Something rather unusual happoened this year. Regulators who showed up to listen, not just to warn. Michael Eganza from the CBK and Justus Agoti from the CMA were both on the floor, and their message was essentially the same one said two different ways. What your product does matters more than what it runs on. If it moves money like a payment service, CBK owns it. If it looks like a capital markets product, that is CMA's desk. The VASP Act, which came into play in November 2025, hardwires this split into law, and the local office requirement is not bureaucratic noise. It is a direct response to the very real pattern of exchanges registered offshore that disappeared when Kenyan users lost money.
The controversy that followed was predictable but worth taking seriously. A KES 500 million minimum capital requirement for stablecoin issuers sounds like investor protection until you realize it also functions as a very effective door to keep local startups out. VAAK said as much and they are not wrong. Some of this regulatory pressure also traces back to Kenya's FATF greylisting, so there is a geopolitical dimension underneath the compliance language that does not always get named. What made KBCC interesting is that companies like Kotani Pay, Taran App, VALR, and Busha did not just show up to complain about the rules but shape them. The builders who are in those rooms right now are the ones whose products will still be standing when the new law lands.
Kotani Pay kept coming up in developer conversations in the most organic way. Their API and USSD integrations let applications move between stablecoins and local currencies in seconds without rebuilding the financial stack each time. CEO Felix Macharia was also visibly engaged in the regulatory sessions, which tells you the company understands the rules being written now will shape how much of their business model survives licensing. Taran App is attacking the same problem from the user side, betting that the next Kenyan crypto wave arrives through something that feels exactly like M-Pesa and reveals itself as blockchain later.
Tether led with their self-custody wallet and a compliance narrative designed to land with regulators. Replacing 42-character wallet addresses with human-readable ones is a small change that removes real anxiety for new users. OKX, Bybit, and Telcoin all ran sessions skewed toward builders rather than traders, signalling they want ecosystem depth in East Africa rather than just account numbers. VALR and Busha brought regional credibility, with VALR engaging the regulatory conversation directly rather than lobbying against it, and Busha running practical workshops drawn from surviving Nigeria's regulatory rollercoaster.
Luno, Sumsub, and InfyniSec explained how they're handling compliance, identity verification, and fraud prevention. Nobody discusses these companies until something breaks, and then everybody does. HoneyCoin was doing the relationship work the tech crowd usually skips, sitting in the policy rooms and bridging conversations between startups and the officials currently deciding what the rules look like.
The conference used to feel like convincing people that crypto deserved to exist. This year that conversation was over. The question was who gets to build it legally, at what cost, and on whose terms. If you were not in the regulatory panels, you were at the wrong conference. The rules are coming. The question is whether you are in the room when they are being finalised, or reading about them after the fact wondering why they do not fit your business.
