Archive · Kenya
All 9 archive entries on Kenya, most recent first.
The Central Bank of Kenya advertised senior and managerial roles for virtual asset licensing and compliance functions in late April 2026, with applications closing 18 May, before the VASP Regulations had been finalised. The hiring confirms the division of labour under Kenya's dual-regulator model: the CBK covers payment-side VASPs, stablecoin issuers and custodial services, while the CMA supervises exchanges, brokers and tokenisation platforms.
In a determination dated 14 April 2026 (Peter Macharia Waithira v LOLC MFB), Data Commissioner Immaculate Kassait held LOLC Kenya Microfinance Bank liable for publishing a former employee's image and personal details in public notices on its social media platforms without consent or lawful basis, and ordered deletion within 14 days. The Commissioner also recommended the bank's directors for criminal prosecution for obstruction, after the lender failed to cooperate with the investigation, with fines of up to KES 5 million or two years' imprisonment on conviction.
Public participation on the Draft Virtual Asset Service Providers Regulations 2026 closed on 10 April 2026, keeping Kenya on track to operationalise VASP licensing in 2026.
Kenya's ODPC opened a suo moto investigation into Ray-Ban Meta smart glasses in April 2026, following a direct appeal filed 6 March 2026 that raised concerns over the devices' embedded recording capabilities. The privacy exposure identified runs two ways: bystanders captured on camera have not consented, and recorded data flows into Meta's cloud infrastructure, raising cross-border transfer questions.
The National Treasury published the Draft Virtual Asset Service Providers Regulations 2026 for public consultation on 17 March 2026, the first implementing instrument under the VASP Act 2025. Developed with the CBK and CMA through a multi-agency task force and accompanied by a Regulatory Impact Statement, the draft sets out licensing and authorisation processes for all VASP categories, from exchanges to custodial wallets to payment processors, and incorporates FATF Recommendation 15 and Travel Rule requirements.
In Muthoni v Africa International University [2026] KEHC 2254 (KLR), decided 16 February 2026, the High Court considered an application to adopt a July 2025 ODPC determination (Complaint No.
On 26 January 2026, ahead of the 2026 Data Privacy Day Conference in Mombasa, Kenya's ODPC announced that it had issued 184 compensation orders to data subjects, against a cumulative docket of 9,061 complaints, 357 determinations, 134 enforcement notices and 20 penalty notices since the Data Protection Act 2019 took effect. The High Court has held that it will not disturb the ODPC's compensation discretion unless a decision is irrational, which gives those orders real legal force.
Kenya's Virtual Asset Service Providers Act 2025 was assented on 15 October 2025 and came into force on 4 November 2025, making Kenya one of East Africa's first jurisdictions with a standalone virtual asset statute. Supervision under the Act splits between the CBK, which covers issuance and custodial services, and the CMA, which covers exchanges, brokers and trading platforms.
On 5 May 2025, the High Court of Kenya declared Worldcoin's operations unlawful under both the Data Protection Act 2019 and Article 31 of the Constitution, in Republic v Tools for Humanity Corporation & 9 others [2025] KEHC 5629 (KLR).
Enforcement decisions, new laws and regulatory movement across African jurisdictions, in one brief. Free, and built to be forwarded to the colleague who needs it.
Your address goes to our email service provider and is used to send you the Digest, nothing else. Unsubscribe in one click, in every issue. Privacy policy. This site itself sets no cookies.