New betting site red flags: what to watch in your first month

A new betting site has no track record, so its first weeks are when gaps show. The flags below follow the order you meet them: before you register, when you deposit, while you bet and when you withdraw. Each one is tied to a section of the Gambling Control Act, 2025 or a regulation made under it in 2026.

Start with the licence itself. The guide on how to check a new betting site is licensed covers the regulator's list, the licence number and the domain, so this page goes on to what comes after.

Before you register: is there a licence line?

Section 36(3) of the Act requires an online licensee to display its licence on its platform. No licence line at all is the first flag. A number that does not appear on the regulator's list is the same flag in another form.

Section 28(1) bars anyone from offering gambling that is not licensed under the Act. Under section 98, a first offence of operating without a valid licence carries a fine of up to KES 3,000,000, prison of up to three years, or both. A repeat offence rises to KES 5,000,000 and five years.

Adverts give a second clue. Regulation 8(c) of L.N. 114 requires every approved gambling advert to show the licence number and the words "authorized and regulated by the Gambling Regulatory Authority". An advert that carries neither tells you something about the site behind it.

Before you register: who is the company?

Read the terms for the company's name and address. Section 79(1) allows a foreign-based operator an online licence only if it is registered in Kenya and has a physical address registered in Kenya. Terms that name only an offshore company with an overseas address are a flag.

Section 79(3) makes it an offence for a foreign operator to offer online gambling in Kenya without a licence. The fine reaches KES 2,000,000 or two years in prison for a natural person, and KES 50,000,000 for a corporate person. The law on foreign betting sites that target Kenya explains why such sites leave you without local protection.

Foreign operators that hold a Kenyan licence to serve other markets must keep Kenyan residents out. Regulation 7(1) of L.N. 113 requires IP geo-blocking and identity verification for that purpose. Section 68(8) of the Act adds a simple test for any online operator: it must keep a customer care centre within Kenya.

When you deposit: where does the money go?

Section 29(b) requires a licensee to pay all money from its licensed activity into an account with an authorised financial institution registered in Kenya. Regulation 3(3)(b) of L.N. 112 requires a new licensee to declare every paybill or other payment mechanism to the Authority before it starts trading. Regulation 4(2)(e) puts paybill numbers, shortcodes and USSD numbers into the terms the Authority approves.

So a deposit should go through a business channel named in the terms. Safaricom describes Paybill as a payment collection service that lets businesses collect money from customers through M-PESA. A request to send money to a personal phone number, or to an agent who promises to load your account, is a red flag.

Two more payment rules apply. Regulation 83 of L.N. 112 prohibits anonymous gambling and the use of virtual assets for gambling or withdrawal unless the Authority approves. Section 72(7) of the Act bars a licensee from helping you bet by advancing credit or accepting credit cards.

Your M-PESA PIN stays with you. A Paybill payment is one you start and finish on your own phone, so a site agent asking for the PIN is a flag on its own.

When you deposit: are the limits tools there?

Regulation 84 of L.N. 112 requires every licensee to give players real-time tools to control their gambling. They include daily, weekly and monthly deposit limits, loss, session and expenditure limits, and pop-up reality checks. A self-exclusion option of at least twenty-four hours, linked to the national self-exclusion register, completes the list.

Look for these in the account settings before you put money in. A site that offers none of them, or hides them behind a request to customer care, is missing a duty in the Regulations as gazetted. Regulation 67(3) separately requires a real-time self-exclusion mechanism on every online platform.

Identity checks belong at this stage too. Regulation 82 bars online gambling without an identity check, location verification and an age check, done before the account is activated and before any deposit is received. Section 72(3) of the Act requires proof of age of majority before registration; the guide to KYC at a new betting site lists what may be asked.

While you bet: are the terms clear and fixed?

Regulation 23(1) of L.N. 112 requires a licensee to display the odds, rules and terms for each bet clearly. Regulation 23(2) bars changing the terms of a bet after acceptance, except as the Act and the Regulations permit. Terms that are missing, will not open, or differ between the app and the website are a flag.

Regulation 4(1) requires a licensee to submit its terms and conditions to the Authority for approval. Under regulation 4(2), those terms must cover the method of paying winnings, account suspension and closure, complaints and dispute resolution, and responsible gambling measures. If you cannot find these points, ask customer care to show you where they are, in writing.

When you withdraw: how fast is the payout?

Section 70(1) of the Act gives a licensee two days to credit a monetary online win to your account. The Third Schedule to L.N. 112 then sets payment tiers. Prizes up to KES 500,000 are paid automatically and immediately to your registered mobile money wallet or gambling account, after basic identity verification.

Larger prizes have longer windows. Up to KES 5,000,000 is paid within five working days, up to KES 50,000,000 within fourteen working days after full verification, and jackpot prizes above that within thirty working days after verification. A small win held for days with no reason given is the flag to record.

Regulation 82(3) does allow a licensee to verify a winner's identity before payment, so one document check at withdrawal is lawful. Repeated requests with no end, or silence after you send what was asked, are the warning sign.

Regulation 101 of L.N. 112 sets a penalty once winnings stay unpaid for fourteen days. The licensee owes the Authority 5% of the total winnings. It must also pay you the outstanding amount plus interest of 5% per day from the end of those fourteen days, for the next twenty-one days, until payment in full.

Illustrative example: winnings of KES 20,000 are still unpaid after fourteen days. The penalty under regulation 101(1) is 5% of KES 20,000, which is KES 1,000, and it goes to the Authority, not to you. Your claim stays at the KES 20,000 plus the interest set by regulation 101(2).

Red flags and the law at a glance

What to do when you see a flag

Stop before the next deposit. Take screenshots of the licence line, the terms and any payment instructions, and keep every M-PESA confirmation message.

Raise the issue with the site's customer care in writing. Under regulation 9(2)(e) of L.N. 112, a matter unresolved after seventy-two hours, or one you ask in writing to escalate, must be referred to the Authority. The steps are in the guide to the complaints process a new licensee must offer.

If the site has no licence at all, report it. The guide on how to report an unlicensed betting site lists the channels, and the regulator's website shows a toll-free number, 0800-723-770.

A licensed site can also lose its licence later. Section 76(2) of the Act requires money held for players to cover their balances at all times, and the guide on what happens if a new site loses its licence explains the steps for your account.