Kenya’s betting industry is facing one of its biggest regulatory tests after the Gambling Regulatory Authority (GRA) confirmed investigations into several gaming firms named in a data privacy case that has already resulted in a landmark court ruling against Safaricom.
At the centre of the investigation is Odibets, alongside other betting operators including Betika and Kwikbet, following findings contained in a Directorate of Criminal Investigations (DCI) forensic report and a High Court judgment that examined the unauthorised access and sharing of Safaricom subscriber information.
The inquiry traces its roots to a complaint filed by businessman Benedict Kabugi Ndungu, who reported the Safaricom data breach to authorities in 2019. In submissions made to the DCI and GRA, Kabugi identified several betting firms that appeared in the forensic investigations and court records connected to the data breach.
The GRA has since confirmed that it is reviewing the conduct of the companies named in the complaint, with the outcome expected to influence future regulatory action, including licensing decisions.
The investigation follows a major High Court ruling delivered in Constitutional Petition E095 of 2026, where Justice Bahati Mwamuye found that Safaricom had violated the constitutional rights of its subscribers through failures in data protection and access controls. The court awarded Sh9.9 million in damages to eleven petitioners and found that personal information belonging to millions of subscribers had been improperly accessed and circulated over several years.
Court records show that the compromised information included financial transaction details, betting histories, device identifiers and location data. The information was shared through various digital platforms, including WhatsApp, email and cloud storage services.
A significant portion of the forensic evidence examined by investigators consists of WhatsApp conversations between former Safaricom employees and individuals linked to betting companies. Investigators concluded that the communications formed part of a broader network through which subscriber information moved from Safaricom systems into the hands of commercial entities.
Among the names highlighted in the investigation is Andrew Akwesera Aligula, the Chief Operating Officer and shareholder of Kareco Holdings Limited, the company behind Odibets. Investigators linked Aligula to communications and financial transactions referenced in the forensic report, placing him at the centre of the ongoing inquiry.
The scrutiny has created fresh challenges for Odibets at a time when the company is seeking to maintain its operating licence. The firm’s licence renewal now coincides with an active regulatory review and ongoing criminal investigations, placing increased attention on the company’s compliance record.
Kabugi has called on regulators to suspend the licences of all betting firms named in the investigation until the inquiries are completed. He argues that companies found to have benefited from improperly acquired subscriber information should face both regulatory and legal consequences.
The case has also drawn attention to Betika and Kwikbet, which appear in the same forensic records reviewed by investigators. The inclusion of multiple operators has broadened the scope of the investigation beyond a single company and raised wider questions about data governance practices within Kenya’s betting sector.
Industry observers view the matter as a critical test of the country’s commitment to enforcing data protection laws. The High Court ruling established that Safaricom’s internal safeguards failed to adequately protect customer information, while the ongoing investigations are examining how that information was subsequently utilised by third parties.
For regulators, the challenge now extends beyond the telecommunications sector. The GRA must determine whether the conduct identified in court records and forensic investigations meets the standards required for continued operation within Kenya’s gambling industry.
The outcome of the investigations could have far-reaching implications for the betting sector, particularly as regulators seek to strengthen compliance requirements around consumer data, privacy rights and responsible business practices.
With the GRA probe still underway, attention remains focused on whether the findings will result in licence suspensions, additional prosecutions or new regulatory measures aimed at tightening oversight of one of Kenya’s fastest-growing industries.