Kenya KE

Kenya's Business Registration Service continues to intensify enforcement of the beneficial-ownership disclosure regime established under section 93A of the Companies Act, 2015 and given operative detail in the Companies (Beneficial Ownership Information) Regulations, 2020. Non-compliance now carries a fixed penalty of KES 500,000 plus a daily accruing fine of KES 50,000 for continuing non-compliance, escalating in persistent cases to deregistration risk, the most severe sanction available against a corporate entity short of criminal referral. This is a domestically anchored compliance-architecture story rather than a single enforcement event: the BRS is not announcing prosecutions so much as tightening the administrative machinery, penalty notices, deregistration threat, that sits behind the register's day-to-day operation.

The significance of this within Kenya's own regulatory perimeter is direct. Beneficial-ownership transparency is a named deficiency area in Kenya's ESAAMLG/FATF mutual evaluation, and continued BRS enforcement pressure is the domestic remediation track most directly responsive to that finding. It should be read as evidence of administrative capacity-building rather than as a completed remediation; the claims describing enforcement intensity here rest on secondary legal-commentary sources rather than published BRS compliance statistics, and the actual compliance rate achieved by this enforcement regime remains unquantified in the material available this cycle.

Globally, the structural backdrop against which any BO/transparency signal should now be read is the European Union's AML Package, even though Kenya sits well outside its direct perimeter. The Package comprises three distinct instruments: the AML Regulation (AMLR, Regulation (EU) 2024/1624), which applies directly across the bloc without national transposition; the sixth AML Directive (6AMLD), which each Member State transposes into domestic law on its own timeline; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority itself. Together these shift the EU's beneficial-ownership and broader AML supervisory perimeter from a purely national-authority model toward a hybrid regime in which AMLA exercises direct supervision over a defined set of higher-risk cross-border obliged entities and indirect, coordinating supervision over the rest. This is standing architecture, not a single-cycle development, and it is not the primary subject matter for Kenya's own BO transparency track; it is the durable global reference point against which the domestic BRS enforcement story sits, illustrating what a more institutionally mature, multi-layered BO-transparency supervisory architecture eventually looks like as a point of comparison rather than as a direct constraint on Kenyan corporate registries.

Outlook

The domestic watch point is whether BRS's tightening enforcement posture converts into a measurable compliance-rate improvement ahead of Kenya's next FATF Plenary review, or whether it remains, as this cycle's evidence base suggests, an administrative signal without yet a published outcome metric. No further beneficial-ownership-specific reform, such as amendments to the disclosure thresholds or a public BO-register access model, was identified this cycle. The absence of a T1 primary source confirming the scale of enforcement action is itself a gap worth flagging for the next cycle's research pass.

Kenya's Virtual Assets Service Providers Act, 2025 came into force on 4 November 2025, following gazettal on 21 October 2025, formally bringing virtual-asset service providers into the country's AML/CFT/CPF obliged-entity perimeter for the first time. The Act names the Central Bank of Kenya and the Capital Markets Authority as joint regulators, splitting oversight along functional lines rather than creating a standalone virtual-asset authority. This is a direct, structural response to a deficiency named in Kenya's ESAAMLG mutual evaluation: the absence of any supervised VASP perimeter, a gap FATF's Recommendation 15 requires jurisdictions to close.

It is important to be precise about what is, and is not, operative. The obliged-entity designation is statutory and in force; the licensing regime that would make it operational is not. As of the National Treasury's March 2026 draft VASP Regulations, neither CBK nor CMA has licensed a single virtual-asset service provider, and the substantive prudential and conduct detail, capital adequacy, safeguarding of client assets, reporting formats, remains contingent on regulations still moving through consultation. In practical terms, Kenya has built the legal shell of a VASP-supervision regime before populating it with the operative rules that would let a service provider actually become licensed, register a compliance officer, or face a supervisory examination. This sequencing, statute first, implementing detail later, is common in emerging-market crypto regulation but it does leave an interim supervisory gap: virtual-asset activity continues in Kenya during this window without an operative licensing check, even though the obliged-entity status nominally already applies.

The joint-regulator structure itself carries an analytical dimension worth surfacing. By splitting responsibility between CBK, whose institutional core competence lies in payment systems and monetary stability, and CMA, whose core competence lies in securities and investment products, Kenya has implicitly pre-classified virtual-asset activity into payment-like and investment-like categories without yet publishing a formal token taxonomy. How cleanly that split holds in practice, particularly for hybrid instruments that combine payment and investment characteristics, will be one of the more consequential unresolved questions once licensing actually begins.

The claim underlying this obliged-entity designation is assessed at the highest confidence tier available in this cycle's evidence base, anchored to a Tier-1 primary source: CBK's own public notice on the Act. That is a meaningfully stronger evidentiary footing than much of the secondary-source commentary elsewhere in this cycle's Kenya coverage, and it means the in-force status of the VASP Act, as distinct from its operative licensing detail, can be treated as a settled structural fact rather than a probable or assessed one. The obliged-entity category also implicitly captures VASP counterparties as a defined customer typology under Kenya's evolving framework, which, once licensing commences, will require CBK- and CMA-supervised entities to apply customer due diligence to virtual-asset counterparties in a manner analogous to existing bank and securities-sector obligations. Until licensing is operative, however, this due-diligence obligation exists on paper without a supervised population of licensed entities against which to apply it.

Outlook

The next concrete marker is the finalisation of the VASP Regulations, 2026, expected in the fourth quarter of 2026 following continuing consultation between the National Treasury, CBK and CMA. Until that instrument is issued, no licensing activity should be expected, and the sector's practical AML/CFT exposure remains defined by statutory obligation without corresponding supervisory examination capacity. Whether the finalised regulations preserve the CBK/CMA functional split or consolidate elements of it will be the first substantive test of how the institutional architecture translates into operative supervision.

Kenya's clearest active-defence signal this cycle sits not inside the core AML/CFT institutions but at the tax authority. The Kenya Revenue Authority has integrated real-time monitoring across more than 100 betting operators, and KRA-linked commentary attributes a roughly fivefold rise in gambling-sector tax collections to that integration, from KSh 5.7 billion in the 2021/22 financial year to KSh 28.45 billion by April 2026. The figure is a tax-administration outcome rather than a directly AML/CFT one, but the underlying capability, real-time transactional visibility across a large, previously opaque cash-intensive sector, is the same class of SupTech infrastructure that a financial-integrity supervisor would want for market-abuse or suspicious-transaction detection.

That read-across is not this cycle's speculation alone: the evidence base notes that the Central Bank of Kenya has signalled interest in extending a comparable real-time monitoring posture toward market-abuse detection more broadly, beyond the betting-sector deployment where the capability has so far been proven out. This is a single-source, T2-sourced development, and the compliance-technology narrative here rests on one illustrative data point rather than a documented CBK programme; it is flagged as a genuine but thin signal rather than a confirmed institutional rollout.

Outlook

Whether KRA's regtech capability is formally extended to, or replicated by, CBK's AML/CFT supervisory function is the development to watch. No implementation timeline or regulatory instrument establishing such an extension was identified this cycle.