How proof of age and identity checks work when you register
A licensed operator must require proof of age of majority before it registers any player (Gambling Control Act, 2025, s.72(3)) and must run identity, location and age checks before the account is activated or any deposit is received (Operations Regulations, r.85). The same proof is required again before a prize is paid (s.70(6)).
Why the checks exist
Registration is the gate the law uses to keep children and excluded persons out of online gambling. The Gambling Control Act, 2025 puts the duty on the operator, not on the player: s.72(2) requires an operator to "put in place mechanisms to ensure that a child is not registered", and s.68(2)(d) makes "protection measures against under age gambling" one of the things an operator's system must contain before the regulator approves it. That system is explained in the glossary entry on the gambling control system.
The Act speaks of a "child" and of "proof of age of majority". The regulations made under it use the figure directly: the operations regulations refer to "persons under the age of eighteen years" (r.95(1)(c)), and the advertising regulations refer to persons who appear under eighteen (r.6(1)(c)(iii)).
What is checked, when, and under which provision
| Check | When it happens | What the provision says | Provision |
|---|---|---|---|
| Proof of age of majority | Before registration | An operator shall require proof of age of majority prior to the registration of every player | Act s.72(3) |
| Identity, location and age assurance | Before anyone may participate online | No participation without a mandatory identity check, location verification and age assurance check | Ops Regs r.85(1) |
| Verification against data sources | Before account activation and before any wagering deposit is received | The licensee shall use reliable, independent and electronically verifiable data sources | Ops Regs r.85(2) |
| Self-exclusion and eligibility | As part of verification | Confirmation that the person is not self-excluded and is legally eligible to gamble | Ops Regs r.85(4) |
| Know-your-customer | For all punters | Identity verified under the Proceeds of Crime and Anti-Money Laundering Act requirements | Ops Regs r.98(2) |
| Proof of age again | Before a prize is remitted | An operator shall require proof of age of majority prior to the remittance of the prize | Act s.70(6) |
| Winner's identity | Before payment of winnings | A licensee shall verify the identity of any winner | Ops Regs r.85(3) |
What to expect during registration
Operators design their own screens, but the legal sequence is the same everywhere. The steps below describe that sequence. They are not instructions for any particular operator.
- You give identifying details
Regulation 85(4) says verification "shall include official identification documents". Expect to be asked for the details of a government-issued identity document.
- The operator checks those details electronically
Regulation 85(2) requires "reliable, independent and electronically verifiable data sources". The regulation does not name a particular database. What matters for you is that the name, date of birth and document number you enter must match official records exactly.
- Your location is verified
The regulations define geo-location technology as a system "capable of accurately determining the physical location of a player to ensure gambling only occurs within permitted jurisdiction". A platform must be able to block access from prohibited locations (r.41).
- The self-exclusion register is consulted
Regulation 73 requires licensees to integrate their systems with the national self-exclusion register and to block all gambling activity by self-excluded persons automatically, with daily verification checks. A person on the register may not open a gambling account (r.70(7)(b)).
- The account is activated, and only then can money go in
Verification comes "prior to player account activation and receipt of any wagering deposit" (r.85(2)). The mechanics of that first payment are in the guide on mobile-money deposits to a player account.
Before you hand any document to a site or an app, confirm that it belongs to a licensed operator. Identity documents sent to a copied site are a gift to fraudsters. The guide on spotting fake apps and copied sites shows how to compare a domain with the regulator's list.
What the operator must tell you at registration
Registration is also the point at which information flows the other way. Section 72(6) requires a licensee to make available to a player all the rules relating to the authorised games it conducts, and the particulars of any processing fee the player may incur.
The operator's terms and conditions, which need the regulator's approval, must cover registration and player accounts, deposit mechanisms, eligibility restrictions, account suspension and closure, complaints and dispute resolution, and data collection and privacy statements (r.4(2)). Read the sections on account closure and on data before you agree to them.
False details, borrowed IDs and accounts for someone else
An account must describe the person who uses it. Section 72(5) deals with false information in direct terms: the licensee shall not register the person and, where the person is already registered, "shall immediately cancel the person's registration".
That has practical consequences at the other end of the cycle. Because identity is verified again before winnings are paid (r.85(3)), an account in one person's name that is used by another cannot pass the payout check honestly. The rules on timing and documents at that stage are in the guide on prize payment and withdrawal timelines.
Regulation 94 lists who may not be allowed to participate at all: a child, a person excluded from gambling activities, a person without legal capacity, and a person prohibited by any law from gambling. An adult who lets a child use an adult's account places the child in exactly the position the law is written to prevent.
Keeping children off an adult's account
The operator's checks happen at registration and again at payout. In between, the account is protected only by what protects the phone. If children use your handset, a few habits matter:
- Keep the screen lock and the mobile-money PIN private, and do not reuse one number for both.
- Do not save the account password in a browser or app on a shared device.
- Log out of the operator's site or app after each session.
- Use the limit tools that r.87 requires operators to provide, so that an unexpected session cannot drain the wallet.
What happens to the documents you submit
Identity data collected for verification is personal data, and two sets of rules protect it. Under the operations regulations, a licensee must encrypt all personal and financial data of a player in transit and at rest (r.42(1)), must store and process player data on servers located within Kenya unless the Authority has given prior written exemption (r.42(2)), and must collect and process data only for purposes directly related to administering the gambling operation (r.96(2)).
Under the Data Protection Act, the operator must tell you before collection what is being collected and why, whether collection is voluntary or mandatory, and what follows if you do not provide it (s.29). You have the right to access the data, to object to processing and to have false or misleading data corrected or deleted (s.26). The glossary of personal data terms for gambling accounts explains each of those rights in a line.
This site does not describe ways to avoid age, identity or location checks. They are legal duties on the operator, and an account opened with false information must be cancelled under s.72(5). If you are under 18, online gambling is not open to you.
Questions and answers
Can I play online without registering an account?
No. Section 72(1) of the Gambling Control Act, 2025 says a licensee shall not allow any person to participate as a player unless the person is registered as a player and holds an account with the licensee.
What happens if someone registers with false details?
Section 72(5) requires a licensee that becomes aware of false information given at registration to refuse the registration, or to cancel it immediately if the person is already registered.
Why does the operator check where I am?
Regulation 85(1) lists location verification next to the identity and age checks, and regulation 41 requires an online platform to use geo-location technology able to block access from prohibited locations.
Can an operator use my ID details to send me marketing?
Not without your consent. Regulation 96(3) of the Conduct of Gambling Operations Regulations says personal data collected shall not be used for any form of marketing without the prior consent of the participant, and section 37 of the Data Protection Act requires express consent for commercial use of personal data.
Is there an anonymous way to hold an account?
No. Regulation 86 prohibits anonymous gambling and the use of virtual assets for gambling or withdrawal unless the Authority approves it in consultation with the National Treasury.
Sources
- Gambling Control Act, 2025 (No. 14 of 2025), ss.68, 70, 72, 73, accessed 2026-10-04
- Gambling Control (Conduct of Gambling Operations) Regulations, 2026, rr.41, 42, 70, 73, 85, 86, 94-96, 98, accessed 2026-10-04
- Gambling Control (Advertising) Regulations, 2026, r.6, accessed 2026-10-04
- Data Protection Act (Cap. 411C), ss.25, 26, 29, 37, Kenya Law, accessed 2026-10-04