Last week, Kenya’s Treasury published the Virtual Asset Service Providers Regulations. The loudest applause seemed to have come not from the fintech hubs of Westlands, but from the boardrooms of traditional banks. The 150-page document was drafted with the meticulous input of the Central Bank of Kenya and the Capital Markets Authority. Whether by design or happy accident, the regulations has erected a fortress around the very institutions that crypto once promised to disintermediate.
Kenyan regulators, stung by a decade of warnings about money laundering, ponzi schemes, and disintermediated payments, have built a compliance edifice that few pure-play crypto firms can scale. Banks, which had watched nervously as capital flowed into unregulated exchanges and wallet apps, suddenly find themselves holding the only set of keys that fit the new locks. It is a remarkable, if unstated, reversal: the revolutionaries invited into the palace, only to be told they must rent their chairs from the old guard.
Capital: the gate that only incumbents can afford
The most immediate barrier is financial. To operate a virtual asset exchange in Kenya, an applicant must now hold KSh100 million ($770,000) in paid-up core capital, unencumbered and held in cash or approved near-cash instruments. A wallet provider must have KSh150 million. A stablecoin issuer — a licence that any firm hoping to plug Kenya into the global dollar-based crypto economy would need — faces a staggering KSh300 million ($2.3 million).
These numbers are trivial for a licensed bank. Equity Bank, KCB, or Co-operative Bank could fund a subsidiary to the required level without troubling their capital adequacy ratios. For a team of three blockchain developers who had bootstrapped a promising exchange from a shared office, they represent a chasm. Hurupay, one of such startups targeting Kenya recently called it a quit, asking Kenyan users to cease using its platform. The regulations also require a virtual asset applicant to maintain liquid capital — in the case of wallet providers and stablecoin issuers, 100 per cent of current liabilities for at least 30 days. That ties up cash that a startup simply does not have, but a bank treasury can allocate in an afternoon.
The ancillary costs reinforce the asymmetry. Every applicant must commission an independent information systems audit, submit audited financials going back three years, and hire a compliance officer with unfettered board access. Large banks already have these functions embedded. Their compliance departments, internal audit teams, and relationships with Big Four accounting firms are sunk costs. For a crypto-native firm, building that infrastructure from scratch is a multi-million shilling proposition before a single trade is processed.
Stablecoin reserves: a captive deposit base
Nowhere is the incumbents’ advantage sharper than in the stablecoin chapter. The regulations require every issuer of a Kenyan-licensed stablecoin to place at least 30 per cent of the funds received from token sales into a trust account at a commercial bank in Kenya. The remaining 70 per cent must be invested locally in a narrow band of instruments: cash, CBK reserve deposits, and government securities maturing within 90 days. The entire reserve pool must be held in custody by a CBK-approved custodian.
Translated from regulatory prose, this means that for every $100 of a Kenyan stablecoin issued, at least $30 sits as a deposit in a Kenyan bank, and much of the rest flows into the banking system as government paper or interbank repos. It is a powerful forced savings mechanism that channels crypto-derived capital directly onto the balance sheets of the very institutions crypto was designed to circumvent. The banks will collect fees on the trust accounts, bid for the custody mandates, and earn spreads on the government securities. They carry none of the market risk; that, the regulations specify, remains entirely with the stablecoin issuer.
The arrangement also creates a structural dependency. A stablecoin issuer cannot operate without a banking partner. It must maintain accounts, manage liquidity, and rely on the bank’s infrastructure for the fiat on-ramp and off-ramp that give the token its utility. In a delicious twist, the crypto firm that once boasted of cutting out the middleman must now pay that middleman a recurring fee, and thank him for the privilege.
Custody: the banks’ new business line
Custodial wallet providers — the firms that hold consumers’ private keys and digital assets — have been told in unambiguous language that they may not lend, hypothecate, pledge, or otherwise use consumer assets. Their revenue model, which at many global exchanges relies on putting idle crypto balances to work, is effectively banned in Kenya. They must segregate consumer assets on-chain at separate addresses, maintain internal ledger partitions, reconcile monthly, and report to the Central Bank.
Who is left standing in such an environment? An entity that already knows how to hold assets safely, file regulatory reports, and survive on thin custody fees. That description fits a bank trust department far better than a crypto-native firm built on the assumption of rehypothecation revenue. Indeed, Regulation 88 requires licensees to hold insurance coverage for consumer assets — a product that banks can often obtain through their existing relationships.
The Coordination Forum: a club of incumbents
The newly established Virtual Assets Services Coordination Forum, chaired by the National Treasury, comprises 19 agencies. They include the CBK, the CMA, the Financial Reporting Centre, the Directorate of Criminal Investigation, the Kenya Revenue Authority, the Office of the Attorney General, and others. Conspicuously absent is any seat reserved for industry representation, consumer groups, or technology experts from outside government. Banks, by contrast, are well represented through their own industry association and longstanding consultative relationships with the CBK and Treasury.
This is not a scandal; it is standard regulatory architecture. But it means that when the Forum meets quarterly to consider cross-sectoral issues, the voices in the room will naturally gravitate toward stability, systemic risk, and the prudential concerns that animate central bankers and bank supervisors. The perspective of a startup exchange that finds the capital requirements excessive, or a wallet provider that needs more flexibility on asset use, will have to be carried in by sympathetic officials — of which there may not be many.
The offshore squeeze
Regulation 4 declares that the rules apply to any person offering virtual asset services “in or from Kenya,” defined to include those who actively solicit local consumers or derive economic benefit from the country, even without a physical presence. Kenya holds the second-highest number of crypto owners in Africa with roughly 4.5 million users, trailing Nigeria’s 13 million. An overseas exchange that has built a sizable Kenyan user base faces a binary choice: incorporate locally, meet every capital and substance requirement, and obtain a licence, or geo-block the country and walk away.
If it chooses the former, it will need a local bank account, local custody arrangements, local compliance staff, and a local chief executive domiciled in Kenya. It will almost certainly need to partner with a Kenyan bank to handle the fiat leg of transactions, hold the stablecoin reserves, and provide the operational backbone that the regulations demand. The offshore exchange, once a borderless competitor, becomes a client of the local banking system. The bank, in turn, gains a new corporate customer, a flow of deposits, and fee income from services it is uniquely positioned to provide.
A fortress, not a bridge
What emerges from the text is a regulatory settlement that is exceptionally friendly to the existing financial order. The high capital requirements filter out undercapitalised challengers. The stablecoin reserve mandate creates a captive deposit base for banks. The ban on rehypothecation guts the economics of independent wallet providers. The extraterritorial reach compels foreign entrants to embed themselves within the local banking infrastructure. The coordination forum ensures that the rule-setting conversation remains firmly within the circle of officialdom, where banks have spent decades building influence.
Regulators would counter that they are not in the business of levelling competitive playing fields; they are in the business of protecting consumers and preserving financial stability, goals that naturally align with the institutions they already supervise. The crypto industry has hardly covered itself in glory — a string of exchange collapses, stablecoin de-peggings, and outright frauds have provided ample justification for a cautious approach. If the cost of safety is a market structure that looks remarkably like the banking system, that may be a price the authorities are willing to pay.
The crypto entrepreneurs who once hoped Kenya would be Africa’s crypto haven now find themselves knocking on bank doors, asking politely for an account, a partnership, a chance to operate inside the fortress walls. The irony is exquisite, and both sides know it. The revolution, it turns out, has a dress code, and it requires a bank reference.