What does Kenyan law require of an online casino?

An online casino needs a licence from the Gambling Regulatory Authority, a Kenyan company with at least thirty per cent Kenyan shareholding, an approved gambling control system, a security deposit, a customer care centre in Kenya and registered, age-verified players. The Gambling Control Act, 2025 and the 2026 regulations set these duties out section by section.

By Online Casino Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-04

The short version, with section numbers

The Gambling Control Act, 2025 (No. 14 of 2025) was assented to on 7 August 2025 and commenced on 26 August 2025. It created the Gambling Regulatory Authority of Kenya and repealed the Betting, Lotteries and Gaming Act (s.120). Part VIII of the Act, sections 67 to 80, is about online gambling.

The table below lists the main duties from the player's point of view. Whether a particular company holds a licence is a separate question, answered by checking the licence against the regulator's list.

"Operations Regulations" here means the Gambling Control (Conduct of Gambling Operations) Regulations, 2026. "Licensing Regulations" means the Gambling Control (Licensing) Regulations, 2026.

Who may hold the licence

Section 29 of the Act allows a licence only to a body corporate in which a minimum of thirty per cent of shares are held by Kenyan citizens, and which keeps an account with an authorised financial institution registered in Kenya for all monies relating to the licensed activity.

For a foreign company, section 79(1) adds that an online gambling licence is issued only where the operator is registered in Kenya, has a physical address registered in Kenya and meets the requirements prescribed in regulations. A foreign based operator that provides online gambling services in Kenya without a licence commits an offence under section 79(3), with a fine for a corporate person not exceeding fifty million shillings.

The licence itself is personal to the holder. The Act's definition of "licence" says it is assigned to a specific person and may not be re-assigned to another person.

What the Authority looks at before it grants one

An applicant must submit a proposed gambling control system (s.67(2)). Under section 68(2) the Authority shall not approve the system unless it provides for eight things: online security of information, safety against criminal activities, an online payment system, protection against under age gambling, protection against vulnerability in gambling, awareness and education, responsible advertising and data protection measures under the Data Protection Act.

Regulation 11(2) of the Licensing Regulations lists what goes with the application, including a tax compliance certificate from the Kenya Revenue Authority, proof of gambling capital, evidence of anti-money laundering compliance and the proposed gambling platform, domain name and games provider. Regulation 20(6) says all applications shall be considered within thirty days of receipt.

The fees are in the Second Schedule to the Licensing Regulations. For an online casino the application fee is KES 5,000,000, the licence fee KES 50,000,000 and the annual operating licence fee KES 5,000,000. These are costs of the operator, not of the player, but they show the scale of commitment the law expects.

How the platform itself must work

Regulation 41 of the Operations Regulations sets minimum standards for an online gambling system. They include an approved domain name, accurate and secure recording of all transactions, geo-location technology able to block access from prohibited locations, a tamper evident audit log and real-time monitoring by the Authority. Player funds must be segregated from operational funds in separately maintained accounts.

Regulation 42 requires personal and financial data of a player to be encrypted in transit and at rest. It also requires player data to be stored and processed on servers located within Kenya unless the Authority has granted a prior written exemption.

Section 68(5) of the Act directs the Authority to establish a framework for real time monitoring of casinos and online gambling. Section 68(4) says failure to comply with the approved gambling control system shall lead to revocation of the licence.

Fair games and visible rules

Regulation 45(1) of the Operations Regulations requires game rules to be clearly displayed on the approved platform before a player places any wager. Regulation 45(2) requires the random number generator used for games of chance to be certified by the Authority or its approved agent.

Regulation 20(2) requires a licensee to display clearly the rules of games, odds, house edge and average return to the player, and regulation 20(3) extends that to online gambling. The house edge is the share of stakes a game is built to keep over a long run of play. Displaying it does not remove it.

Players, accounts and money

A licensee shall not let anyone play unless the person is registered and holds an account (s.72(1)). Proof of age of majority is required before registration (s.72(3)), and regulation 85(1) of the Operations Regulations requires an identity check, location verification and an age assurance check before any online gambling.

The licensee must give the player all the rules of its authorised games and the particulars of any processing fee (s.72(6)). It may receive funds by debit card, electronic funds transfer, mobile money transfer, cash deposit or another method approved by the Authority (s.73(4)).

The rules on winnings and balances are detailed enough to need their own page: online casino payout rules in Kenya.

Inducements and bonuses: what the Act says

Section 74(1) says a licensee shall not provide credit, make an offer designed to induce persons to participate or increase their participation in licensed activities, or participate in arrangements for inducing persons to gamble. A breach is an offence with a fine not exceeding five million shillings or imprisonment not exceeding five years, or both (s.74(2)).

Section 74(3) then says nothing in the section limits an operator from offering free bets and bonus bets in the ordinary course of business. The Act does not define that phrase. This site does not list or describe any operator's offers.

Protection tools the casino must provide

Regulation 87 of the Operations Regulations requires accessible, real-time tools: deposit limits on a daily, weekly and monthly basis; loss, session and expenditure limits; reality checks that show the duration of play; and an easy option for self-exclusion for a period of at least twenty-four hours. The tools must be linked to the national self-exclusion register.

The procedure for stopping altogether is covered in how to self-exclude from online casinos in Kenya.

When a duty is broken

The Authority may investigate a licensee on its own motion or upon information from any person (s.37). Regulation 26 of the Licensing Regulations lists grounds for suspending or revoking a licence, among them failure to comply with licence conditions and consistent failure to protect the confidentiality of data.

A player does not enforce these duties directly. What a player can do is use the operator's customer care centre and then the Authority, as set out in how to complain about an online casino in Kenya.