Kenya VASP Regulations 2026: Cybersecurity and Pentests

Video transcript

Kenya's 2026 Virtual Asset Service Providers Regulations put security evidence in the license file. The window for existing providers closed on November 4, 2026.

The rules cover services offered in or from Kenya, even by firms with no Kenyan presence that target Kenyan consumers.

To apply, you file a cybersecurity policy, a continuity plan, and an independent information systems audit with a pentest, prepared by a qualified person.

Once licensed, you need a chief information security officer. Vulnerability assessments and pentests run twice in year one, then at least yearly. Audit trails must reconstruct every transaction and resist tampering.

You must notify the regulator within 24 hours of discovering a cyber incident. Loss of keys counts too. A detailed report with remedial actions follows within five working days.

Monthly breach reports are due by the tenth, and wallet providers reconcile onchain holdings against internal records each month. Continuity and incident plans are tested yearly.

One thing is still open. The Regulations set no pentest scope or methodology, and Oraro and Company expects the regulators to issue further guidance.

Guardian's infrastructure pentests cover cloud, secrets and build pipelines. Web app pentests attack withdrawal flows. Smart contract audits support listing reviews, and a readiness assessment maps each provision to its control and evidence.

Read the full article for the complete map, or talk to Guardian at guardian.security.

Kenya's Cabinet Secretary for the National Treasury made the Virtual Asset Service Providers Regulations, 2026 on July 3, 2026. They were gazetted on July 22 as Legal Notice No. 134.

They implement the Virtual Asset Service Providers Act, 2025. The Act gave existing providers one year from its November 4, 2025 commencement to comply.

That window closed on November 4, 2026. Security now runs through the license file and every year after it.

This article explains the technical and security side of Kenya's Virtual Asset Service Providers Regulations, 2026. It is not legal advice; confirm how it applies to you with counsel.

The Regulations at a Glance

The Regulations apply to anyone offering virtual asset services “in or from Kenya” (regulation 4).

That includes firms with no Kenyan presence that target Kenyan consumers or earn income from Kenya.

The Act's First Schedule splits licensing between two regulators:

The text says “the relevant regulatory authority” throughout. Read it as your licensing regulator.

Breaching regulations 96, 97 or 100 can mean fines of up to KES 5 million for a company, and suspension or revocation (regulation 142).

Security Evidence to Apply

Regulation 6(2) lists what an application must include. The security items are:

• A description of the proposed business's systems and controls (6(2)(e)).
• A cybersecurity and IT policy, and a continuity and disaster recovery plan (6(2)(f)).
• Evidence of the human and technology resources regulation 18 requires (6(2)(k)).
• An independent information systems audit report, including a vulnerability assessment and penetration test (6(2)(l)).

That report must be “prepared by a person who holds the relevant qualifications and competences”. The Regulations name no certification or testing standard.

The business plan (Third Schedule) has a technology section. It asks for:

• ICT systems and cybersecurity controls.
• Network architecture and data flow diagrams.
• The standards they conform to.
• Wallet infrastructure and addresses, hot and cold.

The regulator decides within thirty days of a complete application and finished due diligence (regulation 6(4)).

Part X Cybersecurity Duties

Part X (regulations 96 to 100) sets the standing duties. Regulation 96 starts with governance:

• A chief information security officer, or equivalent, overseeing cybersecurity systems.
• Monitoring to “quickly detect and prevent cyber incidents”.
• Documented processes and periodic staff training.
• A strategy and policy review at least yearly, and after any incident.
• Review results to the board within one month.

Testing cadence

Regulation 97(4)(a) requires vulnerability assessment, risk assessment and penetration testing “on a bi-annual basis during the first year of licensing”.

After that, they run “at least once a year”. Our reading: two rounds in year one, separate from the application pentest.

The regulator may also require a qualified, independent party to audit your systems and controls and give the regulator a written opinion (97(5)).

Audit trails

Regulation 97(4)(b) requires audit trail systems that:

• Allow “complete and accurate reconstruction of all financial transactions and accounting”.
• Protect audit trail data from alteration or tampering.
• Limit access to hardware, and log physical access.
• Log system events, including changes to the audit trail and cybersecurity events.

Transaction records must hold “wallet addresses, network or chain identifiers and interaction logs”, kept at least seven years (regulation 22).

Our reading: write logs to storage the application cannot alter, then test that claim in the pentest.

Systems and code

Controls must have regard to confidentiality, access, integrity and maintenance, including “proper code version control” (97(3)).

The same list covers procedures for infrastructure updates, “including forks”.

A fit and proper person must prepare the cybersecurity audit report (regulation 100).

24-Hour Incident Reporting

Regulation 99 starts two clocks when a licensee discovers a cybersecurity incident:

1. 24 hours: notify the regulator.
2. Five working days: file a detailed report, with remedial actions.

The report says whether the incident hit critical or important functions or licensed services, or involved malicious unauthorized access.

Regulation 99(4) adds that any material cybersecurity incident, “loss of keys, or unauthorised transaction” must be reported within 24 hours.

“Cybersecurity incident” is broad. It covers anything that jeopardizes integrity, confidentiality or availability without lawful authority.

Three duties sit nearby:

• Insurance: cover against cybersecurity risks, theft, loss of keys or operational failure (88(5), 99(4)).
• Monthly reports: fraud, theft, material interruptions and major security breaches, by the tenth (26(2)).
• Plans: board-approved continuity and incident response plans, reviewed and tested yearly (regulation 21).

For the first hours of an incident, see our exchange incident response plan.

Custody and Reconciliation

Wallet providers carry the sharpest custody rules (regulation 66(1)):

• Consumer assets on separate onchain addresses from the provider's own.
• Separate internal ledger accounts for consumer and own assets.
• Monthly reconciliation of onchain holdings against internal records and consumer entitlements, available to the CBK by the tenth.
• Explicit consumer consent before using omnibus accounts.
• No lending, pledging or other encumbrance of consumer assets.

Every licensee must reconcile consumer assets consumer by consumer, using onchain and offchain records (regulation 107(3)).

Regulation 105 requires reliable wallet technology, with effective security for keys, hot and cold storage, passwords and encryption.

Listings and smart contracts

Before listing an asset, exchanges and token issuance platforms must consider “technical security audits, including smart contract reviews” (regulation 33(2)(g)).

They keep that record for the life of the listing, and monitor each asset continuously.

Compliance Calendar

What is still open: the Regulations set no pentest scope or methodology. Oraro & Company expects the CBK and CMA to issue further implementation guidance.

How Guardian Helps

Guardian's pentests cover web apps, APIs, cloud, keepers, extensions and SDKs, tested by the researchers who audit your contracts.

Infrastructure pentests cover cloud posture, secrets handling and build pipelines. WebApp pentests attack withdrawal and transfer flows.

For listing reviews, Guardian runs smart contract audits. The regulatory readiness assessment lists each provision with its control and evidence.

New to testing? Start with what penetration testing is, then what exchange pentesting covers.

Frequently Asked Questions

Who regulates VASPs in Kenya?

The CBK licenses wallet providers, payment processors and stablecoin issuers. The CMA licenses exchanges, brokers, investment advisors, managers, ICO providers, tokenization and token issuance platforms. The split is in the First Schedule of the VASP Act, 2025.

Does a Kenyan VASP license application need a pentest?

Yes. Regulation 6(2)(l) requires an independent information systems audit report, including a vulnerability assessment and penetration test, prepared by a person with the relevant qualifications and competences.

How often must Kenyan VASPs run pentests?

Regulation 97(4)(a) requires vulnerability assessment, risk assessment and penetration testing twice during the first year of licensing, then at least once a year.

How fast must Kenyan VASPs report a cyber incident?

Within 24 hours of discovery, to the relevant regulator. A detailed report with remedial actions follows within five working days (regulation 99).

Sources

• Kenya Gazette Supplement No. 185: Legal Notice No. 134, The Virtual Asset Service Providers Regulations, 2026 (July 22, 2026), copy published by the CMA
• CMA: The Virtual Asset Service Providers Act, 2025 (No. 20 of 2025), commenced November 4, 2025
• CMA: Regulatory Framework (accessed November 6, 2026)
• Oraro & Company Advocates: Legal Alert, Virtual Asset Service Providers Regulations, 2026 (August 2026)