Operator evidence file · Kenya · 23 August 2026
Brand not on the GRA list: practical checks in Kenya
How to investigate a Kenya gambling brand not found on the public list
Affgate was used only for discovery and priority. The verdict and findings come exclusively from the declared evidence sources.
A gambling brand can appear active in Kenya while its exact name is absent from the captured GRA table. That mismatch deserves investigation, but it does not settle the brand’s legal status. A trading name may differ from a company name, a domain may not appear in a company table, and the captured register may cover a particular licensing period.
The safe response is to identify the company, check the exact domain and preserve dated evidence before depositing money, sending identity documents or making an allegation. The current signal is amber because an unmatched name is an open evidence question rather than proof that no relevant licence exists.
What an absent name does—and does not—show
The starting record is the GRA source headed “Licensed gaming companies 2025/2026”. The captured GRA licensed-operators source supports a check against that dated table. Because the supplied record expressly requires recapture of the current licensing period before publication, the table must not be treated as permanently current.
An unsuccessful exact-name search supports a narrow statement: the searched wording was not found in the captured table. It does not, by itself, establish that the business is unlicensed, unlawful or operating under no recognised company. It also does not verify any website claiming association with a listed company.
| Finding | What it supports | What remains unresolved |
|---|---|---|
| Exact brand name appears in the current GRA record | A recorded name match for the checked licensing period | Whether the visited domain belongs to that entity |
| Exact brand name is absent | No exact captured match under that spelling | Trading name, company identity, licence status and current register position |
| Similar company name appears | A possible lead for further checking | Whether the similarity represents the same operator |
| Domain is not shown in the table | No domain-level confirmation from that table | Ownership, authorisation and control of the website |
Separate the brand, company and domain
A brand name is the public-facing label seen in an advert, app or website. A legal or trading entity is the organisation that claims to operate the service. A domain is the precise internet address used to reach it. These identifiers can overlap, but they are not interchangeable.
Record each one separately. Copy the brand spelling exactly, including punctuation. Note the company name claimed in account screens or correspondence, but label it as an operator claim unless it can be matched to an accepted primary record. Record the full domain, including the top-level ending, because a one-character change or a different ending can lead to another host.
Do not bridge gaps with assumptions. A listed company with a broadly similar name is not automatic evidence for an unlisted brand. Equally, absence of the consumer-facing name does not prove that no listed company operates it. Use the operator-check workflow to keep identity questions separate.
Run a reproducible GRA table check
Begin by confirming the title and licensing period of the GRA table available at the time of the check. Save the URL, access date and a complete capture that shows the heading as well as the relevant result. A cropped search result without the table title can lose the date context needed later.
- Search the exact brand as displayed.
- Repeat without spaces, punctuation or stylisation.
- Search the claimed company name exactly.
- Check recognisable company-name components without treating partial similarity as a match.
- Record every term used and whether it produced an exact, possible or no match.
- Recheck the current licensing period before relying on an older capture.
A “possible match” should remain a lead until the relationship is confirmed. For more detail on interpreting register fields, use the Kenyan GRA licence-check guide.
| Check field | Evidence to retain | Avoid concluding |
|---|---|---|
| Register period | Table title, visible period and access date | That an older table remains current |
| Brand search | Exact search term and full result context | That absence proves non-existence |
| Company search | Exact legal or trading name searched | That a similar name is the same entity |
| Domain check | Full hostname and where it was observed | That a company listing covers every lookalike host |
| Follow-up | Reference number and dated response | That submission alone confirms a violation |
Check the exact host and possible mirror domains
A domain check must be host-specific. Record the address reached after any redirect, not only the text typed into a browser. If an advert, message or app sends users to another host, preserve both the starting address and destination. Never assume that two sites sharing colours, wording or a similar name have common ownership.
Mirror domains complicate the check because a brand can be presented through several hostnames, while an unrelated actor can also imitate that presentation. A company-name match therefore cannot authenticate every domain carrying the brand. Verify each hostname independently and compare only evidence-backed identifiers.
Warning signs such as unexpected redirects or a slightly altered domain justify caution, not an instant legal verdict. Do not enter credentials or upload identification while the host remains unresolved. The Kenyan domain-verification steps explain what to record, while clone and phishing guidance covers lookalike risks.
Preserve evidence before contacting anyone
Use this evidence-preservation checklist:
- record the exact brand, claimed company and full domain separately;
- capture the GRA table title, licensing period, URL and access date;
- save the search terms and full surrounding result, including a no-match result;
- preserve redirects, dates, times and the route by which the domain was reached;
- retain account identifiers, transaction references and correspondence headers;
- export relevant messages rather than relying only on isolated screenshots;
- note what was observed directly and what was merely claimed by another party;
- calculate file hashes if available, but do not alter originals merely to add them;
- keep identity documents and financial records out of public posts;
- create a short chronology linking every event to its supporting file.
Evidence should be proportionate. Do not send passwords, PINs, one-time codes or unnecessary identity documents in an initial report.
Choose the route that matches the concern
A GRA report is the relevant path for a concern about gambling-operator identity or a possible absence from the applicable operator record. Present the result as an unmatched search requiring clarification, unless an official decision already establishes more.
If the issue involves phishing, account compromise, impersonation or a malicious domain, the Communications Authority of Kenya source describes the KE-CIRT role and incident route. Consult the CA cyber-security source for that limited purpose and use the KE-CIRT reporting checklist to organise technical evidence.
A disputed bank transaction may also require the bank’s complaint process. The Central Bank of Kenya customer-complaints mechanism supports the banking-sector complaint route; it is not a decision about whether a gambling operator is licensed. A gambling-status report and a payment complaint can proceed on separate evidence tracks.
For an identity or licensing concern, follow the unlicensed-operator reporting route. For a general escalation sequence, use the complaints and reporting hub.
What a useful report should contain
Lead with a short, neutral description: the exact brand was not located under the stated spelling in the identified GRA table on a stated date, and clarification is requested about the company and domain. This wording reports the evidence without converting a no-match into a legal conclusion.
- the exact brand and every relevant spelling;
- the full domain and redirect destination, if different;
- the company or trading name claimed by the service;
- the GRA table title, licensing period and check date;
- search terms and complete captures showing the result;
- a dated chronology of adverts, registrations, transactions or communications;
- transaction references where payment is relevant, with sensitive details protected;
- the specific outcome requested, such as confirmation of identity, domain association or the appropriate reporting route.
Do not inflate the report with unsupported complaint counts, forum claims or assumptions about the Gambling Control Act. A competent authority can assess the applicable legal provisions; the reporter’s task is to provide accurate identifiers and reproducible evidence.
Dated sources and their limits
All accepted sources were checked on 23 August 2026. The GRA record supports only the preserved 2025/26 table context and requires recapture for the current licensing period. The Communications Authority source supports KE-CIRT’s cyber-security role and incident route. The Central Bank document supports a banking complaint mechanism, not an operator-dispute outcome.
The independent transition report from The Star Kenya provides transition and market context. It is not a regulator record and cannot prove a verdict about a particular brand, company or domain.
Until an exact entity and host are supported by current primary evidence, the sensible position remains amber: pause, preserve the record, request clarification and report through the route matching the concern.
Frequently asked questions
Does a brand name identify the company?
No. A brand may be a public-facing or trading name, while the relevant record may use a different company name. Record both names separately and seek evidence linking them. A similar name alone does not prove that the brand, company and domain belong together.
How current is the GRA table?
The supplied GRA record preserves a table headed “Licensed gaming companies 2025/2026”. Its own evidence boundary requires the current licensing period to be recaptured before publication or reliance. Always record the visible period and access date instead of assuming an older capture remains current.
How do mirror domains affect a check?
Each domain must be checked independently. A company-name match does not authenticate every host using the same brand, and a lookalike host may be unrelated. Preserve the complete hostname, redirects and the source that directed you there, then seek domain-level confirmation.
What should a report contain?
Include the exact brand, claimed company, full domain, redirects, GRA table period, check date, search terms, complete captures, chronology and relevant transaction or communication references. State that an exact captured match was not found and request clarification; do not claim non-existence or illegality without an official finding.