The regulations giving effect to the Gambling Control Act, 2025 were published in the Kenya Gazette on 30 June 2026, as Supplement No. 162. Most coverage went to operator fees and player protections. The provision that matters to Kenya’s technology sector is quieter: there is now a license category called “gambling software or platform”, and the operators who buy that software must name a licensed supplier in their own applications.
A license for the vendor, not just the brand
Regulation 15 of the Gambling Control (Licensing) Regulations, 2026 (Legal Notice 111 of 2026) requires anyone intending to provide any gambling software or platform to apply to the Gambling Regulatory Authority for a license. It sits in the same part of the schedule as equipment manufacture, sale, testing and repair — trades the old framework treated as ancillary.
The pricing is worth reading closely. An online casino license costs KES 5 million to apply for and KES 50 million on issue, against a gambling capital requirement of KES 100 million. Providing gambling software or a platform costs KES 200,000 to apply and KES 1 million a year. The effect is a low financial barrier carrying a heavy disclosure burden — the Authority is bringing the supplier layer onto the register rather than pricing it out of the market.
The operator’s application now names its suppliers
Under regulation 11, an online gambling application must include the proposed platform, domain name and games provider from a supplier the Authority has licensed, with a copy of the agreement attached. Bookmakers face a matching requirement to disclose odds and platform providers and file their contracts.
This is where the industry’s commercial structure meets the paperwork. Almost no operator builds its own game library; the standard route is a single integration with a content aggregator carrying catalogues from dozens of studios. Agreegain’s game aggregator is one example of the model, replacing dozens of individual studio contracts with a single technical relationship. Kenya has moved that arrangement out of purely commercial territory: the supplier needs an Authority licence, and the contract goes into the operator’s file.
Form 12 reads like a technical audit
The application form for software and platform providers asks applicants to classify themselves — software supplier, platform provider hosting a full gambling platform, critical system integrator supplying RNG, payment or player-verification systems, or software modifier. It then asks for:
- the primary data center location and the disaster recovery site, plus a full hosting architecture diagram;
- a random number generator certificate from a named, accredited independent testing laboratory;
- whether the product is a white-label solution and, if so, which operators use it;
- an ownership chart traced up to natural persons.
Applicants also undertake to report material incidents — security breaches, major faults, fraud — within 24 hours, and to grant the Authority and its agents full access to systems, data and premises for inspection.
Kenya has done this before
Licensing the layer beneath the consumer brand is familiar here. The Communications Authority’s licensing procedures turn on which part of the network you actually operate, not on which brand the customer sees; as Techweez set out in its guide to becoming an ISP in Kenya, the license you need follows the infrastructure you run. The Central Bank took a comparable route with digital credit providers, licensing the lenders sitting behind the apps.
The Conduct of Gambling Operations Regulations, 2026 (Legal Notice 112) push further into architecture. Online systems must give the Authority real-time monitoring access through a secure API, integrate with its central monitoring system and the national self-exclusion register, run Geo-location blocking, keep encrypted and tamper-evident audit logs, hold player funds separately from operational funds, and store and process player data on servers inside Kenya unless the Authority grants a written exemption.
Sixty days
Regulation 30 keeps licenses issued under the repealed Betting, Lotteries and Gaming Act alive for sixty days from publication, putting the migration deadline in late August. Holders must apply for the appropriate new license inside that window.
For suppliers, the exposure is subtler than a date. A license can be revoked where a licensee has consistently failed to protect the confidentiality of data in its possession, and the Authority’s on-site inspection now tests operational, financial, managerial and technological separation between a licensee’s business and its associates. Hosting decisions, database access and integration design are the things under examination. The lesson travels beyond betting. When a regulator asks for a hosting architecture diagram and your clients’ operator license numbers, system design has become a compliance document — and a vendor who cannot produce one is a liability to the customer holding the licence.
