AML for Betting and Gaming in Kenya: The Gambling Control Act 2025 and the 2026 Regulations

Short answer: Since 26 August 2025 the Gambling Regulatory Authority of Kenya (GRA) has replaced the Betting Control and Licensing Board (BCLB) as the gambling sector's supervisory body under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA). Regulations published on 29 June and 2 July 2026 require every licensee to run anti-money laundering (AML) controls, verify every punter to the POCAMLA know-your-customer (KYC) standard, report suspicious activity to the Authority within 24 hours, and keep player data on servers in Kenya unless the Authority grants an exemption. Casinos, including online casinos, are also POCAMLA reporting institutions with full duties to the Financial Reporting Centre (FRC); whether bookmakers are is unsettled.

Written for compliance teams, money laundering reporting officers (MLROs) and boards at casinos, bookmakers, online operators, lotteries and prize-competition promoters, this is a summary as at 19 October 2026, not legal advice; the Act, the 2026 Regulations, POCAMLA and the regulators' own texts are authoritative.

---

Who regulates gambling AML in Kenya now

The Gambling Control Act, 2025 (Act No. 14 of 2025) commenced on 26 August 2025 and repealed the Betting, Lotteries and Gaming Act. The Authority is "the successor of the Betting Control and Licensing Board" (s.6(3)), and old licences stay valid until they expire (s.122). Section 123(1) put the Authority in the BCLB's place in POCAMLA's First Schedule of supervisory bodies, and the FRC supervises every reporting institution (POCAMLA s.36A(1)). The FRC's casino guidance and compliance page still name the BCLB.

Where the AML text sits. The Act's AML clauses are in section 4, "Functions of the National Government", not among the Authority's functions. They cover "anti-money laundering risk-based inspections" (s.4(1)(g)) and, citing POCAMLA sections 2A and 36A to 36C, supervision of "the reporting institutions licensed under this Act" (s.4(1)(h)).

The old AML powers are saved for now. Section 121(6)(b) keeps the repealed Act's AML powers and its "penalties for violations relating to money laundering and terrorism financing" in force "until new provisions are enacted". The saved penalty appears to be up to KES 5 million for a legal person, KES 1 million for a natural person and KES 100,000 a day for a continuing breach. No new provisions had been found by 19 October 2026.

No gambling AML guidelines yet. Section 11 requires the Cabinet Secretary to prescribe guidelines, including on "safety measures against criminal activities, anti-money laundering and terrorism", but none were found, nor any AML guidance from the Authority. The only sector guidance is the FRC's October 2023 guidance to casinos, issued with FRC Circular No. 8 of 2023.

As of the FATF's June 2026 plenary, Kenya remained under increased monitoring, with risk-based supervision among the items still to complete.

Who must report to the FRC: casinos are certain, bookmakers are not

The Act borrows POCAMLA's definition of a reporting institution (s.2). POCAMLA names "casinos (including internet casinos)" and has no category for bookmakers, betting, lotteries or prize competitions; no Cabinet Secretary declaration adding betting was found.

Casinos, land-based and online, are certain. FRC Circular No. 8 of 2023 treats casinos, including internet casinos, as designated reporting institutions. Under LN 112 reg 3(3)(j), a casino's notice of commencement must "prove that the company has been registered with the Financial Reporting Center". The FRC inspected 8 casinos in 2023 and 13 in 2024.

Bookmakers and other licensees are unsettled. For bookmakers, online sports betting, lotteries, totalisators, pool betting and prize competitions, the texts point both ways:

No FRC or Authority statement settling the point was found. Ask both in writing, describing each licence class and product, and keep the answers on file. Either way, the Authority's AML and KYC rules below bind every licensee.

Foreign-based operators licensed to serve only players outside Kenya "shall be deemed as a 'Reporting Institution' under the respective Anti-Money Laundering laws of Kenya and the host jurisdiction" (LN 113 reg 9). No text found addresses whether a Legal Notice can extend POCAMLA's definition this way.

What the 2026 Regulations require of every licensee

Six Regulations under the Act were published in the Kenya Gazette, LN 111 to 115 of 2026 on 29 June 2026 and LN 116 (the National Lottery) on 2 July 2026. None is a standalone AML regulation; most AML duties sit in LN 112, the Conduct of Gambling Operations Regulations.

AML controls and punter KYC

Regulation 95 of LN 112 requires every licensee to "develop and implement internal control systems to detect and prevent money laundering, terrorism financing, fraud, and other criminal conduct" and to train staff on detecting and reporting suspicious activity. Regulation 95(2) adds:

"In addition to any other requirement under these regulations, it shall be mandatory for a licensee to verify the identity of all punters in accordance with know your customer requirements under the Proceeds of Crime and Anti-Money Laundering Act (Cap. 59A)."

So POCAMLA-standard KYC applies at every licensee, whether or not it is a reporting institution. LN 116 sets similar duties for the National Lottery's operator, plus seven-year transaction records (reg 64).

Suspicious activity reports to the Authority within 24 hours

Regulation 90(1): "A licensee shall report to the Authority any suspicious activity, transaction and any fraud arising in their operations within twenty-four hours of becoming aware." Regulation 88(2) adds a 24-hour report of fraud and malpractice.

This report goes to the Authority, not the FRC. Nothing in the Regulations says it replaces a suspicious transaction report (STR) to the FRC, so a casino files both.

Identity checks, payments and payouts

• Players must register, hold an account and prove they are of age (Act s.72). Online, reg 82 requires identity, location and age checks from "reliable, independent and electronically verifiable data sources" before account activation and any deposit; winners are verified before payment.
• Anonymous gambling and virtual assets are banned unless the Authority approves (reg 83).
• Funds may come by debit card, electronic funds transfer, mobile money, cash or another approved method (s.73(4)); credit is banned (s.74). Paybill, shortcode and USSD numbers must be declared, and payment service providers need the Authority's approval (LN 112 regs 3, 4 and 30(3)).
• Player money sits in a bank account or mobile money, apart from operational funds (s.76; reg 41(f)). See our mobile money reporting guide.

Online prizes are paid in tiers (LN 112, Third Schedule):

Licensing and vetting

Most licence applications under LN 111 must include "evidence of compliance with anti-money laundering and counter-terrorism financing obligations, including internal policies, procedures, and staff training records"; the land-based bookmaker and the software or platform licences do not. At vetting, the Authority assesses the source of funds and the "anti-money laundering and counter-terrorism financing frameworks" behind directors, shareholders, beneficial owners and key employees (LN 112 reg 61(4)).

Player data stays in Kenya

Regulation 42(2) of LN 112: "The storage and processing of player data shall take place on servers located within Kenya unless otherwise granted prior written exemption or authorization by the Authority." No text found says whether an AML system holding player data is caught, so ask the Authority before placing one on servers outside Kenya.

POCAMLA duties for casinos and other reporting institutions

A casino, and any licensee that turns out to be a reporting institution, carries the full POCAMLA programme (see our POCAMLA and POTA guide):

• Register with the FRC on goAML. Registration is mandatory and done only through goAML; failing to register is an offence.
• Appoint a management-level MLRO, not the chief executive or internal auditor, and notify the FRC and the supervisory body of changes within 14 days.
• Assess risk in a documented assessment updated at least every two years, with a separate assessment before launching new products or technologies.
• Apply due diligence. The FRC's casino guidance calls for customer due diligence (CDD) at first contact and on suspicion, with beneficial owners identified and no anonymous accounts. Foreign politically exposed persons (PEPs) always get enhanced measures, domestic PEPs where the risk is higher.
• Screen for sanctions against the UN lists and Kenya's Domestic List, and freeze and report within 24 hours. The FRC's July 2025 sanctions guidance gives a casino example: freeze a designated patron's chips, balances and pending withdrawals.
• Keep records for at least seven years, file the annual compliance report to the FRC by 31 January, and keep an independent audit function.

Two reporting lines run side by side:

The FRC can fine a company up to KES 25 million and an individual up to KES 5 million, plus KES 10,000 a day for up to 180 days. In November 2025 it fined an unnamed casino KES 200,000 for not fixing inspection findings on AML policies, CDD and enhanced due diligence, and a missing independent audit.

Risk areas the regulators point to

Most of the published material covers casinos:

• Channels. The FRC's casino guidance flags cash, mobile money and casino wallets as transaction risks, and peer-to-peer gambling as a product risk.
• Play patterns. The FRC's May 2025 STR guidance lists about 30 casino indicators, including cashing out with little or no play, third parties buying chips, buy-ins just under thresholds and activity that does not fit the customer's profile. See our STR indicator library.
• Ownership. The 2021 National Risk Assessment rated sports-betting risk low for individual bettors but high for betting-firm owners, citing mainly foreign ownership and possible commingling of proceeds.
• Fraud proceeds. A case in the FRC's 2024 typologies report traced pension-fraud funds to mobile wallets, some belonging to betting companies.

The FRC's Annual Report 2024 found that not all casino MLROs were competent. It also found gaps in sanctions screening, STR escalation, monitoring and training, and risk assessments that ignored PEP and high-risk-country exposure. Its figures show casinos filing 21 STRs in 2023 and none in 2024, though the table's subtotals do not all add up. Ratings also differ: the 2023 national risk assessment update rated casino threat Low, while the FRC's February 2025 risk guidance says Medium in its text and Medium-high in a table. Name the one you rely on.

Compliance checklist

1. Get the Authority's and the FRC's written position on whether you are a POCAMLA reporting institution.
2. Casinos, land-based or online: confirm your goAML registration and keep the proof.
3. Adopt AML internal controls that meet LN 112 reg 95, with documented policies, procedures and staff training.
4. Verify every punter's identity to the POCAMLA standard; online, also check location and age before account activation and any deposit.
5. Apply the prize-tier checks: enhanced AML checks and bank transfer only for online prizes above KES 5 million.
6. Report suspicious activity and fraud to the Authority within 24 hours; reporting institutions also file STRs to the FRC within two days and CTRs at US$15,000 or more.
7. Screen players against the UN lists and Kenya's Domestic List; freeze and report within 24 hours.
8. Declare every paybill, shortcode and USSD number, and keep player funds separate.
9. Keep player data on servers in Kenya unless the Authority grants a written exemption.
10. Keep AML records for at least seven years; reporting institutions file the FRC annual compliance report by 31 January.

Where Creodata fits

Creodata's AML compliance software is licensed by module. The Starter tier covers sanctions, PEP and adverse-media screening, a six-factor customer risk rating with four-eyes (dual-approval) overrides, and case management basics; the Growth tier adds transaction monitoring, STR and CTR reporting, and ingestion connectors. Every decision is kept in an append-only audit log, and reports hand off to the Creodata goAML Reporting Platform for the FRC filing. It runs on Microsoft Azure or on-premises in your own data centre with the same features. For a gambling licensee, the on-premises option keeps player data on your own servers; a cloud deployment holding player data would need the Authority's prior written exemption under regulation 42(2), because Azure has no region in Kenya.

Frequently asked questions

What is the Gambling Control Act 2025 in Kenya?

It is Act No. 14 of 2025, in force since 26 August 2025. It replaced the Betting, Lotteries and Gaming Act and the BCLB, and six Regulations published in June and July 2026 fill in the detail.

Is the Gambling Regulatory Authority the AML supervisor for betting in Kenya?

Yes. Since 26 August 2025 the Authority has been the gambling supervisory body in POCAMLA's First Schedule, in place of the BCLB. The FRC also supervises every reporting institution.

Do betting companies in Kenya have to register with the FRC?

Casinos, including online casinos, must. For bookmakers the texts point both ways and no regulator statement settles it, so get the Authority's and the FRC's written position. The Authority's AML, KYC and 24-hour reporting rules apply either way.

Are casinos reporting institutions under POCAMLA?

Yes. POCAMLA names "casinos (including internet casinos)". They register on goAML, file STRs within two days and CTRs at US$15,000 or more, screen for sanctions and keep records for at least seven years.

How quickly must a betting company report suspicious activity in Kenya?

Within 24 hours of becoming aware, to the Authority (LN 112 reg 90). A reporting institution such as a casino also files an STR to the FRC within two days after the suspicion arose.

Can a gambling operator in Kenya store player data in the cloud?

Only on servers in Kenya, unless the Authority grants a prior written exemption (LN 112 reg 42(2)). Microsoft Azure has no region in Kenya, so an Azure-hosted system holding player data would need that exemption.

---

See how Creodata's AML compliance software supports punter screening, risk rating and FRC reporting for casinos and betting operators: book a demo.