The future of Web3 in Kenya hinges on intelligent compliance

The newly proposed Virtual Asset Service Provider (VASP) Bill (2025) promises to introduce Kenya’s first comprehensive regulatory framework for digital assets, marking a watershed moment for the industry. For Web3 startups, this signals a fundamental shift: compliance can no longer be an afterthought. Rather than scrambling to meet enforcement demands retroactively, firms must now integrate robust KYC/AML controls from inception, or risk becoming obsolete. The draft legislation mandates that all VASPs obtain regulatory licenses while enforcing stringent anti-money laundering (AML), counter-terrorist financing (CFT), and consumer protection standards.

From regulatory arbitrage to strategic compliance

Historically, Kenya’s Web3 innovators have excelled in technological agility but lagged in compliance rigor. Many platforms have relied on rudimentary identity checks, minimal transaction monitoring, and patchy reporting, practices that the Treasury’s 2024 draft National Policy on Virtual Assets explicitly seeks to overhaul. Under the proposed rules, crypto exchanges, wallet providers, and other VASPs will require licensing from the Central Bank of Kenya (CBK) or Capital Markets Authority (CMA), alongside enhanced due diligence and data security obligations.

Rather than perceiving these requirements as a constraint, Kenya’s Web3 ecosystem should embrace them as a catalyst for maturity. Forward-thinking firms are already collaborating with global compliance leaders like Sumsub to bridge resource gaps. Modular regtech solutions now enable even lean startups to integrate automated identity verification, real-time transaction screening, and AI-driven risk analytics, without overhauling their core infrastructure.

The message is clear: The era of reactive, manual compliance is over. Progressive VASPs are adopting a proactive stance, embedding KYC checks, transaction surveillance and suspicious activity reporting (SAR) mechanisms directly into their platforms. This transition won’t happen overnight, but the trajectory is undeniable. Kenya’s once-informal crypto economy is aligning with global best practices, and partnerships with established compliance providers are accelerating this evolution.

The AI fraud surge: A new compliance frontier

Just as Kenya’s regulatory landscape matures, a new wave of AI-driven fraud is testing these defenses. According to Sumsub’s latest Identity fraud data, synthetic identity fraud, where criminals use AI to forge passports or driver’s licenses, surged 195% globally in Q1 2025. Similarly, deepfake-related scams have skyrocketed, with some regional markets recording an 1,100% year-on-year increase.

Africa is not immune. Sumsub notes a paradigm shift in the continent’s fraud landscape: while traditional counterfeit ID schemes decline, AI-generated forgeries and sophisticated social engineering attacks are rising. Kenya’s fraud rate dropped ~15% in Q1 2025 due to improved document verification, yet synthetic identities and organised scam networks remain a persistent threat.

This trend is starkly evident in crypto onboarding. Nearly 4% of Kenyan crypto account applications are fraudulent, far exceeding the global average of 2.8%. From doctored IDs to illicit wallet transactions, the risks are escalating. The solution? Preemptive detection. Modern AI-powered fraud prevention tools, including tamper-proof document authentication, device fingerprinting, and advanced biometrics checks, can identify malicious actors before they infiltrate platforms. Sumsub emphasises that businesses can no longer rely on static verification methods—they must adopt dynamic, multi-layered defenses that evolve with emerging threats.

Balancing innovation and regulation

Critically, compliance need not stifle innovation. On the contrary, next-generation regtech enables both security and seamless user experiences. Biometric KYC, AI-driven ID validation, and machine-learning risk scoring are reducing friction while enhancing safety. Platforms leveraging these tools report 93%+ onboarding success rates and 50% faster verification times, a win for both startups and regulators.

Kenyan policymakers appear to recognise this balance. Rather than imposing rigid, one-size-fits-all mandates, they are drawing selectively from global frameworks like the EU’s MiCA regulations while tailoring rules to Kenya’s unique context. The draft VASP policy explicitly prioritises financial inclusion, ensuring regulations complement, rather than conflict with, Kenya’s mobile-money legacy.

The CMA’s regulatory sandbox further exemplifies this pragmatic approach. By allowing fintechs to test innovations under controlled oversight, regulators gain real-world insights before codifying rules. This “test-and-learn” model fosters collaboration between innovators and authorities, ensuring that compliance evolves alongside technology.

Kenya’s Web3 future hinges on harmonising innovation with intelligent compliance. The VASP Bill should serve not as a constraint, but as a foundation for sustainable growth. By integrating AI-powered identity verification, real-time risk analytics, and adaptive regtech, Kenyan platforms can meet regulatory expectations without sacrificing user experience.

Compliance and innovation are not adversaries; they are co-pilots in building a trusted digital economy. As Kenya’s Web3 ecosystem matures, those who embrace proactive, tech-driven compliance will lead the next phase of Africa’s blockchain revolution.

About Sumsub

Sumsub is a full-cycle verification platform that secures the whole user journey. With Sumsub's customisable KYC, KYB, Transaction Monitoring, and Fraud Prevention solutions, you can orchestrate your verification process, welcome more customers worldwide, meet compliance requirements, reduce costs, and protect your business.

Sumsub has over 4,000 clients across the fintech, crypto, transportation, trading, e-commerce, education, and gaming industries, including Bitpanda, Wirex, Avis, Bybit, Vodafone, Duolingo, Kaizen Gaming, and TransferGo.