The Gambling Regulatory Authority's public-facing pages, checked in the week the Gambling Control Act 2025 finished handing enforcement from the BCLB to the new body, do not host a downloadable register titled "blocked gambling sites". What sits on the public record instead is the inverse — the licensed operator register — plus the enforcement architecture the Act created when it replaced the BCLB at end-February 2026. Gambling tax collections rose 11% to KSh 28.45 billion by April 2026 under the deposit-based system. And yet a Kenyan bettor trying to check whether a particular sportsbook is on a formal blocklist has no such document to open. That absence is the shape of the story.

TL;DR

  • No formal GRA blocklist PDF exists on the public record.
  • The licensed register is the inverse — read that instead.
  • M-Pesa paybill absence is the single strongest field signal.

Red Flag #1: The "Official Blocked List" That Is Not on the GRA Website

Listen. If a Telegram channel or an SEO listicle sends you a link claiming to be the "official GRA blocked sites list Kenya 2026", open the URL in a fresh browser window before you scroll further. Then check whether the domain is `.go.ke`. If it is not, you are not reading a government document. You are reading somebody's affiliate scaffold.

The Gambling Regulatory Authority replaced the Betting Control and Licensing Board at the end of February 2026 under the Gambling Control Act 2025. Its enforcement posture pushes harm-minimisation, licensing conditions, and tax compliance. What the regulator publishes as the primary machine-readable list is the licensed operator side — not a blocklist artefact. If the site you are looking at is unlicensed, its absence from the licensed register is what tells you. There is no separate "banned" PDF you have missed.

Verdict: any URL that promises a downloadable "blocked list" and lives off `.go.ke` is aggregating rumour, not disclosing enforcement.

Red Flag #2: An Operator Missing From the GRA / Former BCLB Licensed Register

The way to check any Kenyan-facing sportsbook is to search for its exact legal entity name in the licensed operator register maintained under the GRA. This is the same investigative move a UK bettor would run against the UKGC public register — and the UK register lists 268 online operators on the public record. Kenya's register is materially smaller and materially easier to walk through.

Five names anchor the licensed side of the Kenyan market: SportPesa, Betika, Odibets, 1xBet Kenya, and Betway Kenya. Each held a BCLB licence through the 2020-2024 renewal cycles and now sits under GRA supervision. If the operator you are trying to deposit with is not one of the five — and is not otherwise findable in the current register — treat that as the primary red flag. Missing from the register is not a filing lag. It is the answer.

Verdict: if you cannot find the legal entity on the register, do not deposit. That single check is more useful than any "top 10" listicle.

Red Flag #3: No M-Pesa Paybill, Only Cards or Crypto

M-Pesa integration is the load-bearing rail for Kenyan-licensed operators, and it is central by design of the licensing framework. The reason matters. Getting an M-Pesa paybill provisioned for a gambling merchant requires the operator to clear KYC and compliance layers with Safaricom that unlicensed offshore sportsbooks simply cannot pass. So the presence of a genuine M-Pesa paybill — not a payment aggregator, not a card-only checkout, not a crypto on-ramp — is one of the strongest field signals a Kenyan bettor can use.

If the sportsbook offering you a welcome bonus routes you to Visa/Mastercard only, or to a Bitcoin wallet, or to a Skrill / Neteller flow with no Safaricom Daraja handshake in sight, you are almost certainly transacting with an operator that is not on the GRA licensed side. That is not a UX gap. That is licensing failure showing through the checkout.

Verdict: no M-Pesa paybill, no deposit. The rail is the disclosure.

Red Flag #4: A "License Number" That Does Not Match the Kenyan Format

A common trick from offshore sites targeting Kenyan traffic is to display a large "Licensed and Regulated" badge in the footer, with a licence number that on inspection points to Curaçao, Anjouan, or a private "gaming authority" you have never heard of. Compare that to the way listed operators disclose. Flutter's licensed jurisdictions sit at MGA, NJDGE, AGCO Ontario, and UKGC — each one a tier-1 regulator whose register you can independently open. On the public record, the UKGC has fined Flutter's UK licensee £1.17m for social responsibility and AML failings (Flutter UKI fine 2023). That is what real regulatory friction looks like.

A Kenyan-facing operator that shows only a Curaçao sublicence number in the footer is not accountable under the Gambling Control Act 2025 — and the GRA has no enforcement handle on it because it is not licensed to serve Kenya in the first place.

Verdict: the footer badge is not the licence. The GRA register is.

Red Flag #5: The Site Still Advertises the Pre-October 2025 20% Withholding Rate

The withholding tax on player winnings was cut to 5% in October 2025. The Finance Bill 2026 has since proposed restoring it to 20% — a change the GRA publicly opposes on enforceability grounds. That is on the public record. A live sportsbook operating for Kenyan bettors in 2026 should have updated its "how withholding works" explainer to reflect the current 5% rate and to disclose the pending restoration debate.

If the terms-and-conditions page or a "Kenya tax guide" article on the operator's site still cites a flat 20% WHT with no reference to the October 2025 cut, one of two things is happening. Either the operator's compliance team stopped updating in 2024 — a red flag on its own — or the entity has no compliance team engaged with Kenyan tax at all, which is a much bigger red flag. Currency for a Kenyan bettor is time. An outdated tax explainer is time you should not spend.

Verdict: stale tax disclosure = stale operational grip on the market.

Red Flag #6: Player Funds Not Held in a Kenyan-Licensed Bank Account

New licensing conditions under the GRA require gambling proceeds to be held in Kenyan-licensed bank accounts. That is a structural investor-protection clause with a specific enforcement pathway: if the operator's cashiering is offshore, they are outside the enforcement perimeter of the Central Bank of Kenya, and outside the perimeter the GRA can reach into for consumer redress.

Compare this to the segregated player fund claim most global operators make. Flutter's investor disclosures list player funds as segregated across the group. Entain's 2024 annual report makes the same claim at group level for its 28.0m active customers. Both statements are technically true — but "segregated" in a London or Malta bank is not the same protection as "held in a Kenyan-licensed bank account" for a Kenyan bettor trying to recover a disputed balance. The Kenyan condition is stricter, and it is the one that binds under the Act.

Verdict: ask where the money sits. If the answer is not "a Kenyan-licensed bank", the licence is not doing the work it should.

Red Flag #7: No Disclosure of the 30% Kenyan Ownership Requirement

Under the Gambling Control Act 2025, an applicant company must have at least 30% Kenyan ownership. That is a stated licensing condition, not a marketing preference. Any operator soliciting Kenyan bettors and holding themselves out as licensed in Kenya should be able to point to that structural requirement in their about-us or compliance page.

The absence of any disclosure of shareholding structure — especially by an operator that is a subsidiary of a large international group — is a signal that the operator either has not filed for a GRA licence, or has filed under an ownership vehicle that does not meet the 30% threshold and is hoping the reader does not check. The empire of licensed listed operators is transparent about ownership by requirement. See again how Entain's shareholder register and Companies House filings for large UK operators look on the public record. That level of disclosure sets the reference bar.

Verdict: no clear ownership disclosure = no comfort the 30% rule is met.

Red Flag #8: Responsible Gambling Pages Pointing to GAMSTOP or GamCare Rather Than a Kenyan Mechanism

This one catches a lot of copy-paste offshore operators. Their responsible-gambling page instructs the Kenyan bettor to "register with GAMSTOP" or to call GamCare's UK helpline. Neither mechanism binds outside the UK. GAMSTOP covers every UKGC-licensed online operator automatically — with roughly 0.42m registered users — and blocks deposits across UK-licensed brands for the user-selected duration. It does nothing for a bettor in Nairobi trying to self-exclude from a Kenyan-facing sportsbook, because the sportsbook is not in the UKGC licensed pool that GAMSTOP polls against.

A serious Kenyan-facing operator's responsible-gambling page names Kenyan support channels, describes the operator's own deposit limits and cool-off tooling, and does not fob the user off with a UK helpline number that will not help them. If the RG page is a lift-and-shift from a UK site, treat that as a signal about the whole compliance posture — because it usually is.

Verdict: an RG page pointing at GAMSTOP is telling you the operator does not treat Kenyan players as its actual market.

The Verdict: What "Blocked" Actually Means Under the Gambling Control Act 2025

The honest read is this. There is no single downloadable "blocked gambling sites list" on the GRA website that a Kenyan bettor can print out and check names against. What exists instead is a licensed operator register, a set of new statutory conditions under the Gambling Control Act 2025, and a tax collection architecture that pulled KSh 28.45 billion by April 2026 under the deposit-based system. In that architecture, "blocked" is functionally defined as "not licensed" — and it is on the licensed register that the reader needs to run the check.

So the workable field method for a Kenyan bettor in 2026 is: search the operator's exact legal name on the GRA register, check for a genuine M-Pesa paybill in the cashier, verify the withholding disclosure reflects the October 2025 5% rate, and confirm the responsible-gambling page names Kenyan support channels rather than UK helplines. Any operator failing two or more of those is functionally "blocked" for your purposes — irrespective of whether a formal register document has ever named them.

FAQ

Does the GRA publish a downloadable list of blocked gambling websites?

No. Checked against the current GRA public-facing pages in the transition window from the BCLB, there is no downloadable "blocked sites register" PDF or CSV. The regulator publishes the licensed operator side — the inverse — and enforces through the Gambling Control Act 2025 architecture that replaced the BCLB at end-February 2026. Any third-party site claiming to host an "official" blocked list on a non-`.go.ke` domain is aggregating rumour, not primary disclosure. The workable check is to search the licensed register for the operator's exact legal entity name.

How do I check whether SportPesa, Betika, Odibets, 1xBet Kenya or Betway Kenya are properly licensed?

Those five are the anchor licensed operators in the Kenyan market and held BCLB licences through the 2020-2024 renewal cycles. Under the GRA they continue to sit on the licensed side of the register. The verification method is the same as for any operator: search the current GRA licensed operator register for the legal entity name, confirm an M-Pesa paybill in the cashier flow, and check that responsible-gambling and tax disclosures reflect current Kenyan law rather than lifted UK boilerplate.

What is the withholding tax rate on winnings for Kenyan bettors in 2026?

The withholding tax on player winnings was cut to 5% in October 2025 and remains at 5% as of the article's reference window. The Finance Bill 2026 has proposed restoring it to 20% — a change the GRA has publicly opposed on the grounds that enforcement at the higher rate is difficult and pushes players toward unlicensed offshore alternatives. A licensed Kenyan operator's tax explainer should reflect the current 5% rate and, ideally, disclose the pending debate. Stale 20% disclosure suggests the operator is not actively engaged with Kenyan compliance.

Why is M-Pesa paybill presence such a strong signal of licensing?

Because provisioning an M-Pesa paybill for a gambling merchant requires Safaricom compliance clearance that unlicensed offshore operators cannot obtain. It functions as a second-order licensing filter — one that is visible to the bettor at the cashier without needing to open any register. Combined with the GRA condition that gambling proceeds be held in Kenyan-licensed bank accounts, the M-Pesa handshake is effectively the on-the-ground proof of a compliant operational stack. Card-only or crypto-only checkouts almost always indicate an operator sitting outside the Kenyan licensing perimeter.

---

This piece does not cover the excise duty stack in detail — the interaction between the 7.5% excise on stakes and the 5% (or proposed 20%) withholding on winnings deserves its own dedicated analysis. It does not cover the specific enforcement pathway the GRA is using against ISPs to block unlicensed sites at the DNS layer, because that mechanism is still being publicly defined in the post-BCLB transition. And it does not cover the joint responsibilities of payment service providers under the Act, which sit somewhere between banking regulation and gambling regulation and remain a live policy question. Each of those is a separate argument.