Kenya's CMA Seeks Blockchain Analytics Tool to Track Crypto Crime

Kenya's Capital Markets Authority is actively procuring a blockchain analytics platform designed to detect and trace illicit cryptocurrency activity. For accounting firms, auditors, and CFOs with exposure to the Kenyan digital asset market, this is not a distant regulatory signal. It is a concrete operational shift that will reshape how on-chain transactions are scrutinised, how suspicious activity is reported, and what standard of crypto record-keeping regulators will expect from licensed entities going forward.

What the CMA Is Actually Doing

The Capital Markets Authority (CMA) of Kenya has issued a call for a blockchain analytics solution capable of monitoring cryptocurrency transactions and identifying patterns associated with financial crime. The regulator's stated goal is to equip its surveillance function with the same on-chain visibility that more established financial intelligence units in other jurisdictions already possess.

Scope of the Procurement

The CMA's request is directed at vendors able to provide transaction tracing, wallet clustering, and risk-scoring capabilities. These are the core functions of any professional-grade blockchain analytics platform: the ability to follow the flow of funds across addresses, group addresses that appear to be controlled by the same entity, and assign a risk score to counterparties based on their transaction history and known associations. The regulator wants this capability in-house, rather than relying on ad-hoc requests to exchanges or third parties.

Why Now

Kenya ranks consistently among sub-Saharan Africa's most active cryptocurrency markets by volume. Peer-to-peer trading is significant, mobile money on-ramps are widespread, and the number of retail participants has grown rapidly over the past several years. That scale creates exposure: the same features that make crypto accessible to ordinary Kenyans also create vectors for fraud, wash trading, and the movement of proceeds from other crimes. The CMA's procurement move signals that the regulator believes its existing surveillance toolkit is no longer adequate for the asset class it now oversees.

Regulatory Context: Kenya's Crypto Framework

Kenya's approach to digital asset regulation has evolved considerably. The CMA has designated certain digital assets as capital market products, bringing them within its supervisory perimeter. Virtual asset service providers (VASPs) operating in the country are required to register with, or seek approval from, the relevant authority depending on the nature of their activities. The Financial Reporting Centre (FRC), Kenya's financial intelligence unit, also has obligations that extend to VASPs under the country's anti-money laundering framework.

Interaction with AML Obligations

Kenya's Proceeds of Crime and Anti-Money Laundering Act, together with the FRC's sector-specific guidance, already requires reporting entities in the financial sector to conduct customer due diligence, monitor transactions, and file suspicious activity reports. As the CMA deploys a dedicated blockchain analytics tool, it will be able to cross-reference on-chain data against the transaction records and reports that licensed entities are already supposed to be producing. That raises the bar: discrepancies between what a firm reports and what the regulator can independently observe on-chain will become far easier to detect.

Implications for Accounting Firms and Auditors

The procurement creates a measurable change in the compliance environment for any firm that audits or advises Kenyan-licensed crypto businesses, exchanges, or investment vehicles holding digital assets.

Audit Evidence and On-Chain Verification

Auditors signing off on financial statements that include digital asset balances or transaction volumes will need to understand that the CMA now has, or soon will have, independent capacity to verify on-chain activity. Audit procedures that rely solely on exchange-provided reports or client-supplied wallet summaries carry more risk in this environment. Firms should consider whether their current crypto audit methodology involves direct blockchain verification, and whether their engagement teams have access to appropriate digital asset accounting software capable of producing transaction-level records that can withstand regulatory scrutiny.

Record-Keeping Standards

If the CMA's analytics tool flags a wallet cluster as high-risk, and a licensed entity that transacted with that cluster cannot produce granular, time-stamped transaction records, the entity faces a difficult conversation with the regulator. Accounting firms advising Kenyan VASPs or crypto fund managers should be reviewing whether their clients' crypto bookkeeping software generates the kind of address-level, timestamped ledger data that an on-chain investigation would demand. A summary P&L or a net balance figure is not sufficient. The regulator will want to see the specific transactions, counterparty addresses, and the due diligence performed at the time.

Client Onboarding and Source-of-Funds

Accounting firms that act as company secretaries or provide managed finance functions for crypto businesses in Kenya should also revisit their own AML procedures. If the CMA's surveillance identifies suspicious flows touching a client's wallets, the firm advising that client may face questions about whether adequate source-of-funds checks were performed. The shift toward regulator-held blockchain analytics capability in effect extends the expected standard of care backward through the advisory chain.

Implications for CFOs at Crypto-Active Companies

CFOs at companies incorporated in Kenya, or with subsidiaries or treasury operations touching Kenyan-registered exchanges, face a set of practical decisions that cannot be deferred.

Transaction Monitoring Infrastructure

A CFO whose company holds or transacts in digital assets needs to ensure the finance function can produce a complete, address-level transaction history at short notice. Relying on exchange account statements alone is inadequate: exchanges may not preserve historical data indefinitely, and their output formats are rarely sufficient for a regulatory examination. Deploying capable digital asset accounting software that maintains a continuous, auditable ledger of all wallet activity is the baseline requirement. This is not a speculative future need; it is something a regulator with blockchain analytics capability can demand today.

Counterparty Risk Screening

The CMA's tool will, by design, generate risk scores for wallets and entities. A company that regularly transacts with counterparties who later appear on a high-risk list faces potential scrutiny over why those transactions were not flagged internally. CFOs should ensure that pre-transaction screening of counterparty wallet addresses is part of the treasury control framework, not an afterthought. This is particularly important for companies using over-the-counter desks or peer-to-peer channels, which are common in the Kenyan market and carry higher counterparty uncertainty than regulated exchange order books.

Disclosure and Financial Reporting

If a company's digital asset holdings or transactions become the subject of a CMA inquiry, the CFO will need to demonstrate that the financial statements accurately reflect those positions and that any material risks were disclosed appropriately. The interplay between on-chain surveillance and financial reporting obligations is a gap that many finance teams have not yet closed. Getting crypto bookkeeping software in place that ties wallet-level data directly to the general ledger is the most defensible position.

The Broader Sub-Saharan Signal

Kenya's move does not exist in isolation. Across sub-Saharan Africa, regulators are accelerating their engagement with digital assets, sometimes through licensing frameworks and sometimes through enforcement-first approaches. South Africa's SARS has published draft guidance on crypto tax treatment, a development covered in detail in our analysis of the South Africa SARS crypto tax draft guidance. Nigeria's Securities and Exchange Commission has similarly moved to bring VASPs under its perimeter. The CMA's procurement of an analytics tool represents the surveillance layer that typically follows initial licensing frameworks: once a regulator has approved entities, it needs the tools to monitor them.

For accounting firms with pan-African practices, this trajectory matters. The investment in blockchain analytics infrastructure by one regulator tends to create expectations in adjacent jurisdictions. Firms that develop robust crypto audit and advisory capabilities for the Kenyan market will be better positioned as neighbouring regulators follow suit.

It is also worth situating this within the global pattern. As our piece on blockchain analytics vendor evaluation and cluster quality sets out, the quality of the analytics tool a regulator deploys matters significantly: cluster attribution errors can produce false positives that harm compliant businesses. Accounting firms advising clients who receive a CMA inquiry should understand the technical limitations of on-chain attribution, not to obstruct legitimate investigations, but to ensure their clients can respond accurately and with appropriate context.

Practical Next Steps for Firms and CFOs

The window between a regulatory procurement announcement and live surveillance deployment is typically short. Acting now is more efficient than reacting after the tool is operational.

For Accounting and Audit Firms

• Assess whether your crypto audit methodology includes direct blockchain verification, not just reliance on client-supplied data.
• Review the record-keeping practices of any Kenyan VASP or crypto fund clients. Confirm that their crypto accounting software produces address-level, timestamped transaction records.
• Update engagement letters for crypto-related audits in Kenya to reflect the heightened surveillance environment and the evidentiary standard it implies.
• Train engagement teams on reading on-chain data and understanding the outputs of blockchain analytics tools, so they can interpret a CMA finding accurately if one arises.

For CFOs

• Map every wallet address your company controls or transacts through, and ensure each is documented with its business purpose and the entity responsible for it.
• Implement pre-transaction screening of counterparty addresses using a risk-scoring service. Document the screening and the decision to proceed or decline.
• Ensure your digital asset accounting software integrates wallet-level data with your general ledger, so financial statements can be reconciled to on-chain activity at any point in time.
• Brief your board or audit committee on the CMA's analytics procurement, framing it as a change in the regulatory operating environment that has direct implications for the company's compliance posture.

Frequently Asked Questions

What is the CMA of Kenya and does it regulate crypto?

The Capital Markets Authority is Kenya's financial markets regulator. It has designated certain digital assets as capital market products and has oversight of VASPs operating in the capital markets space. Its remit is distinct from but complementary to the Central Bank of Kenya, which supervises payment-related services.

What does a blockchain analytics tool actually do?

A blockchain analytics platform traces the flow of funds across public blockchain ledgers, groups wallet addresses that appear to be controlled by the same entity through a process called clustering, and assigns risk scores based on associations with known illicit activity, sanctioned addresses, or high-risk service categories such as mixers or unregulated exchanges.

Will the CMA's tool affect companies that only hold crypto on regulated exchanges?

Potentially yes. Blockchain analytics tools can trace funds that passed through multiple wallets and exchanges. If a counterparty to a transaction later appears in the tool's high-risk database, a company's historical transactions with that counterparty may be flagged even if those transactions occurred on a regulated exchange. Maintaining records of the due diligence conducted at the time of each transaction is the best protection.

What record-keeping standard should Kenyan VASPs and their advisers aim for?

At a minimum, records should include every wallet address involved in a transaction, the timestamp, the amount and asset, the counterparty's identity where known, and any risk screening performed. Records should be retained for the period required under Kenya's AML legislation and be producible in a format that can be reconciled against on-chain data.

How does this development interact with Kenya's existing AML reporting requirements?

Kenya's Proceeds of Crime and Anti-Money Laundering Act and Financial Reporting Centre guidance already impose transaction monitoring and suspicious activity reporting obligations on financial sector entities, including VASPs. The CMA's blockchain analytics capability gives the regulator an independent verification layer: it can now compare what entities report against what the blockchain actually shows, making accurate and complete reporting more important than ever.

Source: Decrypt