Can the regulator see your betting account in real time?
The law gives the Gambling Regulatory Authority a real-time monitoring system and requires licensed online platforms to connect to it through a secure interface. It does not publish a list of the player fields that flow through, so a player cannot assume more or less than the text says.
The short legal answer
The Authority is required to build a real-time monitoring framework for online gambling, and licensed online platforms must feed it. The background to this duty is explained in the guide on the gambling control system. What the texts do not do is describe, field by field, what a regulator officer can see about one named player.
Keep those two things apart. "Real-time monitoring of gambling activity" is a legal obligation on the platform. "The regulator reads your account" is a claim that goes beyond the wording.
What each provision says
Four provisions carry the duty. The table sets out each one in plain terms, with the reference you can check against the published text.
| Provision | What it requires | What it does not say |
|---|---|---|
| Act s.10(h) | The Authority must establish an electronic central real time gambling monitoring system to monitor compliance with regulatory requirements. | Which data items the system holds. |
| Act s.68(5) | The Authority must establish a framework to facilitate real time monitoring of casinos and online gambling activities, accessible for monitoring by the Communications Authority of Kenya and any other relevant government agency. | Which other agencies, or what each may view. |
| Act s.68(6) and (7) | An operator must give the Authority its participation platforms, the particulars of charges, the particulars and location of servers (including how a player is registered and deregistered), other servers, a valid telecommunication licence and other information the Authority requires. For mobile online gambling, particulars of network connectivity with two links to mobile operators. | That individual player histories are among the items listed. |
| Conduct Regulations r.41(d) | An online gambling system must provide real-time monitoring of gambling activity by the Authority through a secure application programming interface. | The format, frequency or fields of the interface. |
The regulations define "real-time" as the actual time during which an event or process occurs with negligible delay (r.2). Read together, the platform side of the arrangement is that activity is exposed to the Authority as it happens, not in a monthly return.
What an operator must connect to
Before trading starts, a licensee gives the Authority seven days' notice of the commencement date. That notice must include integration with the Authority's central monitoring system "or such system as may be required by the authority" (r.3(3)(c)). A platform presented for approval must also be capable of integration with the central monitoring system, the national self-exclusion registry and other systems developed by agencies the Authority recognises (r.44).
Alongside these, the technical standards in r.41 require an approved domain name, accurate and secure recording of all transactions, geo-location technology able to block prohibited locations, and a secure, encrypted and tamper evident audit log of system and user activities (r.41(a) to (c)). The audit log is the record an inspection would rely on.
What stays protected
Monitoring does not switch off data protection. Section 68(2)(h) makes data protection measures under the Data Protection Act a condition of approval for the control system. Regulation 96 adds three points: collection and processing must comply with the Data Protection Act, data may be collected only for purposes directly related to administration of the gambling operation, and personal data may not be used for marketing without the participant's prior consent.
Regulation 42 requires personal and financial data of a player to be encrypted in transit and at rest, and for storage and processing to take place on servers in Kenya unless the Authority has granted a prior written exemption. For your own rights over that data, see the guide on personal data terms for gambling accounts.
Other things the Authority can see about you
Monitoring is not the only route by which information about a player reaches the regulator. The table separates the others, because they are easy to confuse.
| Mechanism | Source | Who sees what |
|---|---|---|
| Identity verification | Conduct Regulations r.98(2) | The licensee must verify the identity of all punters under the know your customer requirements of the Proceeds of Crime and Anti-Money Laundering Act. This is a duty on the licensee, described in the guide on proof of age and identity checks. |
| Self-exclusion register | Conduct Regulations rr.67 to 69 | The Authority keeps a secure register of excluded persons, with full name and identification details, period, restrictions and dates. All licensees have secure, real-time access, and updating is real-time and free of charge. |
| Tax monitoring | Act s.10(o) | The Authority must collaborate with the Kenya Revenue Authority to establish a monitoring system for tax compliance. The text does not describe its content. |
| Complaints | Act s.10(m) | The Authority receives and determines complaints from companies and the public on games of chance. |
Questions worth putting to an operator
Because the public text is silent on the detail, the useful questions are the ones the regulations do answer. An operator's privacy notice and terms should be consistent with them, and you are entitled to ask where they are not.
- Which purposes is my personal data collected for, and are they directly related to administering the gambling operation (r.96(2))?
- Is any of my data used for marketing, and if so, when did I give consent (r.96(3))?
- Where are my data stored and processed, and if outside Kenya, under which written authorisation from the Authority (r.42(2))?
- Is my data encrypted in transit and at rest (r.42(1))?
An answer that contradicts the regulations is a matter for the Data Protection Commissioner or the Authority, depending on the complaint.
How to read this as a player
Three practical points follow from the wording. First, treat the monitoring system as a feature of licensed platforms: a site or app that is not licensed has no approved system to connect to, as explained in the guide on fake betting apps and APK risks.
Second, do not assume anonymity. Identity verification, a registered account and mobile-money transactions all exist before any monitoring question arises. Third, if you want to know what a particular operator holds about you, a data access request to the operator is the lawful route, and a complaint to the Data Protection Commissioner follows if it fails; see the guide on complaining to the ODPC.
Gambling is addictive. Play responsibly, and if you are worried about your play, the GRA toll-free line is in the page footer and the self-exclusion process is on the responsible gambling page.
Questions and answers
Does the GRA watch each individual bet as it is placed?
The Act requires a framework for real-time monitoring of online gambling activities, and the regulations require platforms to provide real-time monitoring of gambling activity through a secure interface. The texts do not list which records or fields are visible, so a per-bet view cannot be confirmed or ruled out from them.
Can other government bodies see the monitoring framework?
Section 68(5) of the Act says the framework must be accessible for monitoring by the Communications Authority of Kenya and any other relevant government agency. The Act does not name the other agencies.
Does monitoring mean my operator can ignore data protection rules?
No. The Act lists data protection measures under the Data Protection Act as a requirement for an approved system, and the conduct regulations say data collection and processing must comply with that Act and be limited to purposes directly related to the administration of the gambling operation.
Is my account data stored in Kenya?
Regulation 42(2) of the conduct regulations says storage and processing of player data takes place on servers located within Kenya unless the Authority has granted prior written exemption or authorisation.
Does real-time monitoring connect to self-exclusion?
The regulations describe a separate register of excluded persons that licensees access in real time, and they require platforms to be capable of integrating with that register. This is a different system from the monitoring interface, although both are described as real-time.
Where do I complain if I think my data is misused?
Complaints about personal data go to the Office of the Data Protection Commissioner; see the linked guide on how to complain. Complaints about a licensee's conduct can go to the Authority, which receives and determines complaints from the public under section 10(m) of the Act.
Sources
- Gambling Control Act, 2025 (No. 14 of 2025), ss.10, 68, accessed 2026-10-11
- Gambling Control (Conduct of Gambling Operations) Regulations, 2026, rr.2, 3, 41, 42, 44, 67 to 69, 96, 98, accessed 2026-10-11