Get breaking business news on WhatsApp
The Capital Markets Authority (CMA) has published draft CMA AML guidelines that would, for the first time, bring licensed virtual asset firms under the same anti-money laundering rulebook as stockbrokers, fund managers and investment banks. The draft Guidelines on the Prevention of Money Laundering, Terrorism Financing and Proliferation Financing in the Capital Markets, 2026, would replace the 2015 version.
CMA invited proposals on 10 November 2026 and set a 30 November 2026 deadline for comments.
On this page
Who the CMA AML guidelines cover
The draft applies to every market intermediary licensed by CMA and every virtual asset service provider (VASP) it licenses under the Virtual Asset Service Providers Act, 2025. That includes virtual asset exchanges, trading platforms, brokers, investment advisers, asset managers, virtual asset offering providers, tokenisation service providers and token issuance platforms.
Crypto firms are already applying for licences under the new regime, as covered in our report on the VASP licence process at CBK and CMA.
Key rules in the draft CMA AML guidelines
- Two-day reporting: firms must report suspicious activity, including attempted transactions, to the Financial Reporting Centre within two days after the suspicion arose, whatever the amount.
- 24-hour freezes: funds of people on United Nations or local sanctions lists must be frozen “without delay”, defined as within 24 hours of a designation.
- No delayed checks for risky clients: firms may not finish identity checks after opening an account for high-risk customers, politically exposed persons or anyone who may match a sanctions list.
- Beneficial owners: firms must identify the real people who own or control corporate clients.
- Records: kept for at least seven years.
New duties for crypto and token firms
VASPs sending crypto must pass on the sender’s name, wallet address and ID or date of birth, plus the recipient’s name and wallet, to the receiving firm. Transfers to or from wallets not hosted by a licensed firm would face extra monitoring, and firms must check the customer owns or controls the wallet.
VASPs would also have to use blockchain analytics to spot links to darknet markets, ransomware, scams, mixers and sanctioned wallets, freeze assets of designated persons, and send monthly reports to CMA by the 10th day of the following month. Token issuance platforms must check and screen every issuer, promoter and subscriber.
Penalties and the grey list push
Breaches could lead to reprimands, fines, suspension or loss of licence under the Capital Markets Act. For breaches of the terrorism financing rules, CMA could impose administrative penalties of KSh100,000 to KSh3 million for each violation.
The review comes as Kenya works to exit the Financial Action Task Force grey list, covered in our report on Treasury’s beneficial ownership push. Investors can confirm a fund is licensed using our guide on checking CMA-approved money market funds.
Frequently asked questions
What are the CMA AML guidelines?
They are draft rules to stop money laundering, terrorism financing and proliferation financing in Kenya’s capital markets. The 2026 draft would replace guidelines issued in 2015.
Do the CMA AML guidelines apply to crypto firms?
Yes. They would cover every virtual asset service provider licensed by CMA, including exchanges, brokers, token issuance platforms and tokenisation service providers.
How fast must firms report suspicious activity?
Within two days after the suspicion arose, to the Financial Reporting Centre, regardless of the amount.
When is the deadline for comments?
30 November 2026. Comments go to the CMA Chief Executive Officer.
Prefer WhatsApp? Follow Business Radar on WhatsApp
We will email you a weekly money and business brief. We store your email (and your name, if you give one) for that purpose, under the Kenya Data Protection Act, 2019. You can unsubscribe at any time. Privacy policy.
