Lead Signal
Kenya's payments operating environment now turns on a single, sharply defined gap: a digital-money statute that is in force against implementing rules that are not. The Virtual Asset Service Providers (VASP) Act 2025 was assented in October 2025 and came into force on 4 November 2025, establishing a dual-regulator model in which the Central Bank of Kenya licenses payment-related virtual assets — stablecoin dealers, virtual asset wallet providers, payment processors and stablecoin-issuance providers — while the Capital Markets Authority supervises exchanges, brokers and tokenisation platforms. The operationalising regulations, however, remain in draft. The draft National Treasury rules would set the heaviest capital requirement on stablecoin issuers at KES 500 million (~USD 3.8m), counting only fully paid-up funds, with licensing fees ranging from KES 100,000 to KES 2 million. Consultation on those rules closed on 10 April 2026, but gazette had not been confirmed as of 24 June 2026, and no VASP had been licensed. The framework exists; operational certainty does not. We assess this split — in-force Act, pending subsidiary rules — as the defining commercial-certainty gap for any issuer planning Kenya entry, and we hold confidence at Assessed rather than High precisely because the licensing mechanics are unresolved.
This foundational uncertainty sits atop an otherwise mature licensing architecture. The CBK operates a single-tier non-bank PSP authorisation regime under the National Payment System Act 2011 and NPS Regulations 2014, with four PSP categories and First Schedule core-capital floors of KES 5,000,000, KES 50,000,000, KES 20,000,000 and KES 1,000,000 across the category tiers. There is no EMI or PI passporting, foreign licences are not recognised, and each applicant must be locally incorporated and CBK-authorised, with full authorisation typically taking four to nine months. Banks are licensed separately under the Banking Act (Cap 488). The binding constraint on market access is therefore local incorporation plus non-recognition of foreign licences — not the capital floors themselves.
Other Developments
The cross-border picture shifted materially in early 2026. Announced 26 February 2026, Pesalink became a PAPSS Technical Connectivity Provider, connecting 80+ Kenyan bank, fintech, SACCO and telco participants to 160+ commercial banks and fintechs on PAPSS and enabling instant 24/7 cross-border payments settled in local currencies, with Kenya the 10th African central bank on the system. This directly addresses correspondent-banking de-risking pressure, which is amplified by Kenya's FATF grey-listing (placed February 2024, retained through the June 2026 plenary) and its EU high-risk third-country listing (added 10 June 2025). On the domestic rails side, the CBK's Fast Payment System national switch — originally targeted for 2025 — remains unconfirmed as launched, with industry sources suggesting a build of up to four years.
In consumer protection, the CBK has unveiled a plan under the Kenya National Financial Inclusion Strategy 2025-2028 to establish formal compensation rules for e-money and digital-wallet fraud, committed for implementation by end-2026; this is a pending regime, not a UK-PSR-style mandatory reimbursement scheme in force. The in-force Digital Credit Providers Regulations 2022, strengthened by the Business Laws (Amendment) Act 2024/2025 with its harassment ban and in-duplum interest cap, continue to reshape the digital-lending segment. On the commercial side, a bank-into-fintech vertical-integration pattern is emerging: KCB Group acquired a 75% controlling stake in Riverbank Solutions in March 2025 for about KES 2 billion (~USD 15.4m), and on 31 October 2025 announced an undisclosed minority stake in CBK-licensed PSP Pesapal, still awaiting regulatory approval as of an 11 March 2026 investor briefing.
Cross-Monitor Connections
Kenya's AML/CFT status is carried here from the Sentinel feed only; original illicit-finance and grey-list-exit analysis is routed to FIM. The FATF grey-list retention (June 2026), EU high-risk listing (June 2025) and the AML and Combating of Terrorism Financing Laws (Amendment) Act 2025 signed on 17 June 2025 carry illicit-finance and sanctions-evasion significance beyond the WPM payments-context carry. Likewise, the VASP Act bringing virtual-asset flows into a supervised perimeter has illicit-finance-use significance — travel rule, VASP as reporting institution — that is a FIM flag, not a WPM conclusion. Within WPM, the grey-list-driven correspondent-banking de-risking is best read narrowly as a settlement and access friction, with PAPSS local-currency settlement as the direct commercial mitigation.
Outlook
The near-term watch items are concentrated and datable. First, finalisation and gazette of the VASP Regulations 2026, expected in the second half of 2026, will close the in-force-Act-versus-pending-rules gap and is the single most important forward signal for stablecoin and virtual-asset payment operators. Second, the CBK Fast Payment System launch remains the structural lever against M-Pesa's near-monopoly mobile-money position (~89.7% share, transaction activity equivalent to ~8% of GDP); timeline slippage preserves the incumbent's standing. Third, the CBK e-money fraud-compensation framework, targeted for end-2026, would shift liability onto mobile-money providers if implemented. Fourth, CBK approval of the KCB-Pesapal minority stake will confirm whether the bank-into-fintech integration pattern consolidates. Each of these is pending and worth diffing on the next periodic run.