KENYA · en-KE · 10 September 2026
Who regulates online casinos in Kenya?
Who regulates online casinos in Kenya? The Gambling Regulatory Authority of Kenya (GRA) is the body to check for gambling licensing, operator records, gambling complaints and advertising controls. The Central Bank of Kenya (CBK) deals with payment-system obligations, while the National KE-CIRT/CC coordinates cyber-security incident response. These roles are different: none of them, on the facts available here, automatically proves that a casino owes a balance or guarantees recovery of money.
The route for a complaint depends on what happened. A licensing or gambling-conduct concern points towards GRA. A problem with a PayBill, M-PESA message, payment account or payment-provider complaint should first be raised with the provider, such as Safaricom, using its customer-care and complaints process. Suspected phishing, impersonation or account compromise may require a separate cyber-incident report. One event can therefore justify more than one report.
Which Kenyan authority handles which issue?
| Issue | Most relevant route | What the remit means |
|---|---|---|
| Gambling licence, operator identity or gambling conduct | GRA | Check the operator record, licence field, trading name and domain, and use the gambling complaint route where appropriate. |
| Payment-provider service or suspected payment fraud | Payment provider first; CBK-related payment obligations where relevant | Payment-service rules require customer-care and complaint processes. They do not decide a casino balance or promise reimbursement. |
| Phishing, cyber incident or account compromise | National KE-CIRT/CC and the affected service providers | KE-CIRT/CC coordinates response to cyber-security matters and incidents. It does not adjudicate a casino balance. |
The Gambling Control Act 2025 is the primary legal reference for the GRA powers, licensing, complaints and advertising limits recorded for this guide. The legal role should not be confused with a finding about a particular operator or complaint.
What does GRA regulate?
GRA is the relevant Kenyan gambling authority for licensing and gambling oversight. Its role includes the powers and controls recorded in the Gambling Control Act 2025, including licensing, complaints and advertising limits. A person checking an online casino should begin by asking whether the precise operator and domain can be matched to a current GRA record.
The GRA licensed-operators record is useful because it includes fields for the operator, trading name, licence information and domain matching. The GRA licensed operators record was checked on 12 August 2026. A name that resembles a licensed business is not enough by itself. Compare the exact domain and trading name, and treat an absent, stale or conflicting match as an unresolved verification issue rather than automatically calling it illegal.
| Check | Why it matters | What remains unknown without a current match |
|---|---|---|
| Operator name | Shows which business is presented in the record. | Whether a similarly named site is the same business. |
| Trading name | Helps compare the public brand with the recorded identity. | Whether the brand’s support account or payment recipient uses that identity. |
| Licence field | Shows the licence information recorded by GRA. | Whether the record remains current after the date checked. |
| Exact domain | Helps distinguish a listed site from a clone or lookalike. | Whether a redirected, newly changed or impersonating domain is authorised. |
For a practical identity check, use the operator-checking guide and the trading-name and licence guide. A GRA listing is evidence of a registry match at the time checked; it is not a guarantee about every payment, withdrawal, support interaction or future conduct.
Can GRA decide a casino payment dispute?
GRA is the relevant route for a gambling complaint, but its gambling remit should not be expanded into a payment-recovery promise. A complaint about an operator’s conduct, licensing information or advertising can be separated from a complaint about how a payment provider processed a transaction.
For a gambling complaint, preserve the operator name, exact domain, trading name, relevant messages, transaction code, dates and the response received. Do not describe an allegation as an official finding. A complaint remains a complaint unless a dated competent-source record establishes a different outcome. The GRA legal role recorded here does not establish that any unnamed operator has breached the law.
Use the GRA complaint guide for the information to organise. If the issue concerns a suspected clone or impersonator, also compare the domain against the GRA record and use the clones and phishing guide.
Who handles a casino payment-provider complaint?
A payment-provider complaint should normally start with the provider that processed or was expected to process the transaction. That may include Safaricom where an M-PESA PayBill, till, message or transaction code is involved. Keep the M-PESA message, transaction code, amount, date, recipient details shown in the message and all customer-care references. Do not share an M-PESA PIN or one-time security code with a person claiming to investigate.
The National Payment System Regulations, checked on 28 August 2026, require a payment service provider to maintain customer-care and complaint processes, including a mechanism for complaints involving loss of funds through fraudulent means. That rule does not decide whether a casino balance is payable, identify a recipient for a customer, or promise reimbursement.
| Payment problem | First evidence to retain | Important limit |
|---|---|---|
| Wrong PayBill or recipient | M-PESA message, transaction code, amount and time. | A payment complaint does not prove who ultimately owes a gambling balance. |
| Uncredited deposit | Provider reference and the operator’s account or deposit record. | The payment provider may not decide the operator’s account ledger. |
| Unpaid withdrawal | Withdrawal reference, operator response and payment-provider records. | Payment rules do not guarantee that a withdrawal will be approved. |
| Suspected fraudulent payment | Original message, account-security details and complaint reference. | Recovery is not guaranteed by the regulations. |
For related steps, see M-PESA and withdrawals, tracing a casino M-PESA transaction and wrong betting PayBill guidance. A provider complaint and a GRA complaint can run separately because they address different records and responsibilities.
What does CBK handle?
CBK is relevant to Kenya’s payment-system framework, including the obligations described in the National Payment System Regulations. The recorded rule requires payment service providers to maintain customer-care and complaint processes. It does not turn CBK into a gambling adjudicator, and it does not establish that CBK will determine a casino’s liability for a disputed balance.
That distinction matters when a payment was successful but an operator account was not credited, or when a withdrawal was requested but not received. The payment provider may investigate the transaction path under its complaint process. The operator may need to explain its account ledger or withdrawal decision. GRA may be relevant to the gambling-conduct or licensing aspect. These are connected facts, but they are not one combined regulator process.
What is the role of National KE-CIRT/CC?
The Communications Authority states that the National KE-CIRT/CC coordinates response to cyber-security matters and cyber incidents. The relevant statement was checked on 28 August 2026. This makes KE-CIRT/CC relevant where the incident involves suspected phishing, a malicious lookalike, compromised credentials, impersonation or another cyber-security concern.
The remit has a clear boundary: KE-CIRT/CC does not adjudicate a casino balance and does not guarantee account or payment recovery. A cyber report should therefore sit alongside, not replace, a payment-provider complaint or gambling complaint where those issues also exist.
If someone requests an M-PESA PIN, directs you to an imitation login page or claims to be casino support, preserve the message and avoid further engagement. Use the M-PESA PIN warning guide, the support-impersonation guide and the fake betting-site warning guide. The Communications Authority information on National KE-CIRT/CC was checked on 28 August 2026.
When should one incident be reported in more than one place?
Separate reports may be appropriate when an incident combines gambling, payment and cyber elements. For example, a lookalike casino may request an M-PESA payment and then use a fake support account. The domain and gambling presentation belong in the GRA-focused record; the transaction belongs in the payment-provider complaint; the impersonation or phishing indicators belong in the cyber-incident report.
- Secure the relevant account and do not disclose a PIN or security code.
- Save original messages, transaction codes, domain details and dates.
- Raise the payment issue with the payment provider’s customer-care and complaint process.
- Record the operator’s response without treating it as an independent finding.
- Check the exact operator, trading name, licence field and domain against GRA’s record.
- Report suspected phishing, impersonation or compromise through the appropriate cyber-incident route.
Use the complaints and reporting guide to keep the records distinct. A regulator’s involvement, a complaint reference or an operator reply is not by itself proof that the underlying allegation has been upheld.
What this guide can and cannot establish
This guide identifies the recorded institutional roles; it does not make a finding about an unnamed or named casino. No licence, legal entity, payment outcome, withdrawal test, complaint outcome or cyber recovery should be inferred without a current, precise record. An absent or stale listing is an open verification issue, not automatically an adverse finding.
CasinoCheck KE reviewed the cited materials and the route structure on 10 September 2026. The GRA record was checked on 12 August 2026, while the payment and cyber references were checked on 28 August 2026. Because records and domains can change, repeat the checks before relying on them. Corrections or dated primary records can be sent through the contact route. The method and its limits are also described at the methodology guide.
Frequently asked questions
Who regulates online casinos in Kenya?
GRA is the Kenyan gambling authority to check for online-casino licensing, operator records, gambling complaints and advertising controls. Payment-system and cyber-security matters have separate routes.
Does GRA trace an M-PESA transaction?
GRA’s gambling remit does not establish that it traces an M-PESA transaction or guarantees recovery. Raise the transaction issue with the payment provider and keep the M-PESA message and transaction code.
Who handles a casino payment-provider complaint?
Start with the payment provider that processed or was expected to process the transaction, such as Safaricom for an M-PESA matter. Payment-system complaint rules do not decide a casino balance or promise reimbursement.
Where should gambling phishing be reported in Kenya?
Suspected gambling phishing, impersonation or account compromise may require a cyber-incident report involving National KE-CIRT/CC, alongside reports to the affected payment provider and the relevant gambling route.