Kenya: technology regulation at a glance

Framework: Virtual Asset Service Providers Act, No. 20 of 2025 (in force 4 November 2025); dual oversight by the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA); implementing Draft VASP Regulations, 2026 under Treasury consultation.

Crypto is legal in Kenya and, since 4 November 2025, is governed by the Virtual Asset Service Providers Act, 2025, which established Kenya's first dedicated licensing regime for virtual assets and split supervision between the CBK (payments, custodial wallets, stablecoin issuers) and the CMA (exchanges, brokers, token offerings, tokenisation platforms). The National Treasury's Draft VASP Regulations, 2026 (public consultation closed April 2026) set detailed capital, reserve, conduct and AML/CFT requirements; existing operators must be licensed by November 2026. Tax rules were reset from 1 July 2025 (Digital Asset Tax repealed, replaced by a 10% excise duty on VASP fees, with income/capital-gains tax and VAT continuing to apply).

Framework: Artificial Intelligence Bill, 2026 (Senate Bill No. 4 of 2025) pending in Parliament; Kenya National AI Strategy 2025-2030 (non-binding); Data Protection Act, No. 24 of 2019 (sectoral automated-decision provisions enforced by the Office of the Data Protection Commissioner)

Kenya has no comprehensive AI law in force. The Ministry of Information, Communications and the Digital Economy launched the non-binding Kenya National AI Strategy 2025-2030 in March 2025, and the Artificial Intelligence Bill, 2026 was tabled in the Senate (first reading April 2026) proposing a risk-based framework and an Office of the AI Commissioner, but it remains at committee stage and not yet law. In the meantime, AI-adjacent conduct is governed sectorally, principally by the Data Protection Act 2019 (right against solely automated decisions) and a draft AI and Emerging Technologies Policy being finalised in 2026.

Framework: Data Protection Act, No. 24 of 2019, supervised by the Office of the Data Protection Commissioner (ODPC); supplemented by the Data Protection (General) Regulations, 2021, Registration of Data Controllers & Processors Regulations, 2021, and Complaints Handling & Enforcement Procedure Regulations, 2021.

Kenya has a comprehensive, GDPR-style personal-data protection regime: the Data Protection Act, 2019 (assented 8 Nov 2019; commenced 25 Nov 2019) establishes an independent Office of the Data Protection Commissioner (ODPC), codifies lawful-basis rules, data-subject rights, mandatory registration, and cross-border transfer conditions. Enforcement has shifted from awareness-building to active supervision in 2025–2026, with hundreds of compensation orders, enforcement notices, and penalty notices issued, and a Data Protection (Amendment) Bill 2025 proposing new AI, cross-border, and penalty provisions.

Framework: National Payment System Act, 2011 (No. 39 of 2011) and the National Payment System Regulations, 2014 (Legal Notice 109 of 2014), administered by the Central Bank of Kenya (CBK). Non-deposit-taking credit (including BNPL) is governed by the Central Bank of Kenya Act (as amended in 2024, Section 33S) and the CBK (Non-Deposit-Taking Credit Providers) Regulations gazetted via Legal Notice 191 of 2026. A National Payment System Bill, 2026 is currently in public consultation to overhaul and expand the regime.

Kenya operates a mature, in-force licensing regime for digital payments and e-money under the National Payment System Act 2011 and NPS Regulations 2014, with CBK as sole authoriser; 43 payment service providers are licensed (including 9 mobile-money e-money issuers such as Safaricom's M-PESA). BNPL and digital lending are also brought within CBK's purview under the Central Bank of Kenya Act amendments and 2022/2026 regulations, with 281 non-deposit-taking credit providers licensed by September 2026. A draft National Payment System Bill, 2026 (open for consultation 21 September – 9 October 2026) proposes to disaggregate licences (payment initiation, account information, e-wallet, merchant acquirer, EMI, etc.), introduce explicit open-finance/API mandates and raise capital floors, but it is not yet enacted.

Framework: Class N Digital Nomad Permit under the Kenya Citizenship and Immigration (Amendment) Regulations, 2024 (effective 1 October 2024), administered by the Department of Immigration Services via the eFNS portal; subsequently amended by Legal Notice 93 of 2025.

Kenya operates a dedicated digital-nomad pathway: the Class N Permit, created by the Kenya Citizenship and Immigration (Amendment) Regulations, 2024 and in force since 1 October 2024, with applications being accepted since April 2025. It is open to non-Kenyans working remotely for foreign employers or freelancing for foreign clients, and in 2025 the minimum assured income was lowered from USD 55,000 to USD 24,000 per year to broaden uptake. Separately, Class G (Investor) and other long-stay permit classes offer additional residency routes, including a path to permanent residency after seven years.

Framework: Computer Misuse and Cybercrimes Act, 2018 (as amended by the Computer Misuse and Cybercrimes (Amendment) Act, 2025, in force 4 November 2025); Communications Authority of Kenya Industry Guidelines for Child Online Protection and Safety (April 2025); Kenya Information and Communications (Amendment) Bill, 2025 (pending). Primary regulators: Communications Authority of Kenya (CA) and the National Computer and Cybercrimes Coordination Committee (NC4).

Kenya has no single, EU-DSA/UK-OSA-style online safety statute. Online content is governed by a patchwork: the Computer Misuse and Cybercrimes Act (as amended in 2025) criminalises specific online harms and sets intermediary notice-and-takedown rules, the CA has issued binding child online protection guidelines (effective October 2025) that require age verification by service providers, and a wider social media age verification bill using national IDs is pending in Parliament. On 2 July 2026 the High Court struck down the executive website-blocking power and the 'false information' provision from the 2025 amendments as unconstitutional.

Framework: Computer Misuse and Cybercrimes Act, 2018 (No. 5 of 2018), as operationalised by the Critical Information Infrastructure and Cybercrime Management Regulations, 2024 (LN 44/2024) and the Computer Misuse and Cybercrimes (Amendment) Act, 2024 (assented Oct 2025); institutionally anchored by the National Cybersecurity Agency (NCSA), established by Legal Notice 89 of 2026, and the National KE-CIRT/CC at the Communications Authority of Kenya.

Kenya has a comprehensive, horizontally-applicable cybersecurity regime built around the Computer Misuse and Cybercrimes Act, 2018, which criminalises a wide range of cyber-offences and empowers the government to designate and regulate Critical Information Infrastructure (CII). Detailed implementing rules came into force in February 2024 (LN 44/2024) and introduced mandatory CII designation, a Chief Information Security Officer requirement, annual risk assessments and a 24-hour incident-reporting duty to the National KE-CIRT/CC. The framework was further strengthened by the 2024 Amendment Act (assented October 2025, now under constitutional challenge) and by the establishment of the National Cybersecurity Agency (NCSA) via Legal Notice 89 of 2026.

Framework: Companies Act, 2015 (as amended by the Finance Act, 2016); administered online by the Business Registration Service (BRS) under the Office of the Attorney General via the eCitizen portal. Foreign investment incentives sit under the Investment Promotion Act, 2004 (Kenya Investment Authority / KenInvest), and the Class G investor work permit is governed by the Kenya Citizenship and Immigration Act, 2011.

Kenya permits 100% foreign ownership of private limited companies in most sectors, has no general minimum share capital, and incorporation is fully digital through the BRS eCitizen portal, typically completing in 3–5 working days for a fee of about KES 10,650. The main friction for a foreign founder who wants to physically run the business is the Class G investor work permit, which requires evidence of a minimum USD 100,000 investment and attracts a KSh 250,000 annual fee, plus sector-specific caps in security, telecoms, insurance and banking.