‘Crypto’ ATMs grow in Kenya; regulators warn of unlicensed ops

Digital asset ATMs have sprung up across Nairobi, allowing Kenyans to quickly convert their cash to digital currency, a month after the country’s VASP bill was signed into law.

Elsewhere, the Atlantic Council has lauded the rapid implementation of digital IDs across Africa, but it warns that poor oversight and fragile legal safeguards expose citizens to privacy breaches and government surveillance.

Kenya warns against unlicensed ‘crypto’ ATM operators

After two years of public consultations and parliamentary debates, Kenya finally enacted the VASP Bill, with President William Ruto signing it into law in late October.

Just weeks later, Kenyan VASPs are rolling out new products and services targeting the growing base of digital asset users, estimated at 6 million.

According to local outlets, digital asset ATMs have sprung up in many of the largest malls in the capital, Nairobi. The most popular is ‘Bankless Bitcoin,’ whose orange-branded machines are conveniently placed alongside bank ATMs.

Digital asset ATMs enable users to convert their cash into digital assets, primarily targeting novice users who are new to digital asset purchases. While they offer an easy and convenient onramp, they have also been vastly targeted by criminals in phishing, ransomware, and extortion scams.

According to blockchain intelligence firm TRM Labs, these ATMs have been used to process at least $160 million worth of illicit digital assets in the past six years. The U.S. Federal Trade Commission claimed that in 2023, Americans lost $110 million to digital asset ATM scams.

In Kenya, where investors lost $44 million to digital asset scams last year, according to one report, these ATMs risk fueling even more illicit activities.

This risk is heightened by the new enacted regulations; while the VASP Bill was signed into law, the Central Bank of Kenya recently warned that it has yet to license any VASP under the new framework.

The top bank is the designated digital asset watchdog, alongside the Capital Markets Authority (CMA). However, in a recent public announcement, it warned that neither regulator had licensed any VASPs under the new Act “to operate in or from Kenya.”

The central bank says the Cabinet Secretary for the National Treasury is drafting regulations that offer guidance on the implementation of the VASP Bill. One industry leader told CoinGeek that this could be the most critical step, as this guidance “gives practical effect to the VASP Act and defines how the law works in day-to-day operations.”

Despite the regulatory gap, Kenya remains a hub for digital assets. According to one study, Kenyans moved Ksh 426 billion ($3.3 billion) through digital assets in the year ending June 2024.

Atlantic Council: Africa’s digital IDs pose privacy, surveillance risk

49 African countries now have some form of biometric system, with 35 using it for national elections.

However, this widespread rollout comes with risks that could expose critical information about hundreds of millions of Africans, says the Washington-based think tank.

One of the main concerns is vendor concentration, with the Council identifying Huawei, Idemia, Semlex, and Veridos as the dominant tech providers in the region. Public familiarity also remains relatively low, with only one in three Africans aware that their governments were issuing digital IDs. Dependence on foreign governments and organizations, led by the World Bank and the European Union, also interferes with oversight and procurement decisions.

These factors leave digital ID in African nations at risk of state surveillance and political abuse, with most governments having access to vast amounts of citizens’ critical data.

Most countries have yet to implement comprehensive legal protections, exposing citizens to privacy breaches in which criminals or government entities can access sensitive information.

“Cyberattacks, data leaks, or intentional misuse of information can have severe consequences for individuals, particularly in authoritarian or politically unstable contexts,” the report states.

“Without strong legal and technical safeguard mechanisms, state critics, journalists, and members of the political opposition remain especially vulnerable to surveillance, harassment, and repression.”

Watch: Tech redefines how things are done—Africa is here for it

title=”YouTube video player” frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share” referrerpolicy=”strict-origin-when-cross-origin” allowfullscreen=””>