Executive Summary
- Public model portfolios can remain outside MiCA's service definitions when the Kenyan publisher gives no personalised recommendation, receives no order and controls no client assets. Payment for information does not itself establish a regulated service, but a tailored recommendation or integrated order path can change the result. (Regulation (EU) 2023/1114, MiCA, art. 3(1)(15)–(26).)
- Version B is the preferred partner-led pilot. Each transaction needs the user's affirmative instruction, and the authorised partner must provide the relevant order service. Personalised recommendations require advice permission even when users approve their trades. (MiCA, arts. 3(1)(21), (23)–(25), 59; ESMA, Q&A 2463, answer of 7 April 2025.)
- Version C ordinarily constitutes portfolio management when future trader decisions become client transactions without necessary client intervention. Choosing a trader, setting a budget or retaining a pause button does not remove that discretion. A partner can provide C only with portfolio-management permission and actual control of the service. (MiCA, arts. 3(1)(25), 73; ESMA, Q&A 2463.)
- The Kenyan firm needs its own EU authorisation route when it remains the client-facing manager, adviser or order-service provider. A partner's execution permission cannot cover a separate firm's discretionary service. An Irish group CASP must obtain the relevant permissions before providing them, then complete MiCA's cross-border notification procedure. (MiCA, arts. 59, 63, 65; ESMA, Supervisory Briefing on Copy Trading, 30 March 2023, para. 32.)
- Professional investors do not create a general MiCA exemption from suitability, conflicts or service authorisation. Portfolio-management inducements and venue-routing remuneration face specific prohibitions; disclosure alone cannot cure them. (MiCA, arts. 80(2), 81(1), (3), (5)–(6).)
- Kenya regulates virtual-asset services conducted in or from Kenya. The 2025 Act allocates management, advice and brokerage to CMA, while custodial wallets and payment processing fall to CBK. The final 2026 Regulations are Legal Notice No. 134, published on 22 July 2026. An EU partner does not replace the Kenyan permission analysis. (Virtual Asset Service Providers Act, No. 20 of 2025, ss. 5–9, First Schedule; Virtual Asset Service Providers Regulations, 2026, L.N. 134, reg. 4.)
The asset boundary and the copy-trading test
MiCA applies to the service actually performed for EU clients. Advice means personalised recommendations about crypto-asset transactions or the use of crypto-asset services. Portfolio management requires discretionary management under client mandates, on a client-by-client basis, of portfolios containing at least one crypto-asset. Reception and transmission means receiving a client's order and passing it to a third party for execution. Execution means concluding purchase, sale or subscription agreements on the client's behalf. These definitions concern conduct, regardless of a product's “signals” or “technology” label. (MiCA, arts. 2(1), 3(1)(21), (23)–(25).)
ESMA's answer of 7 April 2025 requires a case-specific assessment of copy trading. It directs supervisors to its 2012 automatic-execution answer and sections 2.1–2.2 of its 2023 briefing for classification. It expressly distinguishes that classification exercise from the applicable conduct rules, which come from MiCA. The answer and briefing are supervisory interpretations, rather than amendments to the Regulation. Their relevance follows from ESMA's express cross-reference; MiFID conduct exemptions cannot be imported wholesale. (ESMA, Q&A 2463, answer of 7 April 2025; ESMA/2012/382, Q&A 9, p. 15; ESMA35-42-1428, paras. 10, 19–37.)
The platform must classify every permitted asset and contractual exposure before choosing its permissions. Tokenised shares, debt instruments or fund units may be financial instruments excluded from MiCA. Crypto derivatives require the same separate treatment; a crypto underlying does not make a derivative a MiCA spot asset. ESMA expressly addresses perpetual futures within its derivative guidance. An Irish CASP permission therefore cannot serve as the sole permission for a mixed spot-and-derivatives copying product. Exclude derivatives and tokenised financial instruments from the pilot pending the corresponding MiFID II assessment. (MiCA, art. 2(4)(a); Directive 2014/65/EU, art. 4(1)(15), Annex I, Section C; ESMA, Guidelines on the qualification of crypto-assets as financial instruments, ESMA75453128700-1323, Guidelines 2, 4–5, paras. 44–47.)
Version A and the information-only route
Version A can operate as a publishing product when users independently decide and submit every trade elsewhere. The Kenyan firm may select material for a public model portfolio without managing each reader's assets. Its subscription contract should supply information only, with no mandate, personalised assessment, order acceptance or wallet access. The publisher should neither hold keys nor control the user's exchange account. A public portfolio update then remains information that readers may disregard. This conclusion follows from the absence of the service elements, rather than a general publisher exemption. (MiCA, art. 3(1)(17), (21), (23)–(26).)
The strongest contrary view concerns the complete user journey. A portfolio ranked using the user's holdings or risk answers can communicate a personalised recommendation. A prompt to select a particular copying service may constitute advice even before the first trade. A prefilled ticket passed through the Kenyan platform can create an order-service question. Revenue tied to trading can support scrutiny of whether the publisher actually participates in that journey. A disclaimer does not negate conduct satisfying the statutory definition. (MiCA, arts. 3(1)(23)–(25), 66; ESMA35-42-1428, paras. 29–32, 35–37.)
For the information-only design, retain the same publicly available content and objective sorting criteria for all readers. Remove “recommended for your account” prompts, suitability questionnaires used to select portfolios, integrated trading instructions and automatic account connections. Users should open their own independent exchange interface and enter their orders themselves. A neutral external link does not necessarily constitute order transmission, but populated transaction data and subsequent handling must receive separate scrutiny. A fixed subscription is preferable to a venue-linked trading share for this design. These are proposed product boundaries, not statutory safe harbours. (MiCA, art. 3(1)(23)–(25); ESMA35-42-1428, paras. 21, 29–32.)
Version B and transaction-specific instructions
Version B ordinarily avoids portfolio management only when each transaction depends on an affirmative, informed user instruction. A proposed order may originate with a trader, but the user must decide whether it becomes an order. The platform must not execute after a countdown expires or treat silence as acceptance. Approval of an initial allocation cannot authorise undisclosed future rebalancing while preserving this classification. A user click matters only for the decision that it actually makes. (MiCA, art. 3(1)(25); ESMA35-42-1428, paras. 29, 33, 37.)
A non-personal signal can accompany reception/transmission or execution without advice. A signal selected for the user's circumstances, or represented as appropriate for that user, requires an advice assessment. The order-service principal also matters: receipt by the Kenyan firm followed by transmission to a partner can make the Kenyan firm a service provider itself. Partner branding on the destination exchange does not remove that first regulated step. ESMA regards copying supplied by one firm with a direct link to the copied traders as highly unlikely to be execution-only. Advice and an order service can coexist in the same transaction. (MiCA, art. 3(1)(21), (23)–(24); ESMA35-42-1428, paras. 29–32.)
The pilot should place the regulated ticket within a partner-controlled service, with the partner identified before acceptance. Show the asset, direction, quantity, estimated execution terms, fees, order expiry and applicable slippage limit. Each opening, increase, discretionary reduction or closure requires a fresh instruction. Disable blanket approval of future trades and automatic substitutions after a rejected order. Preserve the exact ticket and acceptance record. This proposed design addresses the distinction between an executable client instruction and permission for another person to make later investment decisions. (MiCA, arts. 3(1)(25), 68(9), 78, 80; ESMA35-42-1428, para. 33.)
Version C and delegated investment decisions
Version C ordinarily requires portfolio-management permission because the selected trader determines future investment decisions for the user's account. Automatic replication, discretionary rebalancing and closing positions satisfy the decisive factual element when they proceed without necessary user intervention. The mandate can arise through an online “follow” instruction. Identical strategies across many accounts do not remove client-by-client management where each client grants a mandate over an individual portfolio. Budget limits and a right to stop constrain the manager's discretion without necessarily eliminating it. (MiCA, art. 3(1)(25); ESMA/2012/382, Q&A 9; ESMA35-42-1428, paras. 26–28, 33.)
Automation alone is insufficient. A system that mechanically implements every investment parameter already specified by the client can lack investment discretion. A client-defined limit order illustrates that distinction. A general instruction to copy a trader's future choices leaves those choices to someone else. Nor does a window to veto a trade establish necessary client participation when execution follows inaction. The classification must separate predetermined client instructions from future asset-selection, sizing or disposal judgments. (ESMA/2012/382, Q&A 9; ESMA35-42-1428, para. 33, applied through ESMA Q&A 2463.)
An authorised portfolio-management partner can provide C without the Kenyan technology supplier obtaining its own EU permission solely because it supplies code. The partner must actually undertake the mandate, supervise the strategy and control the investment service. An execution-only partner cannot supply that missing permission. Separate advice, order, custody or transfer permissions depend on the functions each actor also performs; portfolio management is not a universal licence for the entire transaction chain. (MiCA, arts. 3(1)(16), 59(6), 73.)
The partner's contract, algorithm and operational control
The partner-led route requires the EU CASP to contract with the user for the regulated service. Its terms must identify the service, charges, authorised entity and respective responsibilities. Any Kenyan subscription agreement should distinguish the information or software product and avoid a parallel promise to manage, advise or execute. The partner must own the regulated client relationship, including suitability decisions, investment mandates and complaints. A Kenyan-law clause cannot alter which firm actually performs a MiCA service in the EU. (MiCA, arts. 2(1), 59, 73(1), 81.)
Code ownership may remain in Kenya. Effective control requires the partner to approve the eligible assets, copied traders, strategy versions, client limits and material changes. It needs staff who understand the logic, usable documentation, access to logs and the ability to reject signals. The partner must control production changes and have a working power to suspend copying. A vendor's technical emergency stop is compatible with outsourcing when governed by the partner's incident policy. A vendor's unilateral decision to change client allocations or override investment limits indicates a different service allocation. (MiCA, arts. 68, 73.)
For B, the user chooses each accepted trade; the partner receives the instruction and controls its permitted onward handling. For C, the partner accepts responsibility for investment discretion exercised through the selected strategy and supervised trader. Its execution arrangements must determine venues, order timing and responses to stale signals, partial fills and excessive slippage. Client assets should remain with the appointed authorised custodian, or in a genuinely client-controlled account where the relevant permissions permit that model. Kenyan development staff should have no independent production authority to move assets. (MiCA, arts. 73, 75, 78, 80–82.)
The outsourcing contract needs defined functions, information and audit rights, regulatory access, incident duties, subcontracting controls and an executable exit plan. The CASP remains responsible, must retain expertise, and cannot outsource in a manner that changes its client obligations or authorisation conditions. A group relationship does not remove these requirements. The narrow exclusion for services provided exclusively within a group does not exempt external client business merely because an affiliate participates. (MiCA, arts. 2(2)(a), 73.)
The adverse case is a Kenyan firm that hires the traders, selects the portfolios, receives the subscriptions and orders, and determines every algorithm change. An EU firm then supplies only execution and a licence reference. ESMA's two-firm example attributes separate services to the signal-pooling firm and executing firm. The proposed arrangement must address that separation directly. If Kenya retains the regulated service, the group must change the allocation or obtain an EU authorisation for the actual provider before launch. (MiCA, art. 59; ESMA35-42-1428, para. 32.)
Irish authorisation before EU cross-border access
An Irish group CASP becomes necessary for the proposed own-service route when the group wants its Irish entity to undertake regulated client functions. The application must cover portfolio management for C, advice for personalised recommendations, and the order services actually performed. Custody and transfers require their own assessment. Adding permissions later is possible through MiCA's extension procedure, but the existing grant must cover a service before it starts. The Kenyan parent does not acquire its subsidiary's permissions. (MiCA, arts. 59(6), (8), 62–63.)
The applicant needs a registered office in Ireland where it performs at least part of its crypto-asset services. Effective management must be in the EU, with at least one EU-resident director. The Central Bank of Ireland expects substantive local direction, resources and operational capability. A registered address with investment decisions controlled entirely from Kenya is unsuitable for this proposed structure. Application preparation must address management suitability, prudential safeguards, controls, outsourcing and the actual service architecture. (MiCA, arts. 59(2), 62, 67–68; Central Bank of Ireland, Supervisory Expectations for CASPs, 10 March 2026, pp. 3, 9.)
The Central Bank's process includes preliminary engagement, a Key Facts Document and the formal application. Since 2 April 2026, CASP application documents are submitted through its Portal. Neither engagement nor submission authorises activity. The statutory assessment periods run through completeness and information-request stages; they do not promise a launch date measured from initial contact. Licentium's MiCA/CASP authorisation guide provides further reading on classification and application preparation. (MiCA, art. 63; Central Bank of Ireland, MiCAR authorisation process and Portal notice.)
EU cross-border access follows Irish permission. The Irish CASP must notify the Central Bank of the intended Member States, services, start date and other relevant activities. Under Article 65, services may start when the CASP receives the prescribed communication, or at the latest on the fifteenth calendar day after submitting the required information. The authority's transmission period is ten working days. These are distinct clocks. An existing EU partner uses its own authorisation and notification route; it does not lend that access to the Kenyan firm. (MiCA, art. 65(1)–(4).)
EU-directed advertising defeats reliance on a client's exclusive initiative under Article 61. Solicitation through another person, including a closely linked entity, also matters; contractual declarations cannot reverse the facts. This exception cannot support the proposed marketed launch, including a professional-investor campaign. An Irish company must obtain permission before beginning its own regulated service, rather than relying on a historical VASP registration or transitional route. (MiCA, arts. 59, 61; Central Bank of Ireland, MiCAR transitional-period guidance.)
Suitability for retail and professional clients
Advice and portfolio management require suitability assessment for clients and prospective clients. The CASP must obtain knowledge and experience, investment objectives, risk tolerance, financial circumstances and ability to bear losses. It must not recommend an unsuitable asset or service, or begin unsuitable portfolio management. Missing required client information also prevents those steps. The provider cannot satisfy these duties by asking users to acknowledge that they understand every risk. Copying an experienced trader does not establish the follower's capacity to bear that trader's losses. (MiCA, art. 81(1), (8)–(11).)
For retail users, the assessment should address crypto-specific volatility, liquidity, custody risk, trading frequency and the effect of fees. The proposed strategy must fit the client's horizon and loss capacity, including concentration across copied traders holding the same assets. Automated questionnaires need consistency checks and controls against coaching users into riskier answers. A failed advice or management assessment should not be bypassed through an otherwise identical “execution-only” screen. These design recommendations apply the statutory suitability obligation to the copying model. (MiCA, art. 81; ESMA35-1872330276-2031, Guidelines 2–4, 7–10.)
Professional investors remain clients under Article 81; MiCA does not supply a blanket MiFID professional-client waiver. Proportionality can change the evidence needed, but cannot remove the test. For an institutional client, assess the entity's finances and objectives, the authorised representative's knowledge and experience, and that person's authority to transact. A professional individual may understand execution mechanics while still having unsuitable concentration or loss exposure. The same A, B and C classification applies to each audience. (MiCA, arts. 3(1)(39), 81(1); ESMA35-1872330276-2031, Guidelines 3 and 6, paras. 63–64.)
Article 81 requires suitability reviews at least every two years, with policies for more timely updates when circumstances warrant. Advice requires a suitability report in electronic format. Portfolio management requires a statement every three months, subject to the qualifying online-access exception. That exception requires current portfolio valuations and suitability information, with evidence of client access to a valuation during the quarter. A dashboard showing only the copied trader's returns cannot replace these client-specific reports. (MiCA, art. 81(12)–(14).)
MiCA's reception/transmission and execution provisions do not independently impose Article 81's suitability test on a genuinely non-advised B service. A risk-understanding check remains a sensible pilot control and may serve obligations under other applicable law. Staff competence is a separate matter. Ireland's competency amendments took effect on 28 July 2026 and extend requirements to relevant outsourced personnel. ESMA's criteria address staff who determine automated information or advice parameters. The classification of the output therefore matters even without a human adviser in the interface. (MiCA, arts. 78, 80, 81(7); S.I. 295/2026, regs. 2, 4–5; ESMA35-24871704-2922, para. 17.)
Advisers and portfolio managers must warn about fluctuating values, partial or total loss and possible illiquidity. They must also explain the absence of deposit-guarantee protection and, where applicable, investor-compensation coverage. The copying interface should present those warnings before the relevant service starts. A warning cannot replace the suitability decision. (MiCA, art. 81(9)–(11).)
Fees, exchange rebates and trader conflicts
The proposed trading-fee share and exchange rebates require separate analysis for each service. Article 80(2) prohibits remuneration, discounts or non-monetary benefits for routing client orders to a particular platform or CASP. A routing-linked rebate cannot be cured by disclosure. Portfolio managers cannot accept and retain third-party fees, commissions or monetary or non-monetary benefits connected with that service. The ban is distinct from fees paid by the client. Payment to a Kenyan affiliate requires examination of its actual purpose and recipient role; it is not an automatic workaround. (MiCA, arts. 80(2), 81(5).)
Independent advice faces its own third-party remuneration prohibition, with a limited exception for qualifying minor non-monetary benefits. Non-independent advice permits benefits only under the statutory conditions, including service-quality enhancement, consistency with clients' best interests and advance disclosure. A generic consent to “commercial partnerships” is insufficient. For the pilot, prefer a disclosed client charge and a documented software fee between firms that does not reward venue choice or unnecessary turnover. (MiCA, art. 81(2)–(6).)
A copied trader's compensation, personal holdings and opportunity to trade before followers create conflicts requiring active controls. The partner should approve trader remuneration, monitor unusual turnover and account for conflicts in trader selection and rankings. Revenue should not reward strategies merely for generating more trades. The CASP must identify, prevent, manage and disclose conflicts, with policy review at least annually. Disclosure supplements controls; it cannot legitimise prohibited remuneration. (MiCA, arts. 66(1), 72, 80(2), 81(3), (5)–(6).) MiCA's market-abuse rules also reach an information-only publisher where the assets are admitted to trading or admission has been requested. Article 91(3)(c) prohibits taking a position, voicing a media opinion and profiting from its price effect without proper simultaneous public disclosure of that conflict. The partner must maintain prevention and detection arrangements and report reasonable suspicions without delay when it professionally arranges or executes relevant transactions. (MiCA, arts. 86, 91(3)(c), 92(1).)
Performance claims and the permitted asset universe
Marketing must be fair, clear and not misleading. The pilot should distinguish actual trader performance, simulated performance and returns achievable by followers. Disclose the measurement period, losses, fees, data source and relevant differences caused by latency, liquidity and position sizing. Excluding failed traders or displaying gross returns beside net user charges can distort the comparison. Avoid guaranteed returns, capital-protection claims and an implication that CASP authorisation approves a strategy. These controls follow from the duty governing client information. (MiCA, art. 66(2)–(4).)
The partner should approve EU-targeted messages and retain the approved version, including Kenyan-origin promotions and affiliate material. Atlas crypto-marketing screening offers a first-line review of claims and supporting material; the CASP's compliance review must remain responsible for release. Neither an automated score nor an influencer's experience establishes that the message satisfies MiCA. (MiCA, arts. 66, 72–73.)
Stablecoin eligibility also affects the launch. ESMA's opinion of 8 October 2026 recommends supervisory action across crypto-asset services involving non-MiCA-compliant asset-referenced and e-money tokens. It is a supervisory opinion, rather than a new legislative prohibition defining every service as an offer. Its best-interests analysis makes these tokens unsuitable for the proposed pilot's new-access list. Limited arrangements for existing clients to liquidate, convert or withdraw assets do not provide a basis for starting a new copying service. (ESMA75-113276571-1742, paras. 12–27; MiCA, art. 66.)
Order handling, slippage and client assets
An executing CASP must take all necessary steps to obtain the best possible result under Article 78's execution factors. It needs an execution policy, client consent and evidence that it follows that policy. Before executing outside a trading platform, the CASP must inform the client of that possibility and obtain prior express consent. That consent may cover the arrangement generally or individual transactions. A specific client instruction limits the duty only in relation to what that instruction determines. Selecting a trader does not prescribe every venue, timing or execution response. A receiving/transmitting CASP instead needs procedures for prompt and proper transmission under Article 80. The partner must identify which duty applies at each point in the order path. (MiCA, arts. 78(1)–(6), 80.)
The pilot should enforce stale-signal expiry, maximum permitted deviation and rules for rejected or partially filled orders. It should test capacity when many followers trade together and determine whether to pause, cancel or seek a fresh instruction. B must not convert a failed order into a different investment without the necessary user decision. C must keep any response within the client's mandate and suitability limits. The client terms should explain why follower prices and holdings may differ from the leader's. (MiCA, arts. 66, 78, 80–81.)
Custody depends on safekeeping or control of assets or their means of access, including private keys. A “non-custodial” label cannot settle the effect of withdrawal credentials, smart-contract administration rights or signing permissions. A trading-only API also needs a precise control assessment; it does not automatically establish custody. Transfers arise separately where a firm moves crypto-assets for a client between distributed-ledger addresses or accounts. Displaying a model portfolio, recommending a trade and moving its proceeds are different functions. (MiCA, art. 3(1)(17), (26).)
Where the partner provides custody, it must maintain the required agreement, position records and segregation arrangements. Subcustody may be entrusted only to an Article 59-authorised CASP. Kenyan key holding cannot be disguised as ordinary software outsourcing. An attributable custody loss can engage Article 75's liability rule, which does not insure investment losses. Transfer services require their own agreement and controls. Related payment services require the provider or its payment partner to hold the relevant payment-services authorisation. (MiCA, arts. 70(4), 75(1)–(9), 82.)
Automation, data flows, records and complaints
The partner should test every strategy version before production, restrict privileged access and rehearse suspension and recovery. It must be able to continue or wind down the service if the Kenyan supplier fails. MiCA expressly connects operational arrangements with DORA and requires the CASP to retain responsibility for outsourcing. A contractual right to inspect software is insufficient if staff cannot exercise it or the supplier can deny access to production records. (MiCA, arts. 68(7)–(9), 73.)
For each copied transaction, retain the originating signal, algorithm version, client settings, approval or mandate, order timestamps, execution result and override history. These proposed records allow reconstruction of who made the investment decision and who controlled execution. MiCA requires records of services, activities, orders and transactions for five years, extendable to seven at the authority's request. Complaints procedures must be free, accessible, fair and timely, with complaint and outcome records. The client should reach the responsible CASP even when Kenya operates first-line support. (MiCA, arts. 68(9), 71, 73.)
An automatic decision based on personal data requires a separate data-protection analysis. Where it is solely automated and produces legal or similarly significant effects, the GDPR's Article 22 restrictions and exceptions apply. Necessity for a contract or explicit consent requires its own justification and safeguards. Starting the system with a human click, or adding an appeal after the event, does not necessarily remove the prohibition. Human intervention must be substantive where required. A manager's human supervision can satisfy a data safeguard without converting C into client-directed trading. (Regulation (EU) 2016/679, art. 22; Data Protection Commission, AI Insights Report, September 2026, p. 59.)
Before processing begins, the controller must conduct a data protection impact assessment where the processing is likely to create high risks. Systematic, extensive profiling used for legally or similarly significant decisions requires particular attention under Article 35. The assessment should identify the decision-maker, intervention rights and consequences of erroneous copying. (GDPR, art. 35(1), (3)(a); Data Protection Commission, Data Protection Impact Assessments.)
Map EU-to-Kenya access separately from Kenya-to-EU and onward transfers. The partner should limit Kenyan access to the data required for its outsourced function and contract for the actual controller or processor roles. EU standard contractual clauses require the appropriate transfer assessment and safeguards; signing a vendor agreement alone is insufficient. Kenya imposes its own outward-transfer conditions and automated-decision protections. The September 2026 ODPC guidance addresses cross-border access and transfer safeguards. An EU transfer mechanism does not discharge the Kenyan rules for the reverse flow. (MiCA, art. 73; GDPR, arts. 44–46; EDPB, International data transfers; Kenya Data Protection Act, No. 24 of 2019, ss. 35, 48–49; ODPC, Guidance Notes for Cross-border Data Transfers, 2026, pp. 10, 13–17.)
Kenyan permissions and operating duties
Kenya's Virtual Asset Service Providers Act commenced on 4 November 2025. It prohibits unlicensed virtual-asset business conducted or held out in or from Kenya. The final implementing instrument is the Virtual Asset Service Providers Regulations, 2026, Legal Notice No. 134, published on 22 July 2026. The March consultation document cannot establish the current obligations or their numbering. Serving EU clients from Kenya remains relevant to the domestic perimeter. (Virtual Asset Service Providers Act, No. 20 of 2025, ss. 4, 8; L.N. 134/2026, reg. 4.)
The Act's First Schedule assigns discretionary virtual-asset management, investment advice, brokerage and exchange services to CMA. Custodial wallet provision and virtual-asset payment processing fall to CBK, which also supervises the scheduled stablecoin activity. Consequently, C requires a CMA management assessment when the Kenyan entity provides that service. B may involve CMA brokerage or advice, depending on the accepted orders and recommendations. Adding key control or payment processing can require CBK permission as well. A wallet permission cannot substitute for a management permission. (Act, ss. 5–9, First Schedule.)
The MiCA conclusion for A does not establish a Kenyan publishing exemption. The Kenyan investment-adviser category concerns advice on virtual assets for clients and must be tested separately against the subscription content. Public recommendations sold to subscribers therefore require a CMA perimeter assessment even where MiCA personalisation is absent. (Act, ss. 8–9, First Schedule.)
The actual Kenyan authority must match the entity, activity and conditions. Section 17 requires each relevant regulator to maintain a register recording the service type and licence status. Incorporation, a pending application, an exchange affiliation and another group's permission are insufficient substitutes. Section 47 gives persons already providing services at commencement one year to comply. That provision requires evidence of the qualifying pre-existing business and cannot be treated as an unrestricted entry route for a new service. (Act, ss. 8, 10, 12, 17, 47.)
The final Regulations impose duties relevant to this product beyond licensing. A Kenyan virtual asset manager must provide each consumer a written monthly statement of account value, transactions between licensee and consumer, and changes in asset quantity and valuation. MiCA's quarterly reporting default does not replace that duty. Regulation 109 addresses client understanding and recommendations, including a reasonable basis for the client's understanding and records supporting the explanation. Regulations 123–133 govern promotions, performance and charges, including material issued on a licensee's behalf. Professional status does not itself remove the Kenyan conduct analysis. The Kenyan service provider must account for the customer and activity covered by its own duties alongside those of the EU principal. (L.N. 134/2026, regs. 107(4), 109, 123–133.)
A Kenyan licensee must preserve transaction records for at least seven years. The Regulations also require seven-year complaint records and advertising-approval records for seven years after the advertisement ceases to be available. The group's retention policy must distinguish those periods from MiCA's five-year starting rule. (Act, s. 44(2); L.N. 134/2026, regs. 22, 110(4), 133; MiCA, art. 68(9).) Licentium's Kenyan licensing and client-protection analysis examines the wider domestic duties.
Outsourcing direction matters. A Kenyan licensee outsourcing a function must obtain the relevant authority's approval at least thirty days before implementing the outsourcing agreement. Senior officers must retain their responsibilities for material outsourced functions. The licensee must preserve client obligations, supervisory access and compliance with its authorisation conditions. An EU CASP purchasing Kenyan software faces MiCA Article 73; a Kenyan regulated firm outsourcing part of its own service faces the Kenyan rule. Connected contracts can trigger both assessments. The group must map each contract's function rather than call the entire arrangement a single technology partnership. (L.N. 134/2026, reg. 113; MiCA, art. 73.)
Feature decisions and the launch sequence
Retain A only as the information-only design described above. Launch B through a partner whose permissions cover the actual advice and order functions, with each trade accepted inside its controlled service. Keep C disabled unless that partner has portfolio-management permission and accepts the complete mandate and operating controls. Route custody, transfers and payments only through providers authorised for those functions. Treat any later Kenyan assumption of personalised advice, client-order handling or investment discretion as a trigger for a fresh authorisation assessment before enabling it. (MiCA, arts. 3, 59, 73, 75, 78, 80–82.)
Before a partner pilot, the contracts and interface must identify the regulated principal consistently. Remove future-trade pre-authorisation from B, default auto-rebalancing and execution after silence. Allocate approval of traders and algorithm changes, order receipt, slippage decisions and emergency actions to named functions. The partner must control suitability, regulated communications and complaints, with the Kenyan supplier bound to provide records and assistance. These changes are essential to the proposed allocation; cosmetic co-branding cannot replace them. (MiCA, arts. 66, 68, 71, 73, 81.)
The implementation sequence should begin with the asset inventory and legal-entity allocation, followed by permission checks in both jurisdictions. Next, freeze the user contracts, fee flows, algorithm controls and order, asset and data paths. Complete the partner's onboarding, suitability design and operational testing before a limited live pilot. Test retail and institutional journeys separately, including failed suitability, price gaps, partial fills, outages and complaints. No live feature should precede the permission and control conditions applicable to it. (MiCA, arts. 59, 68, 73, 81; Kenya Act, ss. 8–12; L.N. 134/2026, regs. 6, 109, 113.)
For the own-service route, prepare the Irish application while the genuine partner remains responsible for its existing service. Do not move investment discretion to the group applicant before grant. After Irish authorisation, complete Article 65 notifications for the intended EU markets, then migrate contracts and asset instructions with the required client arrangements. The new entity must possess the relevant service permissions at migration; continued use of Kenyan code does not change that requirement. (MiCA, arts. 59, 63, 65, 73, 75, 81–82.)