KYC at a new betting site in Kenya: what you may be asked, when, and what to refuse

KYC stands for "know your customer". At a Kenyan betting site it means the checks the operator runs on who you are, how old you are and where you are before it lets you play. These checks are a legal duty from a licensee's first day, alongside the other duties set out in what a newly licensed bookmaker must have.

This guide explains what the law requires, when the checks should happen, what a site may ask you for, and the few things no site should ever ask for.

What does the law require a betting site to check?

Section 72(1) of the Gambling Control Act, 2025 lets a person play only if registered as a player and holding an account with that licensee. Section 72(3) requires the operator to obtain proof of age of majority before it registers anyone. Section 72(2) adds a duty to keep mechanisms that stop a child being registered.

Gambling is for adults of the age of majority, which in Kenya is eighteen. The Conduct of Gambling Operations Regulations, 2026 (Legal Notice No. 112) treat persons under eighteen as minors in regulation 92(1)(c).

Regulation 82(1) of L.N. 112 then names three checks for online play: an identity check, location verification and an age assurance check. Regulation 82(4) says verification includes official identification documents and confirmation that you are not self-excluded and are legally eligible to gamble under the Act.

When should the checks happen?

Regulation 82(2) fixes the order. The site must verify you through reliable, independent and electronically verifiable data sources before it activates your account and before it receives any wagering deposit.

A second check comes at payout. Regulation 82(3) requires the licensee to verify the identity of any winner before paying winnings, and section 70(6) of the Act requires proof of age of majority before a prize is remitted.

Regulation 82 sets the sequence but no time limit for finishing the checks. A site that takes your deposit first and asks for ID only when you try to withdraw has run the steps in the reverse of the order regulation 82(2) sets.

What may a site reasonably ask you for?

Regulation 82(4) speaks of "official identification documents" without listing them. Elsewhere the same Regulations name a national identity card or passport, for example on the self-exclusion request form (Form 1 in the First Schedule). Expect one of those, plus the details that match it, such as your full name and date of birth.

The location check is a legal step too. Regulation 82(1) requires location verification, and regulation 41(c) requires an online platform to use geo-location technology that blocks access from prohibited locations.

A site may also ask how you will fund the account. Section 73(4) of the Act lists debit card, electronic funds transfer, mobile money, cash deposits and other methods the Authority approves. Regulation 95(2) of L.N. 112 makes it mandatory to verify every punter's identity under the know-your-customer requirements of the Proceeds of Crime and Anti-Money Laundering Act, so questions about large or unusual payments can be lawful.

What a site may collect has an outer limit. Regulation 93 of L.N. 112 requires data collection to comply with the Data Protection Act, confines it to purposes directly related to running the gambling operation, and bars its use for marketing without your prior consent.

Why do bigger wins bring more checks?

The Third Schedule to L.N. 112 links the depth of verification to the size of an online prize. Small prizes need only basic identity verification, while the largest call for full verification and enhanced anti-money laundering checks.

The general provisions of the same schedule add that no prize is paid without verification of lawful ticket ownership. If a site asks for a video call before a large payout, that step appears in the schedule; a demand for your PIN does not.

What should a betting site never ask for?

The first is your M-Pesa PIN. On Safaricom's Paybill service you enter the business number, the account number and the amount, then approve the payment with your PIN on your own phone.

Safaricom's Paybill page notes that the M-PESA PIN authenticates Paybill payments and reminds customers, in Swahili, that the PIN is their secret. Its fraud-awareness page says Safaricom's own staff will never ask you to share your M-PESA PIN, SIM passcodes or password.

A betting site has even less reason to ask. If you have shared a PIN, Safaricom's advice is to change it immediately, and suspicious messages can be forwarded to 333.

Three other requests also fall outside the rules:

• A credit card. Section 72(7) bars a licensee from helping you bet through credit cards or advanced credit.
• Crypto deposits or an anonymous account. Regulation 83 of L.N. 112 prohibits anonymous gambling and the use of virtual assets for gambling or withdrawal unless the Authority approves.
• Passwords or one-time codes for your phone line, bank or mobile money wallet. Regulation 82 runs on documents and verifiable data, so it gives a site no reason to hold them.

How must a site handle the data you give it?

Regulation 42(1) of L.N. 112 requires a licensee to encrypt every player's personal and financial data, both in transit and at rest. Regulation 42(2) requires player data to be stored and processed on servers located in Kenya, unless the Authority has given prior written exemption.

The Data Protection Act, 2019 adds rights that apply to any data controller. Section 26 gives you the right to be told how your data is used, to access it, to object to processing, and to have false or misleading data corrected or deleted. Section 25(h) bars transfer of personal data outside Kenya without proof of adequate safeguards or your consent.

The Office of the Data Protection Commissioner publishes a searchable register of data handlers that shows whether an organisation's registration is active, expired or deregistered. You can look up the operator's company name there before you upload documents.

A licensee that fails on data also puts its licence at risk. Regulation 26(1)(g) of L.N. 111 lists a consistent failure to protect the confidentiality of data as a ground for suspension or revocation. Regulation 87 of L.N. 112 bars disclosure of a winner's identity without written consent, a legal requirement or a court order.

What can you do if a request looks wrong?

Stop before you send anything. Compare the site with its line on the regulator's list, following the steps to check that a new betting site is licensed.

A request for a PIN, a credit card or crypto is among the warning signs in new betting site red flags. If the site turns out to be unlicensed, you can report the unlicensed betting site to the Authority, whose toll-free line is 0800-723-770, as shown on the regulator's website.

For misuse of your personal data, section 56 of the Data Protection Act lets you complain to the Data Commissioner orally or in writing, and the complaint must be concluded within ninety days. If you want a break from gambling, self-exclusion and limit tools are explained on the help and limits page.