Why does an online casino ask you to verify your identity?
Kenyan law requires it. The Gambling Control Act, 2025 and the 2026 operations regulations oblige a licensee to check identity, location and age before an account is activated and before any deposit is taken, and to verify a winner before payment.
Verification is a licence condition, not a house preference
When a licensed online casino asks for an identity document, it is following the law that governs its licence. Regulation 85(1) of the Gambling Control (Conduct of Gambling Operations) Regulations, 2026 says a licensee shall not allow a person to take part in any form of online gambling without a mandatory identity check, a location verification and an age assurance check.
The check is sometimes called KYC, short for know your customer. The regulations use that phrase in regulation 98(2), which makes it mandatory for a licensee to verify the identity of all punters under the know-your-customer requirements of the Proceeds of Crime and Anti-Money Laundering Act. The wider list of duties on a licensee is in what Kenyan law requires of an online casino.
Three separate reasons for the same request
The documents you hand over serve more than one rule, which is why a casino may ask for them at registration and again later. The table separates the reasons.
| Purpose | Where it sits | What the rule says in substance |
|---|---|---|
| Keep children out | Act, s.72(2) and (3) | Mechanisms so a child is not registered; proof of age of majority before registering every player |
| Confirm who you are and that you may play | Regulations, r.85(1), (2) and (4) | Identity, location and age checks before account activation and any wagering deposit; confirmation that the person is not self-excluded and is legally eligible |
| Financial integrity | Regulations, r.98(1) and (2) | Internal controls against money laundering, terrorism financing and fraud; identity of all punters verified under know-your-customer requirements |
| Pay the right person | Regulations, r.85(3); Act, s.70(6) | Identity of a winner verified before payment; proof of age of majority before a prize is remitted to the registered player |
What happens at each stage
Regulation 85(2) says the licensee shall use reliable, independent and electronically verifiable data sources, and that this happens prior to player account activation and receipt of any wagering deposit. In plain terms, a licensed casino should not hold your deposit while it still does not know who you are.
The same regulation adds a check on a winner before payment of winnings. This is a separate step from the first one, so being verified at registration does not rule out a request for confirmation when you withdraw. How payment timing works is in the payout rules guide.
| Stage | What the licensee must do | Rule |
|---|---|---|
| Before the account is activated | Identity, location and age assurance, using reliable, independent and electronically verifiable data sources | r.85(1) and (2) |
| Before any wagering deposit is received | Same checks completed first | r.85(2) |
| Before winnings are paid | Verify the identity of the winner | r.85(3) |
| Before a prize is remitted | Proof of age of majority from the registered player | Act, s.70(6) |
| On discovering false information | Refuse registration, or cancel it immediately | Act, s.72(5) |
What the check is meant to establish
Regulation 85(4) says verification shall include official identification documents and confirmation that the individual is not a self-excluded person and is legally eligible to take part under the Act. That second half explains why age alone is not the whole check. Regulation 94(1) bars a child, a person excluded from gambling, a person without legal capacity and a person prohibited by any law.
The regulations do not list which documents count, so the precise list is for the operator's own published rules. The age side of the same checks is explained in the minimum age guide, and the exclusion side in how to self-exclude from online casinos.
Location verification and the account holder
Identity is not the only item in regulation 85(1). It also lists location verification, so a licensee has to establish where a person is taking part from, in addition to who they are and how old they are. The regulation does not describe the method, and the operator's own rules are the place to read how it is done.
Section 72(1) of the Act ties play to an account: a licensee shall not allow a person to take part as a player unless the person is registered as a player and holds an account with the licensee. The verified person is therefore the registered account holder, which is a practical reason to register in your own name with your own details.
What the rules say about your personal data
Handing over an identity document is a data protection matter as well. Regulation 96(1) says collection and processing of data during gambling operations shall comply with the Data Protection Act. Regulation 96(2) restricts collection to purposes directly related to the administration of the gambling operation, and regulation 96(3) bars use of the data for marketing without the prior consent of the participant.
Regulation 90 adds a limit on disclosure: a licensee shall not disclose the identity or personal information of a winner except with written consent, as required by law, or under a court order. Regulation 86 prohibits anonymous gambling unless the Authority approves it in consultation with the National Treasury, which is part of why a no-identity account is not a normal feature of a licensed service.
Check the operator before you upload anything
A verification request is a request for sensitive documents, so the order of events matters. First confirm that the brand and its domain appear on the Authority's list of licensed gaming companies, using how to check an online casino licence. The list on the regulator's page describes the 2025/26 trading period, so read it against the live page before relying on it.
| What you see | What the rules point to |
|---|---|
| Licensed brand asks for ID before the first deposit | Consistent with regulation 85(2) |
| Licensed brand asks you to confirm identity before paying a win | Consistent with regulation 85(3) |
| Site takes a deposit and plays with no identity or age question | Does not match regulation 85 for a licensee; check the register first |
| Site asks for documents but cannot be matched to the list | No licence-based protection can be assumed; do not send documents until the licence is confirmed |
| Brand uses your ID data for marketing without asking | Regulation 96(3) requires prior consent |
If verification is refused or delayed
A casino may hold a withdrawal while it completes the winner check. If a licensed operator seems to be delaying beyond what its own rules say, keep the messages and follow the steps in what to do when a casino withdrawal is not paid. Keep copies of what you submitted and when, because the records show which documents were sent.
The Authority's free line is 0800-723-770, and the options for support are on the responsible gambling page. Gambling is addictive: play responsibly, and only if you are 18+.
Questions and answers
Is identity verification at an online casino a legal requirement in Kenya?
Yes for a licensee. Regulation 85(1) of the Conduct of Gambling Operations Regulations, 2026 bars a licensee from letting a person take part in online gambling without an identity check, a location verification and an age assurance check. Section 72(3) of the Act separately requires proof of age of majority before registration.
When should the casino ask for my documents?
Regulation 85(2) places the checks before player account activation and before receipt of any wagering deposit. Regulation 85(3) adds a second check, the identity of a winner, before winnings are paid.
Which documents does the law name?
Regulation 85(4) says verification shall include official identification documents but does not list them. A casino may therefore set out in its own rules which documents it accepts, and you can ask it to show where those rules are published.
Can the casino use my identity details for marketing?
Regulation 96(3) says personal data collected shall not be used for any form of marketing without the prior consent of the participant. Regulation 96(2) limits collection to purposes directly related to administering the gambling operation.
What happens if I give false details?
Section 72(5) of the Act says a licensee that becomes aware of false information in registration shall not register the person, and shall immediately cancel an existing registration.
A site let me deposit without asking for any ID. Is that normal?
It does not match regulation 85 for a licensee. Check the operator against the GRA list of licensed gaming companies before sending documents or money, and treat a site that cannot be matched with caution.
Sources
- Gambling Control Act, 2025 (No. 14 of 2025), ss.70(6), 72, accessed 2026-10-12
- Gambling Control (Conduct of Gambling Operations) Regulations, 2026 (L.N. 112), r.85, r.86, r.90, r.94, r.96, r.98, accessed 2026-10-12
- Gambling Regulatory Authority of Kenya, Licensed gaming companies for the trading period 2025/26, accessed 2026-10-12