Betting apps in Kenya: how to tell a licensed app from a fake

What makes a betting app licensed in Kenya?

A betting app counts as licensed when the operator behind it holds a licence from the Gambling Regulatory Authority of Kenya and the app is that operator's platform. The quick version is to verify the app against a licensed operator in a few steps. This page explains why each of those checks exists and what else to look at.

The rule starts in section 28(1) of the Gambling Control Act, 2025. Nobody may offer a gambling activity or service in Kenya unless that activity or service is licensed under the Act, and section 98 makes operating any form of gambling without a valid licence an offence.

The regulator lists operators, not apps. Its published list names each company, its trading name, its licence numbers and its domain, so an app is licensed only through the line that belongs to its operator.

Section 67(1) of the Act provides three kinds of online licence: an online bookmaker's licence, an online lottery licence and an online casino licence. An app that takes sports bets, sells lottery entries or runs casino games needs an operator that holds the licence for that activity.

Section 36(3) gives you something to look for on the screen. A holder of an online gambling licence must display that licence on its online platform, so a licensed app, or the website it belongs to, should show it.

The Gambling Control (Conduct of Gambling Operations) Regulations, 2026, published as Legal Notice 112 on 30 June 2026, name the opposite case. Under regulation 102(2), an app that offers gambling without the licence or approval the law requires is an illegal gambling platform. The same words cover websites, digital devices and electronic systems.

Operators based outside Kenya get no shortcut. Section 79(1) allows a foreign-based operator an online licence only if it is registered in Kenya with a physical address here. Under section 79(3), a foreign-based company offering online gambling in Kenya without a licence faces a fine of up to fifty million shillings.

The Authority succeeded the Betting Control and Licensing Board under section 6(3) of the Act. A mention of the old Board on an app or website does not replace a line on the Authority's current list.

A licence also has limits as a signal. It means the operator may lawfully offer the licensed activity in Kenya; it does not mean the regulator vouches for any app that uses the operator's name, which is why the rest of this page is about matching the app to the operator.

Store listing or APK: where does the app come from?

A betting app reaches a phone in one of four ways. It comes from Google Play, from Apple's App Store, as an APK file from the operator's own website, or as an APK from a link someone forwarded.

Each route puts a different check between you and the operator. The table sets out who screens the app on each route and what you can still verify yourself.

The two store routes add screening before the app reaches you. Google's policy for real-money gambling apps requires the developer to complete an application process and to hold a valid gambling licence for each country where the app is distributed. Apple's Guideline 5.3.4 requires the necessary licensing and permissions in the locations where the app is used.

The APK routes skip that screening. When an operator offers an APK on its own website, the domain in the address bar is the one detail you can compare with the regulator's list.

An APK forwarded in a chat group gives you nothing to compare. That is the route where the warnings Android shows for a betting APK download carry the most weight, and where a clone is hardest to tell from the real thing.

Updates follow the route too. An app from a store updates through that store, while an APK installed by hand depends on whatever update channel the operator provides.

A mobile website is checked the same way as an APK download. The address in the browser should be the domain on the operator's line, because the list ties the licence to that domain and not to an icon on your home screen.

A store listing is a starting point, not proof. Both stores show a developer name, and reading it against the licence list is a job the listing leaves to you.

How do you tie an app to one line of the licence list?

The regulator publishes its list on gra.go.ke under the heading Licensed Gaming Companies for the Trading Period 2025/26. On 29 October 2026 it held 187 lines, numbered 1 to 188 because number 119 is skipped. The App check table of licensees and their domains reproduces every line that carries a domain.

The list has eight columns: No., Operators Name, Trading Name, BK, PG, PL, STATUS and DOMAINS. The column headed BK carries bookmaker licence numbers, and PG and PL sit beside it. The page does not expand any of the three abbreviations.

Matching works field by field, and every field has to land on the same line. Use these steps with the store listing or the download page open beside the list.

1. Read the developer name on the listing. It should be the company in the Operators Name column, or plainly the same business under its trading name.
2. Read the app name and look at the logo. They should match the Trading Name on that line.
3. Open the website field of the listing, or note the address an APK came from. The domain should be the one in the DOMAINS column of the same line.
4. Find the licence the app displays under section 36(3). Its number should appear in the BK, PG or PL column of that line.
5. Check that the STATUS column reads Renewal or New and that the heading names the current trading period.

The table below shows the last line of the list exactly as published, beside the part of an app each column should match. It is quoted only to show the format and says nothing about that operator.

One match is never enough. A clone can copy a trading name and a logo, but it cannot add itself to the regulator's list, so the developer, the domain and the licence number must all point to one line.

Sixty-two lines carry Nil in the DOMAINS column. An app claiming one of those operators cannot be matched to a domain from the list, so the check rests on the developer name, the licence number and a call to the Authority's toll-free line, 0800-723-770, as shown on the regulator's website.

A mismatch tells you something different depending on where it falls. A developer name that fits no line points to an operator without a licence, while a matching name that leads to another domain points to a clone steering you to a different site.

Both cases leave you with an app you cannot tie to a licence. Treat it as the illegal gambling platform that regulation 102(2) describes until the Authority tells you otherwise.

The heading also names a trading period, 2025/26. A check made against an older version of the list may no longer hold, so repeat it when the period changes.

What do Android and Play Protect warn about?

Android treats an app from outside a trusted first-party store as an unknown app. Its developer documentation says Android blocks such installs until the user opts in to allowing apps from other sources.

On Android 8.0 (API level 26) and higher, that opt-in is given per source on the Install unknown apps settings screen. The browser or chat app that downloaded the APK has to be allowed before the file installs. On Android 7.1.1 or lower, the setting was a single Unknown sources switch or permission for one install.

Google Play Protect is the second layer. Google's help page says Play Protect is on by default and recommends keeping it on.

The same page lists what Play Protect does. It runs a safety check on Play Store apps before you download them, checks the device for potentially harmful apps from other sources, warns you about them and may deactivate or remove them.

For apps installed from outside the Play Store, Play Protect may ask to send the unknown app to Google. Google also says it may stop an unverified app from installing when it uses sensitive device permissions that scammers commonly target to commit financial fraud.

None of these warnings proves an app is fake, and silence does not prove it is licensed. They tell you the file came from outside the store, while the licence list tells you whether the company behind it may offer gambling in Kenya.

Switching protections off to force an install removes the only automatic check on a sideloaded file. If the instructions that came with a betting APK tell you to turn Play Protect off, take that as a reason to stop.

What do Google Play and the App Store require of betting apps?

Kenya is on Google's list of countries where real-money gambling apps may be distributed. Google's country page allows four product types here: online casino games, sports betting, horse racing where it is regulated and licensed separately from sports betting, and lotteries.

Google's gambling policy sets the conditions. The developer must complete Google's application process, hold a valid gambling licence for each country or territory where the app is distributed and offer nothing beyond the scope of that licence.

The app itself must keep under-age users out and block access from places its licence does not cover. It must be free to download, must not use Google Play In-app Billing and must carry an AO (Adult Only) rating or the IARC equivalent.

Both the app and its listing must show information about responsible gambling. Google's country page adds that the statement must appear in the description text of the listing and inside the app, with local contact details for third-party problem gambling support.

Apple sets its rules in the App Review Guidelines. Guideline 5.3.4 says apps offering real money gaming, such as sports betting, casino games or lotteries, must have the necessary licensing and permissions where the app is used, must be geo-restricted to those locations and must be free on the App Store.

Guideline 5.3.3 bars in-app purchase as a way to buy credit or currency for real money gaming. Guideline 5.1.1(ix) says apps in highly regulated fields, gambling among them, should be submitted by the legal entity that provides the service rather than by an individual developer.

Guideline 4.1 covers copycats. Submitting an app that impersonates another app or service breaches Apple's Developer Code of Conduct, and a developer may not use another developer's icon, brand or product name in an app's icon or name without approval.

These rules turn a listing into evidence. A developer name that is a private person, a price tag, or betting credit sold through the store would each break a store rule, and each is a reason to check the licence list before you install.

A listing that passes these tests still has to match the regulator's line. The stores require a licence, but only the Authority's list tells you which companies hold one.

Which permissions make sense for a betting app?

A permission request is easier to judge when you know what the operator must do by law. Licensed operators have to confirm where you are, who you are and how old you are, and those duties explain most of what a genuine app asks for.

Location comes first. Regulation 41(c) of L.N. 112 requires online gambling systems to use geo-location technology able to block access from prohibited locations, and regulation 82 requires location verification before anyone gambles online.

The camera follows from identity checks. Regulation 82 also requires a mandatory identity check and an age assurance check, and section 72(3) of the Act requires proof of age of majority before a player is registered, so a request to photograph an identity document fits those duties.

Notifications play no part in any of the checks in regulation 82. Refusing them does not stand in the way of identity, location or age verification.

Some requests have no link to these duties at all. None of the regulation 82 checks involves reading your contacts, your SMS inbox or your call log, so an app that will not open without them is asking for more than the law explains.

Each request, and what Android says it lets an app do, is covered in the guide to what each betting app permission means. Use it when a prompt appears that the table does not cover.

Identity checks, deposits and winnings

A licensed app cannot let you bet before it knows who you are. Regulation 82 of L.N. 112 says no person may take part in online gambling without a mandatory identity check, location verification and an age assurance check, done before the account is activated and before the first deposit.

Gambling is for adults of the age of majority, which in Kenya is eighteen. Regulation 92 of the same Regulations treats persons under the age of eighteen years as minors who must be kept out of gambling and its promotion.

Regulation 83 closes two more gaps. Anonymous gambling is prohibited, and so is the use of virtual assets such as crypto for gambling or withdrawals, unless the Authority approves.

An app that takes deposits with no identity step, or invites crypto deposits, is behaving in a way the Regulations do not allow a licensee to behave. That tells you more than any logo.

Deposits follow the Act. Section 73(4) lists the ways a licensee may receive a player's money: a debit card, an electronic funds transfer, a mobile money transfer, a cash deposit or another method the Authority approves.

Section 73(3) adds that a wager may be accepted only when the player's account holds enough approved funds to cover it. Section 72(7) bars a licensee from helping a player bet by advancing credit, allowing credit cards or meeting a player's third-party costs.

Section 29(b) requires every licensee to keep an account with an authorised financial institution registered in Kenya, into which it pays all money from the licensed activity. A request to send your deposit to a private person or a personal mobile number does not fit that pattern.

Before you enter your M-PESA PIN, check who the payment is going to and compare the name with the licensee's line. If they differ, do not complete the payment.

A licensed app also has to give you control tools. Regulation 84 of L.N. 112 requires real-time tools including daily, weekly and monthly deposit limits, loss, session and expenditure limits, reality-check pop-ups and a self-exclusion option of at least 24 hours linked to the national register.

Winnings have rules too. Section 70(1) requires a licensee to credit a monetary prize won online to the player's account within two days.

The Third Schedule to L.N. 112 sets payment tiers. Prizes up to KES 500,000 are paid automatically and immediately to the registered mobile money wallet or gambling account after basic identity verification, while larger prizes need more checks, up to full identity verification and enhanced anti-money-laundering checks above KES 5,000,000.

None of the tiers asks the player to pay anything before a prize is released. A demand for a fee to unlock winnings does not come from these rules.

Disputes with a licensed app have a route as well. A dispute goes first to the operator's customer care, and section 80 of the Act lets a party to an online gambling dispute appeal to the Gambling Appeals Tribunal within fourteen days of the dispute.

The signs of a fake, and what to do next

No single sign settles the question, but a pattern does. The table lines up each check from this page with what a licensed app should show and what should make you stop.

The guide to the signs of a fake betting app in Kenya takes each warning sign further. Read it alongside the table when an app passes some checks and fails others.

The people behind an unlicensed app face penalties. For a second or later offence of operating gambling without a valid licence, section 98 of the Act sets a fine of up to five million shillings, up to five years in prison, or both.

Regulation 102(1) reaches the services around such an app. Hosting it, registering its domain, processing its payments or giving it technical support is an offence, which is why the domain and the payment details are the most useful parts of any report.

If you find a fake, stop using it and do not enter your ID details or M-PESA PIN again. Then follow the steps to report a fake betting app in Kenya to the regulator, the app store and your mobile money provider.

If you already sent money, keep every confirmation message. They show where the money went, and any report needs that detail.