevant regulatory authority shall take into consideration the following-—
• (a) the person's probity, competence, experience and soundness ofjudgment for fulfilling the responsibilities of the relevant position;
• (b) the diligence with which the person is fulfilling or is likely to fulfil theresponsibilities oftherelevant position;
• (c) the person'seducational and professional qualifications and membership ofprofessional or other relevant bodies as applicable,or such other equivalent as may be relevant;
• (d) the person's knowledge and understanding of the legal and professional obligations to be assumed or
• undertaken;
• (e) any evidence that the person has committed any offence involving dishonestyor fraud or has contravened any law designed to protectmembers ofthepublic arisingfrom dishonesty, incompetence,malpractice,misconduct or conduct ofdischarged or undischarged bankrupts or otherwise insolvent persons;
• (f) any evidence that the person has contravened any law with respect to virtual assets;
• (g) the person's financial standing integrity; and

Fit and proper assessment.

• (h) any other consideration that the relevant regulatory authority may apply.
• (3) Where the relevant regulatory authority determines that a person is not fit and proper, it shall inform the applicant or licensee,in writing,of such determination stating the reasons for the determination.
• (4)Where-
• (a) a licensee has not complied with subsection (1); or
• (b) the relevant regulatory authority determines that a licensee has appointed any person who is no longer fit and proper,

the relevant regulatory authority shall take such

enforcement action as it deems necessary,in terms of section 40 of thisAct.

• 20.A virtual asset service provider shall maintain a physical office in Kenya where its business activities are carried out.
• 21.(1) Subject to subsection (2) and section 19, the business and affairs of a licensee shall be managed by at least three directors of the board of whom at least three shall be natural persons;

Provided that a director shall not serve in more than two boards of a licensee under this Act.

• (2) A licensee shall conduct its business in a prudent

2. manner.

• (3) In determining whether a licensee is conducting its business in a prudent manner,the relevant regulatory authority shall take into accountwhether the licensee-

4. (a) complies with the provisions of this Act or any otherrelevantlaw; 5. (b) complies with the any regulations, codes or guidelines issued by the relevant regulatory authority; 6. (c)maintains the minimum net assets in such other amountas the relevant regulatory authority may direct in writing,taking into consideration the nature, size and complexity of the licensee's business;

Registered office

and activities of virtual asset service provider.

Business to be conducted in prudent manner.

• (d) maintains the adequate accounting and other
• records of its business and adequate systems of control and records,and has developed policies and procedures pertaining to its obligations under this Act or any other relevant law;or
• (e) has effected a policy of insurance to cover risks inherent in the operation of its business of an amount commensurate with the nature and scale of its virtual asset services.
• (4) Any person who contravenes the provisions of this section,that person shall be liable to the administrative penalty specified under section 40(2)(f) of this Act.
• 22.(1) A virtual asset service provider shall,within or from Kenya,conduct its business with integrity at all times, and in particular, shall -
• (a) not undertake mixer or tumbler services or
• anonymity-enhancing services;or
• (b)not mislead clients as to the service beingprovided
• and the duties and obligations of the licensee; or
• (c) act with due care, skill and diligence, having regard to the nature and scale of its business activities.
• (2) A person who contravenes the provisions of this
• section commits an offence and is liable,upon conviction, to a fine orimprisonment,or to both,asspecified in section 41(3) to this Act.
• 23.(l) A virtual asset service provider shall at all times maintain its business in a financially sound condition by complying with such capital, solvency and insurance
• requirements as may be prescribed.
• (2) Where a person has contravened the provisions of this section,the relevant regulatory authority shall take such enforcement action as it deems necessary under section40 of this Act.
• 24.(1) A virtual asset service provider shall ensure that it has in place policies and procedures,satisfactory to the relevant regulatory authority,as applicable, to avoid, mitigate and deal with conflicts of interest between-

Business to be conductedwith

integrity

Capital,solvency and insurance requirements.

Conflictof interest.

• (a) the licensee and its clients;
• (b) the licensee and its service providers or other third parties;
• (c) the licensee's clients.
• (2)Where a person has contravened the provisions of this section, the relevant regulatory authority shall take such enforcement action as it deems necessary under section 40 of thisAct.
• 25.Every virtual asset service provider shall at all
• times-
• (a)provide services honestly and fairly;
• (b) maintain and hold the prescribed capital requirements;
• C
• manage any actual and potential conflicts of interest related to its services;
• have adequate technological,financial and
• (d) human resources to discharge its services;
• comply with the full range of the anti-money laundering and counterterrorismfinance preventive measures,including targeted financial sanctions obligations;
• f
• have its annual financial statement audited;
• (g) have adequate measures in place to ensure the
• safekeeping and protection of the virtual assets of the customer;
• open and operate a bank account in Kenya for the purposes of this Act;
• (i) ensure that recording, storing, protecting and transmission of the data processed by it is in accordance with laws in Kenya;
• ensure that all advertisement,marketing and promotional materials are fair,accurate, identifiable,transparent and not misleading;
• plan for business continuity and disaster recovery k
• in the event of an incident or a disaster;
• have in place a mechanism for handling customer
• complaints;

Additional requirements.

• (m) have in place a mechanism for protecting whistle-
• blowers;
• n) take reasonable steps to prevent market abuse and ensure the integrity and transparency of the financial market;
• 0 take reasonable steps and measures to maintain an effective consumer education program for the
• virtual asset in which it deals;
• take reasonable steps to ensure that employees
• andpersons acting on itsbehalf comply with the provisions of this Act or any other relevant law;
• g maintain competence to provide thevirtual asset services;
• if offering for sale a virtual asset, conduct due diligence on the virtual asset and its issuer,taking
• into account the requirements of this Act and any other relevant law;
• take reasonable steps to ensure that a person
• S employed,contracted or associated with,the virtual asset service provider—
• (i)
• is fit and proper;
• complieswith thisActand all applicable laws
• (ii) in Kenya;
• (ili) complies with the code of conduct ofvirtual asset serviceproviders set out by the relevant
• regulatory authority;
• (iv) comply with the conditions of license issued by the relevant regulatory authority;and
• is competent to provide the virtual assets services.
• 26.(l) The chief executive officer,appointed or designated under section 31(1) of this Act, shall,in writing, notify the relevant regulatory authority where that chief executive officer becomes aware or has reason to believe that-
• (a) the licensee has become insolvent or there isa likelihood of it becoming insolvent;

Ongoing

notifications.

• (b) the licensee has failed to comply substantially with a provision of this Act or such other relevant and applicable laws or a condition imposed upon it by the relevantregulatory authority;
• (c) the licensee has failed to comply with a modified provision,or with a condition,being a provision or condition specified in a direction given to it by the relevant regulatory authority;
• (d) the licensee has become involved in any criminal proceedings whether in or outside Kenya;
• (e) where the licensee is an international business company,the registered agent of the licensee has notified the licensee of its intention to resign as registered agent;
• (f) there is a material change to the business,
• including change to banking arrangements;
• (g) the licensee has or is likely to change ownership in
• shares or trusts;
• (h) one or more civil suits are pending against the
• licensee;
• (i) the licensee has ceased to carry on business for
• which it was licensed and authorised;
• (j) the directors or senior officers have resigned or ceased to be fit and proper;or
• (k) a cyber-security incident has occurred.
• (2)Withinseven workingdays ofproviding notification under subsection (1),the licensee shall furnish the relevant regulatory authority with a written report setting out the particulars of the situation and indicate such mitigating measures to be undertaken by the licensee.
• (3) Where a person contravenes the provisions of this section, the relevant regulatory authority shall take such enforcement action as it deems necessary,in terms of section 40 ofthisAct.
• 27.(1) A licensee shall not effect or permit a material change within the meaning of subsection (2),unless-

Material changes

to business.

• (a) it has served on the relevant regulatory authority a notice,in writing,stating that the licensee intends to effect such a material change;and
• (b) the relevant regulatory authority has notified the licensee,in writing,that it has no objection to the
• licensee effecting the material change.
• (2) For the purposes of subsection (1), the following changes are material--
• (a) a change to the business activity for which the license was first issued;
• (b)a change to the most recent business plan submitted to the relevant regulatory authority;
• (c)a merger with or acquisition of another legal
• person;
• (d) the sale of a subsidiary;
• (e) the acquisition of a controlling interest in another company or other entity;
• (f) the outsourcing of the functions of the virtual asset services;
• (g) where the licensee is an international business
• company,a change of registered agent of the licensee;
• (h) a change of principal place of business;
• (i) a change in directorship or senior officers;
• (j) a change of business or trade name or such other
• marks used by the licensee;
• (k) a change of domain name;or
• (l) a change in the target market.
• (3) A notice under subsection (l) shall be in such form and shall contain such information and be accompanied by such documents as the relevant regulatory authority may require.
• (4) Upon receipt of the notice under subsection (1),the relevant regulatory authority may, by notice in writing, require the licensee to provide such additional information or documents,within thirty working days from the date of

such notice or within such time as the relevant regulatory authoritymayreasonably require assessthe considerations outlined in subsection (5).

• (5) After receipt of a notice under subsection (1),the relevant regulatory authority may approve or object if it has reason,among others,to believe that-

2. (a) the interests of any clients of the licensee would be threatened by the material change; 3. (b) the manner in which the business is operated would reasonably be compromised; 4. (c) the requirements of this Act would not continue to be complied with;or 5. (d) the financial reputation of Kenya is likely to be threatened by thematerial change.

• (6) Where the relevant regulatory authority objects to the material change,it shall provide the reasons,in writing, for such objections.
• (7) Where a person contravenes subsection (1), the relevant regulatory authority shall take such enforcement action as it deems necessary,in terms of section 40 of this

8. Act. 9. 28.(1) No shares in a licensee shall be issued and no issued shares shall be voluntarily transferred or disposed of, without the approval of the relevantregulatory authority. 10. (2)Notwithstanding subsection(l),therelevant traded on securities exchange licensed in Kenya or a 11. regulatory authority may exempt from the provisions of this section a licensee whose shares or interests are publicly recognised overseas exchange and any such exemption shall be subject to- 12. (a)a condition that the licensee shall as soon as practicable,notifytherelevant 13. reasonably regulatory authorities of- 14. (i) 15. any change in control of the licensee; 16. the acquisition by any person or group of person of shares representing more than ten percent of the licensee's issued share capital 17. (ii) or total votingrights;or

Ownership

changes.

• (ii) the acquisition by any person or group of persons of shares representing more than ten percent of the issued share capital or total voting rights of the licensee's parent company;
• (b)a condition that the licensee shall, as soon as reasonably practicable,provide such information to the relevant regulatory authority,and within such period of time, as the relevant regulatory authority may require for the purpose of enabling an assessment as to whether persons acquiring control or ownership of the licensee in the circumstances set out in paragraph (a) are of satisfactory repute to have such control or ownership;and
• (c) such other terms and conditions as the relevant
• regulatory authority may deem necessary.
• (3) For purposes of subsection (l), the reference to shares or interests being transferred or disposed of includes the transfer or disposal of the legal or the beneficial interest in the shares or interests.
• (4) In the event of shares in a licensee vesting involuntarily or through process of law in a person,the licensee,as soon asit becomes aware of such vesting,shall inform the relevant regulatory authority of the number of shares and the identity of the person in whom they have vested,and the licensee and the person in whom they have vested shall comply with any instructions as to the license or the business of the licensee as may be given by the relevantregulatory authority.
• (5) A person who contravenes the provisions of subsection (1) or (4) of this section,that person commits an offence and is liable,upon conviction, to a fine or
• imprisonment,or to both,as specified in section 41(1).
• 29.(1) A licensee shall have appropriate and effective cyber security measures as prescribed or as provided for under the Computer Misuse and Cybercrimes Act.
• (2) Where a person has acted in contravention of subsection (1),the relevant regulatory authority shall take such enforcement action as it deems necessary,in terms of
• section 40 of this Act.

Cyber security measures.

• 30.(l) Every licensee shall cause to be prepared annual audited financial statements in respect of all
• transactions and balances relating to its business.
• (2) A licensee's financial statements shall be audited
• by an approved auditor in accordance with recognised audit standards and the approved auditor shall be required to provide an auditor's report in respect of the audit.
• (3) Every licensee shall submit a copy of its audited
• financial statements to the relevant regulatory authority within three months fromitsfinancial year end.
• (4) The relevant regulatory authority may at any time instruct a licensee to have its accounts audited and to submit them to the relevant regulatory authority within such time as may be specified.
• (5) Where a licensee has acted in contravention of subsections (1),(2) or(3),the relevant regulatory authority shall take such enforcement action as it deems necessary,in terms of section 40 of this Act.
• 31.(1) A virtual asset service provider shall appoint or designate a person as a chief executive officer,who shall be responsible for the day-to-day management of the virtual asset service provider in Kenya.
• (2) A virtual asset service provider shall ensure the chief executive officer is fit and proper person.
• (3) A virtual asset service provider who intends to appoint or designate a person as a chief executive officer, shall apply to the relevant regulatory authority for its approval.
• (4) The relevant regulatory authority may from time to time prescribe the eligibility criteria for the person applying or being designated to become a chief executive officer.
• 32.A virtual asset service provider shall -
• (a) maintain,in its custody,a sufficient amount of each type of virtual asset in order to meet the license holder's obligations to the customer;
• (b) meet the prescribed financial requirements relating
• to the virtual asset;

Duty to prepare annual audited financial statements.

Appointment of chief executive

officer.

Duty to protect customer assets.

• (c) segregate holdings of virtual assets on behalf of their clients from their own holdings or property, and from any other non-clientvirtual assets;
• (d) not subject the virtual asset to the claim of creditors of the license holder.

PARTV-PREVENTION OFMONEY LAUNDERING,TERRORISMFINANCINGAND PROLIFERATIONFINANCINGBYVIRTUAL ASSETSERVICEPROVIDERS

• 33.(1) Pursuant to sections 2A,36A,36B and 36C of the Proceeds of Crime and Anti-Money Laundering Act and section 42A of the Prevention of Terrorism Act,the relevant regulatory authority shall regulate,supervise and enforce compliance for anti-money laundering and counter terrorism finance purposes by all virtual asset service providers.
• (2) In undertaking its mandate under subsection (1), the relevantregulatory authority shall-
• (a) vet significant shareholders,beneficial owners, directors,senior officers of a virtual asset service provider;
• (b) conduct onsite inspection;
• (c) conduct offsite surveillance;
• (d) undertake consolidated supervision of institution and its group;
• an
• (e) compel theproduction ofany documentor information the relevant regulatory authority may require for the purpose of discharging its supervisorymandate under the Proceeds of Crime and Anti-MoneyLaundering Actandthe
• Prevention of Terrorism Act;
• (f)impose monetary,civil or administrative sanctions for violations related to anti-money laundering and counter terrorism finance purposes;
• (g) issue regulations,guidelines, directions,rules or instructions for anti-money laundering and counter
• terrorism finance purposes;

Powers of

relevant regulatory authority for antimoney laundering and counter terrorism finance purposes.

Cap59A.

Cap59B.

• (h) co-operate and share information for anti-money
• laundering and counter terrorism finance purposes; and
• (i) take such action as is necessary to supervise and enforce compliance by a virtual asset service provider in line with the provisions of the Proceeds of Crime and Anti-Money Laundering Act, the Prevention of Terrorism Act and any regulations,guidelines,rules,instruction or direction made or issued thereunder.
• 34.(1) No director, officer, employer, agent or any other person in a virtual asset serviceprovider shall violate or fail to comply with the regulations, guidelines, directions, rules or instructions issued for anti-money
• laundering and counter terrorism finance purposes.
• (2) A person who violates or fails to comply with the provisions of subsection (1l),that person commits an offence and shall be liable, upon conviction,to imprisonment or a fine,or to both,as specified under section 41(3) of this Act.

PARTVI-VIRTUALASSET OFFERING

• 35.(1) A person shall not issue or purport to issue a
• virtual asset offering,in or from Kenya,or seek an admission of such asset to trading on a virtual asset trading platform unless that issuance is approved under this Act or any otherrelevant law.
• (2) For avoidance of doubt,a natural person shall not be eligible to promote or issue a virtual asset offering in or fromKenya.
• (3) A person desiring to issue or promote a virtual requirements as may be prescribed by the relevant
• asset offering,in or from Kenya, or trading on a virtual asset trading platform shall be in compliance with such regulatory authority.
• (4) A person shall not issue or promote a virtual asset offering,in or from Kenya,or trading on a virtual asset trading platform unless it has submitted to the relevant regulatory authority an application in compliance with
• subsection (3) and the relevant regulatory authority has

Cap59A.

Cap59B.

Penaltiesfor

violationsrelating to money laundering, terrorism financing.

Issuers of virtual asset offering.

• notified the person,in writing, that it has no objection to

the issuance.

• (5)Notwithstanding subsection (4),the relevant such measures or actions be taken after issuance has
• regulatory authority may object,in writing,and require that commenced,where-
• (a) the manner in which the issuance is advertised is not consistent with the information provided in the application;
• (b) the description,nature or characteristics of the virtual asset offering material deviatesfrom the description provided in the application;
• (c) the issuer is a person that was not disclosed in the application;
• (d) the target investor base is different from that
• disclosed in the application;
• (e) the relevant regulatory authority has reason to believe that the issuer is misselling the virtual assets offering;or
• (f) the issuance is undertaken in a manner detrimental to the public interest.
• (6) A person who,in connection with the application, supplies the relevant regulatory authority with information he or she knows or should reasonably know is false or misleading,that person commits an offence and is liable, upon conviction,to imprisonment or a fine,or to both,as specified under section 41(2) of this Act.
• (7) A person who contravenes the provisions of subsection (1),(2),(3)or(4),that person commitsan offence and is liable,upon conviction,to imprisonment, fine or to both fine and imprisonment, as specified in
• section 41(3).

PARTVII-INVESTIGATIONAND EXAMINATION

• 36.(l)Therelevantregulatory authority shall undertake compliance inspections and investigations in accordance with the powers conferred under this Act and any other Act ofParliament.

Compliance, inspection and

investigation.

• (2) Subject to subsection (1), any person acting as a virtual asset service provider or issuer of a virtual asset offering shall cooperate with the relevant regulatory authority during any investigation or examination.

2. 37.A relevant regulatory authority may appoint or designate examiners and empower such examiners with the necessary powers to undertake such examinations in accordance with the powers under this Act and any other written law. 3. 38.(l) A relevant regulatory authority shall require the production ofinformation,including specified information or documents,in accordance with the powers conferred to it under this Act or any other written law.

• (2) Notwithstanding the provisions of subsection (1),a relevant regulatory authority may require the production of information or documents from any person or company which is or has at any relevant time been-

5. (a) a parent company, subsidiary company or other 6. associate of the licensee; 7. (b) a subsidiary company of a parent company of the 8. licensee; 9. (c) a parent company of a subsidiary company of the 10. licensee; 11. ) 12. company;or 13. (e) a company in the case ofwhich a significant owner of the licensee,either alone or with any associate or associates,holds 10 percent or more of the shares or is entitled to exercise,or control the exercise of, more than 10 percent of the voting power at a general meeting.

• (3) The relevant regulatory authority may,by notice in writing served on any person who is or is to be a controller or officer of a licensee require him or her to provide the relevant regulatory authority,within such time as may be specified in the notice,with such information or documents as the relevant regulatory authority may reasonably require for determining whether he or she is a fit and proper person to hold the particular position which he or she holds or is to

15. hold.

Appointmentor

designation of examiner.

Powers to access information.

• (4) The powers conferred by subsection (1), (2) or (3) may be exercised in relation to a former licensee but only in relation to—

2. (a) business carried on at any time when the licensee was licensed under this Act;or 3. (b) the ownership or control of a licensee at any time 4. when it was licensed under this Act.

• (5) Any person who, in connection with a request

6. made under this section, supplies the relevant regulatory authority with information he or she knows or should reasonablyknow is false ormisleading,commits an offence and is liable,upon conviction,to imprisonment,fine or to both,as specified under section 41(2) of this Act.

• (6) The relevant regulatory authority shall take such enforcement action as it deems necessary,in terms of section 40 where a person who,without reasonable excuse, fails to comply with a requirement imposed on him or her by the relevant regulatory authority in connection with the exercise of the relevant regulatory authority's powers under this section.

8. 39.(l) The relevant regulatory authority may by notice in writing require a person who is the subject of an investigation in termsofthis Actorany otherwrittenlaw orany person connectedwiththeperson under investigation— 9. (a) to provide, at such place and in such form as may be specified in the notice and either forthwith or at such time asmay be so specified,such information as the relevant regulatory authority may reasonably require for the purpose of the investigation; 10. (b) to produce, at such place as may be specified in the notice and either forthwith or at such time as may be sospecified, such documents,or documents of such description,as may be specified,being documents the production of which may be reasonably required for the investigation;

Additional powers.

• (c) to attend at such place and time as may be specified in the notice and answer questions relevant to the enquiry as the relevant regulatory authoritymayrequire.
• (2) The relevant regulatory authority may, by notice in
• writing,require every person who is or was a senior officer, director, shareholder,beneficial owner, officer, employee or agent of a licensee which is under investigation by virtue of subsection (1)-
• (a) to produce to the relevant regulatory authority within such time and at such place as the relevant regulatory authority may require, such documents, or documents of such description,as may be specified, being documents the production of which may be reasonably required for the investigation, which are in his or her custody or power to obtain;
• (b) to attend before the relevant regulatory authority at such time and place as the relevant regulatory authority may require and answer questions relevant to the investigation as the relevant regulatory authority may require; and
• (c) to take such actions as the relevant regulatory authority may direct in connection with the investigation.
• (3) The relevant regulatory authority or a duly
• authorised officer, employee or agent of the relevant regulatory authority may take copies of or extracts from any documents produced under this section.
• (4) Any officer, employee or agent of the relevant regulatory authority may, on producing if required evidence of his or her authority, enter any premises occupied by a person on whom a notice has been served under subsection (1) for the purpose of obtaining information or documents required by the notice, putting the questions referred to in subsection (l)(c) or exercising the power conferred by subsection (3).
• (5) For the purposes of this section, a person is connected with the person under investigation if such
• person is orhas at anyrelevant time been

• (a) a member of a group to which the person under investigation belongs;
• (b) a controller or significant owner of the person under investigation;
• (c) a partner of a partnership of which the person under investigation is a member.
• (6) Any person who,in connection with the exercise of the relevant regulatory authority 's powers under this section,supplies the relevant regulatory authority with information he or sheknows or should reasonably know is false or misleading,that person commits an offence and is liable upon conviction to such penalties as specified under section 41(2) in this Act.
• (7) The relevant regulatory authority shall take such enforcement action as it deems necessary,in terms of section 40 where a person who,without reasonable excuse, fails to comply with a requirement imposed on him or her by the relevant regulatory authority in connection with the exercise of the relevant regulatory authority's powers under this section.

PARTVIII-ENFORCEMENTACTIONS

• 40.(l) The relevant regulatory authority may take administrative enforcement action against any person who violates any relevant provision of this Act.
• (2) In exercising the powers provided for under subsection (1), the relevant regulatory authority may take the following administrative enforcement action-
• (a) issue a formal written warning to the licensee for the cessation of the non-compliance and require the specific action for rectification is undertaken;
• (b) issue a direction to the licensee to take remedial action or to make specific arrangements to remedy the noncompliance within such timeframe as may be specified;
• (c) issue a directive to the licensee imposing a prohibition,restriction or limitation,including-
• (i) issuing enforcement notices requiring noncompliance to berectified within a specified period of time;

Administrative enforcement action.

• (ii) restriction from entering into any new
• business contracts;
• ili requiring that any director, senior officer or person having functions in relation to the licensee, be removed and replaced by a person acceptable to the relevant regulatory authority;
• (iv) requiring such action as the relevant regulatory authority may consider necessary to protect customers,creditors or potential
• customers and creditors;
• (d) suspend or revoke-
• (i) a license issued under section 1lof this Act;
• (ii) a virtual asset offering approved under section
• 35 of this Act;or
• (e) initiate such investigation as may be necessary to
• ensure compliance with this Act;
• f impose an administrative penalty to a person who contravenes the provisions provided for under section13(5),15(2)or21(4)ofthisAct-
• (i) in the case of an individual, of a fine not
• exceeding three million shillings; or
• (ii)in the case of a company, of a fine not exceeding ten million shillings;
• (g) taking any other administrative enforcement action determined by the relevant regulatory authority under this Act or any other relevant Act of
• Parliament.
• (3) When determining the appropriate administrative enforcement action, the relevant regulatory authority shall consider the following factors-
• (a) the nature, seriousness and impact of the violation;
• (b) the conduct of the individual or company after the
• violation and throughout any investigation or examination by the relevant regulatory authority;
• (c) the previous disciplinary record and compliance
• history of the individual or company;

• (d) the interpretation and application of the relevant regulatory authority published materials,including guidance, industry codes and such materials as may bepublished from time to time;and
• (e) any action taken by the relevant regulatory authority or by other domestic or international regulatory bodies in similar cases.
• 41.(l) A person who commits an offence under section 28(5) is liable,upon conviction—
• (a) in the case of an individual,to a fine not exceeding three million shillings or to imprisonment for a term not exceeding three years,or to both;
• (b) in the case of a company, to a fine not exceeding
• five million shillings.
• (2) A person who commits an offence under section
• 11(8),35(6),38(5)or39(6)is liable,upon conviction
• (a) in the case of an individual, to a fine not exceeding seven million shillings or to imprisonment for a term not exceeding three years,or to both;
• (b) in the case of a company, to a fine not exceeding twenty million shillings.
• (3) A person who commits an offence under section 9(3),22(2),34(2)or35(7)is liable,upon conviction —
• (a) in the case of an individual,to a fine not exceeding ten million shillings or to imprisonment for a term not exceeding five years,or to both;
• (b) in the case of a company,to a fine not exceeding
• twenty-five million shillings.
• 42.Where any offence or contravention against this Act is committed by a licensee, a director, partner or any senior officer of the licensee who knowingly authorised, permitted or aided in the commission of the offence that individual also commits the contravention or offence and, is liable for any criminal,civil or administrative penalty to which the licensee is liable under this Act.

PARTIX-MISCELLANEOUSPROVISIONS

• 43.(1) Subject to subsection (2),neither the relevant regulatory authority nor any agent of the relevant

Criminal offences and penalties.

Liability of individuals.

Confidentiality.

information or documents acquired in the performance of its duties under this Act, including in respect of any licensees.

• (2) Subsection (1) shall not apply to any disclosure -—

2. (a) lawfully required by any court of competent jurisdiction in Kenya; 3. (b) in respect of the affairs of any licensee or other person, with the consent of such person, as the case may be,which consent has been voluntarily given; 4. (c) where the information disclosed is in statistical form or is otherwise disclosed in such a manner that does not enable the identity of any licensee or otherperson towhich the information relates to be ascertained;or 5. (d) in terms of any lawful disclosure required under the Mutual Legal Assistance Act,the Proceeds of Crime and Anti-Money Laundering Act, Prevention of Terrorism Act or any other relevant 6. law,bilateral or multilateral agreements. 44. (1) A person who is aggrieved by any of the following decisions of the relevant regulatory authority may appeal against that decision to the relevant body- 8. (a) refusal to approve an application for a license in 9. terms of this Act; 10. (b)refusal to approve any other application or 11. appointment made in terms of this Act; 12. (c) the decision to amend,revoke or suspend a license or a decision to amend a condition of a license in terms of this Act;or 13. (d) an enforcement action taken by the authority.

• (2) In determining an appeal, the relevant body may-—

15. (a) confirm,vary or revoke the decision of the relevant regulatory authority;and 16. (b) make further orders as it considers appropriate.

• (3) For the purposes of this section, a "relevant body" means a court of law,a tribunal or a committee established

18. by a written law of competent jurisdiction in Kenya.

Appeals.

• 45.(1) A licensee shall,where the relevant regulatory
• authority so requires, provide the relevant regulatory authority with online or automated real time read-only access to both its client's and its own virtual asset transaction records.
• (2)A licensee shall maintain a record of both its client and its own transactions at its principal place of business for a period of not less than seven years beginning from the date the transaction occurred.
• (3) Where a person has acted in contravention of
• subsection (1) or (2), the relevant regulatory authority shall take such enforcement action as it deems necessary,in terms of section 40 of this Act.

46. No action,prosecution or other proceedings shall be brought against the relevant regulatory authority,an employee or agent of the relevant regulatory authority or other person appointed under this Act in respect of any acts done or omitted to be done in good faith in the proper discharge of functions or duties conferred by this Act. 47. Any person processing personal data under this

• Act shall comply with the Data Protection Act.
• 48.Upon the commencement of this Act,any person providing virtual asset services shall,within one year of the commencement,comply with the provisions of thisAct.
• 49.The Act specified in the Second Schedule is
• amended in the manner specified in that Schedule.

PARTX-PROVISIONSONDELEGATEDPOWERS

50. (1) The Cabinet Secretary may, on the advice of 2. the relevant regulatory authority,make Regulations for the purpose of carrying out and giving effect to the provisions of this Act.

• (2) Without prejudice to the generality of subsection (1),the Cabinet Secretary may make Regulations relating

4. to- 5. (a) matters to be included in the materials to be published by the licensee for the promotion of a 6. virtual asset offerings;

Access to and maintenance of

client transaction records.

Protection from liability.

Compliance to the DataProtection Act Cap.411C.

Transitional and saving provisions.

Consequential amendments.

Regulations.

• (b) other informationor documentationtobe
• submitted in support of an application under this Act;
• (c) the acquisition or holding of shares,legal interest
• orbeneficial ownership in the license holder;
• (d) conditions for assignment and transfer of a license;
• (e) standards to be maintained by the licensee in the
• conduct of its business;
• (f) the standards,policies and procedures for business
• management and continuity;
• (g)advertisement and promotion of virtual asset
• services and products;
• (h) prudential standards in respect of --
• (i) disclosure to clients;
• (ii)
• safekeeping of client virtual assets;
• (ili) cyber security measures and cyber security audit report;
• (iv) financial reporting;
• (v)
• statutory returns;
• (i) third party transactions and relationships; and
• (j) periodic returns.
• (3) The Regulations made under this subsection may provide for the imposition of penalties not exceeding ten million shillings or imprisonment for a term not exceeding five years for contravention of the Regulations.
• (4) For the purposes of Article 94 (6) of the
• Constitution-
• (a) the purpose and objective of the delegation under this section is to enable the Cabinet Secretary to make regulations for better carrying into effect the provisions of this Act;
• (b) the authority of the Cabinet Secretary to make bringing into effect the provisions of this Act and
• regulations under this Act will be limited to fulfilment of the objectives specified under this section.

FIRSTSCHEDULE VIRTUALASSETSERVICES

(ss. 2;3(1); 7(1)(a); 10(1),(2) &(4))

The list below shall constitute the types of virtual asset services, their functions and description of services.

| Types | Functions | Description | Responsible Relevant Regulatory Authority | |---------------------------------|-------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------| | Virtual Asset | Custodial Wallet Provider wallet/ services (corporate and retail) | Services provided by a third party,in which the privatekeys to the subject's virtual assets are held and managed by the third party forproof of ownership and facilitation of transactions. | Central Bank of Kenya | | Virtual Asset Exchange | Transfer and conversion services of Virtual Assets | Providing a digital online platform facilitating virtual assetAuthority. transfers and exchanges. Exchanges may occur between one or more forms of virtual assets,or between virtual assets and fiat currency. | Capital Markets | | Virtual Asset Exchange | Trading, clearing and settlement platforms. | Aplatform providing for the facilitation of the sale,trading,or exchange ofvirtual assetsfor fiat currencies or for other virtual assets. | Capital Markets Authority | | Virtual Asset Payment Processor | Payment gateway | Arranging transactions involving virtual assets and fiat currency,or Kenya betweenvirtual assets. | Central Bankof | | Virtual Asset Broker | Brokerage services | Facilitate the exchange between one or more forms of virtual assets through a virtual asset exchange and virtual asset wallet providers for and onbehalfof clients,which may include retail, institutionalinvestors,orfunds. | Capital Markets Authority |

| Types | Functions | Description | Responsible Relevant Regulatory Authority | |-----------------------------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------| | Virtual Assets Investment Advisor | Investment advisory services | Provision ofinvestment advice on virtual assets,initial virtual asset offering and non-fungible tokens for andonbehalfof clients,which may include individualsor institutional investors. | Capital Markets Authority | | Virtual Asset Manager | Virtual Asset management | Managing portfolios in accordance with mandates given Authority by clients ona discretionarybasis where such portfolios include one or more virtual assets. | Capital Markets | | Virtual Asset Offering Provider | Initial Coin Offering | Issuing and selling virtual assets tothe public. May participating in and providing financial services relating to the initial coin offering. | Capital Markets involve|Authority | | Virtual Asset Offering Provider | Virtual Asset Tokenization | The process of converting real- world assets (like real estate,art,Authority orcommodities)intodigital tokens on a blockchain. | Capital Markets | | Virtual Asset Offering Provider | Token Issuance Platform | Provisionoftokenizationplatform forissuanceandsecondary trading of tokens of real-world assets. | Capital Markets Authority | | Virtual Asset Offering Provider | Stablecoin Issuance | The processof creating and managing approved stablecoins. | Central Bankof Kenya |

SECOND SCHEDULE

CONSEQUENTIALAMENDMENTS

(s. 49)

Amendment

• (1) By deleting the definition of "reporting institution" and substituting therefor the following definition

"reporting institution" meansa financial institution, designated nonfinancial business and profession or a virtual asset service provider;

• (2) By inserting the following new definition in proper alphabetical sequence—

"virtual asset service provider " has

the meaning assigned to it under section 3 of the Virtual Asset Service Providers Act.

• 44(4) By deleting the words "financial institution" and substituting therefor the words"reporting institution".
• 45A (1) In subsection (1), by inserting the words "or virtual asset service providers" immediatelyafterthewords"legal arrangements".
• (2) In subsection (3)(c), by inserting thewordsorvirtualasset service providers" immediately after the words "financial institutions".

Written law

Provision

The Proceeds of s.2 Crime and AntiAct

Money Laundering (Cap.59A)

The Capital s.2 Markets Act (Cap. 485A)

• (3) In subsection (3)(d), by inserting

2. the words "orvirtualassetservice providers" immediately after the words ""financial institutions" appearing after the words "offices of'.

• (1) In the definition of the word "securities", by inserting the following paragraph immediately after paragraph ()-

4. (la) virtual asset;

• (2) By inserting the following new definitions in proper alphabetical sequence--

"virtual asset" has the meaning assigned to it under section 2 of the Virtual Asset Service Providers Act;

"virtual asset service provider" has the meaning assigned to it under section 3 of theVirtual Asset Service Providers Act;

s.11(3) By inserting the following paragraph immediately after paragraph (fa)-

• (fb)regulate virtual asset service

The Central Bank s.2 of Kenya Act

(Cap. 491)

• providers in accordance with the Virtual Asset Service Providers Act;

By inserting the following new definition in proper alphabetical sequence-

"virtual asset service provider" has the meaning assigned to it under section 3 of the Virtual Asset Service Providers Act;

S.4A

The National s.2 Payment System Act (Cap.491A)

• s.17A

In subsection (1) —

• (a) by inserting the following new paragraph immediately after paragraph (db)
• (dc) license and supervise virtual asset service providers;

(b) in paragraph (h)-

• (i) in the opening sentence, by inserting the words "and section 7 of the Virtual Asset Service Providers Act" immediately after the expression "Cap. 59A"; and
• (ii) by inserting the following new subparagraph immediately subparagraph (vii)
• after (viia) virtual asset service

providers;

Byi insertingt the following new definition in proper alphabetical sequence-

"reporting institution" has the meaning assigned to it under section 2 of the Proceeds of Crime and AntiMoney Laundering Act (Cap. 59A).

In subsection (1), by inserting the words"and section 7of the Virtual Asset Service Providers Act"immediately after the expression "Cap. 59A" appearing in

the first sentence.

MEMORANDUMOF OBJECTSAND REASONS

This Bill seeks to provide a legislative framework to regulate virtual

asset service providers and address potential risks associated with the misuse of virtual asset products and virtual asset services. The Bill designates the Capital Markets Authority and the Central Bank of Kenya as the primary regulatory authorities for virtual assets services and virtual assets service providers in Kenya. The Bill further provides for the licensing requirements for virtual assets services and the factors that the relevant regulatory authority shall consider while considering an application for a license. Further the Bill provides for general obligations of virtual asset service providers including the obligation for a fit and proper assessment before a virtual asset provider appoints any person or senior officers.

The structure of the Bill is as follows:

• PART I (Clauses 1-5) of the Bill provides for preliminary matters including,the short title and interpretation of technical terms used in the Bill.
• PART II (Clauses 6-8) of the Bill contains provisions on the designation of regulatory authorities. In this regard, the Bill designates the Capital Markets Authority, Central Bank of Kenya and any other public body that the Cabinet Secretary may designate as a regulatory body responsible for the implementation of this Act.The designated regulatory authorities above are empowered regulate, supervise and monitor the activities and the conduct of virtual asset service providers to ensure market integrity and soundness of financial system in respect of matters falling under the Act.
• PART III (Clauses 9-18) of the Bill provides for the licensing
• regime of virtual asset service providers by setting out requirements expected to be met by an applicant who wants to be licensed as a virtual asset service providers operating in or from Kenya. Further the Bill provides for the grounds upon which a virtual asset service providers licence may be granted.
• PART IV (Clauses 19-32) of the Bill seeks toprovide for the general obligations of a person licensed as a virtual asset service provider in the country. Such a licensee shall be a fit and proper person based on several factors, including the person's probity, competence, experience and soundness of judgment for fulfilling the responsibilities of the relevant position; any evidence that the person has committed any offence involving dishonesty or fraud or has contravened any law designed to

protect members of the public arising from dishonesty,incompetence, malpractice, misconduct or conduct of discharged or undischarged bankrupts or otherwise insolvent persons amongst others.

• PART V (Clauses 33-34) of the Bill contains provisions on the prevention of money laundering,terrorism financing and proliferation financing by virtual asset service providers. It requires the relevant regulatory authority to regulate, supervise and enforce compliance for anti-money laundering and counter terrorism finance purposes by all virtual asset service providers.
• PART VI (Clause 35) of the Bill seeks to allow the issuance of virtual asset offering or admission of such asset for trading on a virtual asset trading platform with approval from the relevant regulatory authority.
• PART VII (Clauses 36-39) of the Bill seeks to empower the regulatory bodies to undertake compliance inspections and investigation in accordance with the powers conferred under the Act.
• PART VIlI (Clauses 40-42) of the Bill contains provisions requiring the regulatory authorities to enforce administrative and criminal sanctions against any person who violates the provisions of the Act.
• PART IX (Clauses 43-49) of the Bill contains miscellaneous provisions which includes provisions on confidentiality of the client's information and documentation and access to and maintenance of client transaction recordsby the relevantregulatory authority.
• PART X (Clause 50 provides for the delegated powers of the Cabinet Secretary to make Regulations.

Statement on Whether the Bill limits Rights or Fundamental Freedoms contained in the Bill of Rights

The Bill does not contain provisions limiting the rights and fundamental freedoms contained in the Bill of Rights.

Statement on Whether the Bill is a Money Bill in terms of Article

114 of the Constitution

The Bill is a draft money Bill in terms of Article 1l4 of the Constitution since it contains provisions assigning more powers and functions to the designated regulatory authorities including powers to appoint designated examiners to undertake examination of documents and information regarding the licensees.

Statement on Whether the Bill Concerns County Governments

The Bill does not concern county governments in terms of Article

110 (1) (a) of the Constitution.

Dated the 17th March,2025.

ICHUNG'WAHKIMANI, Leader of the Majority Party.