In 2026, making money in the market is only half the work for a Kenyan retail forex trader. The other half is proving where the money came from, who held it, under which license it was traded, and whether the records can survive a regulatory inspection, a tax audit, or a fraud event. In Kenya, the regulators have reacted to the fast growing retail trading sector with tighter tax enforcement, increased licensing requirements for brokers, and better scam prevention measures.
Kenya’s online forex market is regulated by the Central Market Authority (CMA), while taxes are handled by the Kenya Revenue Authority (KRA). There are also situations where the Central Bank is involved. When it comes to suspected criminal activities such as fraud, the Kenya Police Service (KPS) and the Directorate of Criminal Investigations (DCI) are working together with the relevant authorities, both within Kenya and abroad.
In this manual, we will look at practical regulatory considerations for traders in Kenya. This is not a forex trading guide about entries, indicators, or what EUR/USD did after lunch. It is about your legal position as a retail trader in Kenya. Do you know what to do if your broker becomes insolvent, if a group of clone site fraudsters get their hands on your broker login credentials, or if KRA asks why your account shows repeated inflows? Which rights do you have, and which duties must you fulfill? Have you picket a broker that is authorized within Kenya and is your money covered by the Kenyan Investor Compensation Fund (ICF) in case of broker failure? Is your paperwork and audit trail defensible? In Kenya in 2026, these are not insignificant side issues, they are part of the due diligence a retail trader should carry out.
Retail forex traders in Kenya are not just worrying about finding the right stop-loss points and avoiding too much leverage; they must also juggle both incessant fraud attempts from scammers and increased demands from Kenyan authorities, including the tax authority and those who work to prevent money laundering and identity theft. When it comes to fraudsters targeting online traders, the growing adoption of AI driven attacks is making the environment increasingly difficult to navigate for Kenyan traders. In recent years, the Kenya Computer Incident Response Team Coordination Centre (KE-CIRT/CC), which operates under the Communications Authority (CA), has repeatedly warned traders about the rise in AI-powered scams, including AI-generated phising attacks, deepfake scams, and cloned web sites. The advent of advanced AI-powered impersonation tools online is a part of the increased risks, as both voice and appearance can now be altered for videos and video calls.
For Kenyan traders, it is more important than ever to pick a CMA licensed broker and verify exactly which legal entity you trust with your money and personal data. Make sure the entity name in your contract is an exact match to the entity holding the CMA license, otherwise you can easily be signed up with an offshore company based in a lax jurisdiction on the other side of the world.
To handle requests from Kenyan authorities, make sure you save all documentation, and preferably make back-up copies in case the broker meddles with your account or your device is lost or damaged. Keep a trader’s ledger that can distinguish between deposits, withdrawals, costs, realized gains, and realized losses. Assume KRA will treat unexplained deposits as taxable unless you can prove otherwise.
Trade performance still matters, of course. But in a market shaped by stricter regulation, heavier tax enforcement, bank deposit analysis, and much more advanced scams, due diligence and heavy documentation carries weight. The trader who investigates beforehand and keeps good records is not guaranteed success, but is much less likely to get into trouble.
The entity trap: Who is your real contract partner?
The first legal mistake many traders make is confusing a global brand with the legal entity that actually onboard them and is their contractual counterpart. That mistake can be really expensive, because legal rights attach to the contracting entity. This means you need to confirm that you actually sign up with the CMA-licensed company and not with some other company that operates under the same brand and logo.
A broker group operating under a unified brand typically consist of many different companies, which are based in different countries and licensed by different authorities. Within the group, you might for instance find a UK FCA licensed company based in London, an ASIC licensed company based in Sidney, a CMA licensed company based in Nairobi, and a smattering of companies registered in and licensed by offshore paradise locations known for their lax approach to trader protection, e.g. the Seychelles, Mauritius, Vanuatu, and the Marshall Islands. To enjoy the full protection and enforcement of the Kenyan legal system, you need to sign up with the CMA-licensed entity. Make sure the broker web page does not discretely nudge you over to another entity once you have been lured in by the Kenyan-facing marketing material where the CMA license is proudly displayed.
It is easy to fall into the offshore trap, because retail broker groups are usually built to look unified. Support pages, apps, and websites are often shared. But the legal architecture underneath is not. A global brand may operate many companies and hold many licenses. But your account is with one specific company. Before signing up, a Kenyan trader should know that entity’s legal name and its CMA license number. If the answer is murky, either cut bait or dig deeper. Do not sign up until things are crystal clear. Regrettably, signing up with a well-known brand that has a good reputation in the UK or Australia does not guarantee that they will treat Kenyan retail traders well, especially not if they have managed to onboard you through a legal entity in Vanuatu. When a Kenyan resident is onboarded through a Seychelles or Mauritius branch of an international broker group, the fact that the same group also has an FCA or ASIC facing brand does not import UK or Australian retail trader protection into that Kenyan relationship. Even if you were to sign up with a brokerage company based in Australia and licensed by ASIC, a highly reputable financial authority, you are introducing jurisdictional complexity and might find yourself in a situation that proves difficult to manage. Which law will apply, and will you enjoy the same level of protection as traders actually living within the Australian jurisdiction?
Why is it so important to pick a CMA-licensed brokerage company?
Traders in Kenya sometimes assume that they will be fine as long as they pick a brand associated with a reputable financial authority, e.g. a brand that (somewhere in the company group) holds a license from BaFin in Germany, CySEC in Cyprus, ASIC in Australia, or FCA in the United Kingdom. The problem is that foreign regulation is not as useful as it sounds, not even if the regulator has a good reputation.
You need a CMA-licensed broker that will put you solidly within the Kenyan legal system. This affect thing such as applicable law, licensing rules, complaint channels, compensation route, client money rule, and disclosure regimes. A CMA license means that there is a company based in Kenya to deal with. It also shows that the global brand is taking the Kenyan market seriously enough to operate under a CMA license.
If a CMA-licensed broker misbehaves, you can file a complaint directly with the CMA. You do not have to try to access a legal system in Vanuatu or the Seychelles. Suspected criminal activity, such as fraud, can be reported to the Kenyan police.
How to verify your prospective contractual counterpart before you sign anything
Kenya’s CMA directory makes this visible because it lists Kenyan licensed entities by legal name and license number, not by marketing flair. Example: On the live register for CAM-licensed online forex brokers, TPXMGLOBAL Kenya Limited appears with license number 233, and the XM brand´s Kenya client agreement states that services for that arm are provided by TPXMGLOBAL Kenya Limited, a CMA regulated non-dealing online foreign exchange broker.
For 2026, the local verification step is straightforward. Do not trust any claims from the broker or follow any links they provide. Go directly to the CMA license directory and look for the company named in the contract the broker wants you to sign.
When you have located the broker company, you will also see the official web site listed with the CMA. Use that link to sign up with the broker. That way, you avoid clone scams, i.e. fraudsters who register similar-looking domain names to piggyback on the good reputation of a licensed broker.
Understanding the lingo and categories
Kenya regulates online forex through named license classes under the Capital Markets (Online Foreign Exchange Trading) Regulations.
- A dealing online foreign exchange broker acts as principal and market maker.
- A non dealing online foreign exchange broker acts as a link between the market and the client and does not engage in market making.
- A money manager manages client forex portfolios for a fee.
These are separate categories with separate obligations.
Examples of CMA requirements and why the matter for retail forex traders in Kenya
Mandatory money segregation
CMA-licensed brokers must keep client funds in separate bank accounts away from the broker’s own operating funds. This matters, because if a broker’s business fails (insolvency, bankruptcy, fraud, etc), your money isn’t mixed with the company’s cash, and it can be returned to you more easily. When client money and company money is not segregated, all claimants will get money from that pot, and you are unlikely to get you full amount back.
Without segregation, there is also an increased risk of a broker using client funds to pay for the broker’s day to day expenses, and then failing to uphold their obligations to the clients.
The capital requirements
Dealing Online Foreign Exchange Broker
- Must have a minimum paid up share capital of KES 50 million.
- Must undertakes to maintain liquid capital of at least KES 30 million or 8% of total liabilities, whichever is higher.
Non dealing Online Foreign Exchange Broker
- Must have minimum paid up share capital of KES 30 million.
- Must also maintain liquid capital of at least KES 30 million or 8% of total liabilities, whichever is higher.
Online Forex Money Manager
- Must have minimum paid up share capital of KES 10 million.
- Must maintain liquid capital of at least KES 5 million or 8% of total liabilities, whichever is higher.
Capital and liquidity rules exist to reduce the odds that a broker becomes unable to meet client obligations. You want a broker to be able to handle withdrawal requests even when dealing with stress events. Retail traders often dismiss these thresholds as unimportant, but they are not. A broker with adequate capital is more likely to stay solvent under stress, reducing the risk that the company fails and can’t return your funds. Capital buffers help ensure the broker can honour withdrawals and meet obligations, and not run out of money due to bad risk management. Capital requirements help protect your money by ensuring the broker isn’t under capitalized.
Reporting & Audits
CMA-licensed brokers must regularly submit financial reports and audited statements to the CMA. They must provide disclosures about their business, execution practices, and risks. The CMA can inspect books and take action if a broker misleads clients or runs unsafe practices.
Fair Conduct, Risk Warnings & Marketing Rules
CMA-licensed brokers must explain risk clearly and are generally restricted from aggressive or misleading advertising. This reduces the risk of begin lured in by deliberately vague promises such as “guaranteed profits” or “risk free” trading.
There are is also a leverage cap in place for retail trading, but it is at 1:400 which is much higher than the caps imposed by financial authorities such as ASIC, CySEC, and the UK FCA, who typically cap at 1:30 for major fx pairs and even lower for other fx pairs.
Dispute Resolution & Complaint Channels
CMA regulated brokers must participate in formal complaint resolution mechanisms so you can raise complaints and get redress. It does not mean that the CMA will always take your side and force the broker to do what you want, but it does mean that there is a clear and accessible path available. If the broker does not fulfill this obligation, the CMA can take a look at the situation and, if possible, help mediate. If this does not work, it is time for the next escalation step, in accordance with the predefined path. For the average retail trader with a small forex account, this is much easier than having to go through the formal legal system in a place like the Seychelles, Vanuatu, or Saint Kitts & Nevis.
If the first step of escalation is not enough, you also have the Kenyan legal system at your disposal, which is preferable to trying to handle a claim on the other side of the world.
The Kenyan Investor Compensation Fund
The Investor Compensation Fund (ICF) is a legal mechanism established under the Capital Markets Act (Cap 485A) in Kenya. Its purpose is to provide limited compensation to investors (including traders) in Kenya who suffer pecuniary loss due to the failure of a CMA-licensed broker or dealer to meet contractual obligations. In other words, if a CMA licensed broker becomes insolvent or defaults, the ICF may pay compensation to eligible investors who lost money because of that failure.
The ICF is funded by mandatory contributions from licensed market participants (including brokers), transactions levies on trades (e.g., equity and bond transactions), penalties paid by operators for regulatory non compliance, and interest or profits earned on the fund’s investments.
Under existing rule, the maximum payout from the ICF is KES 200,000 per individual investor/trader for losses that after other remedies (like exchange guarantees) have been applied. This is not enough to cover a big forex trading account, but for many small-scale hobby traders in Kenya, getting KSh 200k will make a big difference.
The ICF only applies to investors/traders in Kenya who suffer direct financial loss because a CMA-licensed intermediary fails to meet its contractual obligations. If you use a broker without a CMA-license, you are not covered. If you sign up with a brand and a foreign company is your counterpart, you are not covered, even if the brand holds a CAM-licens through another company within the same company group.
Some Kenyan traders believe that if they sign up with a foreign-licensed broker, they will be covered by a similar compensation scheme in that country. Regrettably, that is usually not the case. Offshore paradise locations with lax trader protection will typically have no compensation fund. Stricter countries, such as the UK and the EU members, will typically limit compensation to its own residents, and not cover traders in Kenya. Example: The UK fund pays compensation up to £85,000 which, of course, sounds much more appealing than KSh 200,000. But under most circumstances, only traders within the UK are covered.
The legal escalation path when a broker does not fulfill its obligations
When a broker freezes withdrawals, ignores support tickets, or simply goes silent, most traders react emotionally first and legally later. That order should be reversed. The record should start with a dated written notice to the broker that identifies the account, the disputed amount, the transaction references, the relevant dates, and the remedy requested. Kenya’s online forex regulations require applicants to have internal dispute resolution mechanisms and customer complaint handling arrangements. This first step is part of the regulated operating structure itself.
The internal notice should be factual and narrow. State when the withdrawal was requested, whether the broker acknowledged it, whether any compliance query was answered, and what remains unresolved. Attach broker statements, bank proof, and prior correspondence. Do not write a manifesto. Write a document that can later be forwarded to the regulator without embarrassment. In capital markets disputes, the first clean chronology often wins more respect than the first loud accusation.
If the broker fails to resolve the matter, the next stop is the CMA complaint machinery. The CMA’s public channels include an online complaints path through its eCitizen service, and the Authority has publicly directed investors with concerns to complaints@cma.or.ke and to its complaints and whistleblowing channels. That is not a guarantee of recovery, but it is the proper supervisory route before the matter becomes a more formal appellate or enforcement dispute.
The CMA stage works best when the complaint package is already coherent. That means you should include the legal entity name from the licensee directory, not just the brand name, together with account identifiers, dates, transaction references, prior support tickets, and the exact loss or withheld sum. If the complaint is really about a suspected clone rather than a licensed firm, say so early and attach the website, message, or caller details used. Regulators are much more effective when the complainant has done the basic sorting work first.
Where the dispute involves a decision of the CMA or a formal capital markets determination, the Capital Markets Tribunal becomes relevant. The Capital Markets Act establishes the Tribunal and says it hears written appeals by aggrieved parties following a determination by the Authority. The Tribunal may confirm, set aside, or vary the decision and may exercise powers that the Authority could have exercised in the matter. The Act also states that the Tribunal should hear and determine an appeal within ninety days from filing, and the Rules say the memorandum of appeal is to be presented within fifteen days after the decision appealed from was communicated. That is an important limit. It is important to understand that the Tribunal is not a generic customer service desk for every bad broker interaction. It is a statutory appellate body dealing with matters that fit its jurisdiction under the Capital Markets Act and related rules.
Note: If your problem is that you were duped by a fake site, you may need more than what the CMA can provide on its own. You can still contact the CMA, but prepare yourself for a situation where you might also need to explain the situation to the police, banks, mobile money providers, and special cyber crime reporting channels within the police system.
Defeating the 2026 KRA banking analysis
For tax purposes, it is important to distinguish between cash movement and taxable income, and it is very important to keep a clear paper trail. Under section 56 of the Tax Procedures Act, the burden is on the taxpayer to prove that a tax decision is incorrect. Kenya Law’s text of the Act says this directly, and recent tax cases keep repeating the same idea in practice. The burden of proof is not on the KRA or any other governmental authority.
That burden matters, especially now when the Kenyan courts are accepting banking analysis as a valid assessment method if records are weak. In Avery Lounge Limited v Commissioner of Domestic Taxes, decided on January 30, 2026, the High Court stated that bank deposit analysis operates on a rebuttable presumption, and that unexplained deposits in a business account constitute business income. In another case, one from 2025, the court stated that bank deposits are prima facie income unless explained and that documentary proof is needed to substantiate the non income nature of those deposits. For more info, see Tax Appeals Tribunal case Kirin Pipes Limited vs Commissioner, Intelligence Strategic Operations & Enforcement (Appeal E1116 of 2024), decided on 22 August 2025.
As you can see, the KRA can look at what flows into your account from your trading acocunt, and decide that all of it is taxable income, no matter how many losses and costs you have been hit with during the year. It is up to you to provide the documentation that shows a more full picture.
If you have proper documentation, you are in a much better situation if the KRA tries to take more than their fair share. This is not just relevant for traders, but for everyone in Kenya. Kenyan tribunal and court material show taxpayers arguing, sometimes successfully, that some deposits were loans, inter account transfers, soft loans from friends, or other non-sales items. The point is not that KRA always wins or always loses. The point is that once KRA uses bank deposit analysis, the taxpayer needs to provide documents, and not just angry letters. If you want a deposit treated as capital introduction, loan proceeds, self transfer, or returned funds, you need a record that shows exactly that.
For a retail forex trader, this creates a particular audit problem. Trading accounts generate lots of movement that is not all taxable gain. Initial capital paid into a broker is not profit. A transfer from your bank to your broker and then back again is not profit just because the money returned to you after sitting somewhere else for a while. A withdrawal can also be part capital return and part realized gain, making the situation more complex. KRA will not intuit those differences for you, so you have to make them legible by showing the appropriate documentation. If your trading activity creates taxable income, you need the return to match a clean documentary trail. A return filed on time but unsupported by bank and broker evidence is still weak if KRA later reconstructs cash movement independently.
This is where a trader’s ledger (See our Traders Ledger and Instructions) can become more useful than most platform account statements. It should be detailed enough to show, for every movement, the date, the source account, the destination account, the purpose, the broker reference, the local bank or M Pesa reference, and whether the amount is capital introduced, trading gain, capital returned, fee, internal transfer, or unrelated personal receipt. If KRA later performs a deposit analysis on your Kenyan bank or wallet, you need to be able to trace each suspicious looking inflow back to a prior outflow, a broker statement, or a separate legal source. That is how you rebut a presumption.
The ledger should separate at least four things in substance.
- The first is seed capital. This is money you introduced from salary, business savings, prior taxed income, or documented loans.
- The second is trading result. This is realized profit or loss after trades close, not the gross amount that moved through the broker account.
- The third is recycling of your own funds, meaning deposits and withdrawals that simply move your own capital between accounts.
- The fourth is external receipts not tied to trading at all.
If these four categories are mixed and unclear, you are handing KRA an ugly puzzle and then asking for sympathy. The Kenyan tax administration is not known for being particularly big on sympathy.
Of course, your ledger is not enough. You should also preserve any other documentation that can back up your claims, such as broker statements, funding confirmations, and withdrawal confirmations for every tax year. The documents that matter the most are usually the ones that tie a Kenyan bank or mobile money entry to a broker ledger entry and then tie that broker ledger entry back to the origin of funds. If your opening capital came from salary, keep the salary proof. If it came from sale of another asset, keep that proof. If it came from a loan, keep the loan agreement and the matching transfer path. Recent Kenyan case law is clear that once the taxpayer produces competent records, the burden does not remain frozen in one place. But without records, the presumption sits there quite comfortably.
Do not trust your broker to preserve all relevant information for you. Regularly save the information away from your broker account. (This will also come in handy if you run into problems with a broker, and need records to show their conduct. You don´t want all the evidence to be in their hands.)
There is one more point many traders miss. KRA now says it validates declared income and expenses against available records during the filing process, including withholding tax data and electronic invoice information where relevant. That does not mean KRA has a perfect real time map of every retail forex account. It does mean the Kenyan tax environment has shifted away from a casual self declaration culture. If your banking pattern looks like income and your file cannot explain why it is not, the law places the proof burden on you.
KRA filings
The annual filing mechanics are simpler than the evidence problem outlined above. KRA’s official guidance says individual income tax returns should be filed on or before 30 June of the following year, and its 2026 filing guidance confirms that the 2025 year of income was to be filed between 1 January 2026 and 30 June 2026. KRA also continues to state the resident individual bands that run from 10 percent to 35 percent, as shown below.
| Annual taxable income band | Rate |
| First KES 288,000 | 10% |
| Next KES 100,000 | 25% |
| Next KES 5,612,000 | 30% |
| Next KES 3,600,000 | 32.5% |
| Above KES 9,600,000 | 35% |
These are the published individual rates KRA shows as continuing from the Finance Act 2023 framework. KRA also states that resident individuals are entitled to personal relief of KES 28,800 per year.
The VASP Act
Many Kenyan traders who are interested in forex are also interested in cryptocurrency, either for pure speculation or for making deposits and withdrawals to a brokerage account. If you are one of them, you might already have heard about Kenya’s new Virtual Asset Service Providers Act.
The Virtual Asset Service Providers Act was assented to on 15 October 2025 and went into force on 4 November 2025. This Act is Kenya’s first comprehensive law regulating crypto and digital asset businesses. It´score purpose is to provide the legal framework to license and regulate the activities of virtual asset service providers (VASPs) in Kenya. Among other things, the law aims to reduce frauds, improve transparency, create a safer environment for traders and investors, and align Kenya with FATF standards. (FATF stands for the Financial Action Task Force, an international organization that sets global rules to fight money laundering, terrorism financing, and other illicit financial flows. It was created during a G7 Summit in Paris in 1989 in response to growing concerns about money laundering.)
Examples of VASPs:
- Crypto exchanges
- Crypto wallet providers
- Crypto brokers and crypto trading platforms
- Token issuers (ICOs, stablecoins, etc.)
- Portfolio managers for crypto
The law has established a dual-regulator model, where the Central Bank of Kenya and the CMA share responsibilities. The Central Bank of Kenya regulates things such as payments and stable coins, and is focus on financial system risks. The CMA regulates trading platforms, investment crypto activities, and similar. The new law has imposed serious compliance requirement for crypto businesses, including mandatory licensing, capital and solvency requirements, cybersecurity standards, custody standards, and ongoing reporting. Anti-money laundering (AML) and counter-terrorism financing (CTF) rules must be adhered to. If you are used to the CMA license requirements for ordinary retail forex brokers, you recognize the main lines.
The Virtual Asset Service Providers Act represents a big shift in Kenya, as businesses associated with cryptocurrency trading and related activities have been moved out of a largely unregulated gray area and into the auspices of the CMA and the Central Bank.
For traders, it is important to understand that the Act is broad enough to touch things such as stablecoin based account funding and cryptocurrency account flows. If a broker relationship or its affiliated payment flow involves cryptocurrency or similar digital asset services, the compliance picture stops being purely “forex broker plus bank transfer”, as it may engage the VASP statute.
This is where many traders create trouble for themselves without thinking about it. They fund a forex account through a stablecoin leg because it is faster, cheaper, or easier to move cross border. Then, months later, they suddenly face a banking compliance question and cannot explain the path cleanly. The money trail no longer runs from Kenyan bank to licensed Kenyan broker and back again. It runs through a virtual asset hop, sometimes across platforms and through entities outside the original trading relationship. Even if the trading profit itself is lawful, the evidential burden becomes heavier. The trail is now harder to narrate and easier to misread.
At the time of writing, in 2026, the details of the Act are still being implemented and worked out by the CMA and the Central Bank. Eventually, we will probably also begin to see court cases that will further clear up exactly what this new Act entails. Traders in Kenya are wise to expect more, not less, scrutiny over cryptocurrency linked funding channels. So the safe reading for the nearby future is that forex and crypto cannot be treated as separate paperwork universes anymore. If your broker or payment route touches digital assets, you should preserve those records with the same seriousness as bank and broker statements, because the compliance story is no longer single channel.
Spotting AI clone scams
Creating fake but serious looking trading sites is now easier than ever thanks to advance AI tools and the advent of “frauds-as-a-service” companies.
In a typical brokerage clone scam, the fraudster will clone the web site of a genuine and reputable company, including the web site layout and logos, and place it on a domain that looks legit.
Example: If the true brokerage site is XYZBroker.com, the scammer will use domains such as XYZBrokerTrading.com XYZForexBroker.com, XYZBroker.net, and similar. For scams targeting Kenyan traders, they can also set up sites such as XYZBrokerKenya.com or XYZBrokerAfrica.com.
Scamming online traders has evolved into a very large industry and specialized companies are even available for fraudsters who are willing to pay for the cloning and associated services, e.g. AI-voiced “customer service” lines that make victims even more certain they are dealing with a real and reputable brokerage company. AI-powered deepfakes are also used to impersonate not just general customer service staff, but also well-known people in the finance industry. AI can clone a voice using just a few seconds of audio, and even video chats can now be powered by AI.
Fraud-as-a-service (Faas) is making deep fakes very accessible to criminals around the world. Instead of one scammer doing everything, there’s now a well-developed criminal supply chain, where a single company can provide deepfakes (or tools to make your own deepfakes), phishing kits, databases of suitable victims, cloned brokerage sites, and more. Criminals don’t need to be skilled anymore, they can just “buy a scam”.
Financial authorities in many different countries have issued multiple warnings about fraudsters who, in a very convincing manner, steal the identity of a true and licensed brokerage company and use it to lure in victims. Sticking to a well-known brokerage brand is no longer enough, you absolutely need to verify the exact domain with the responsible regulatory body. For traders in Kenya, that means only using the exact brokerage web sites listed with the Central Market Authority (CMA). Do not let anyone lead you astray by promising you a big bonus and big perks if you sign up through XYZBrokerVIP.com instead of the listed XYZBrokerVIP.com.
For the April-June 2025 period, the National KE CIRT/CC reported that the sharp rise in detected cyber threats was linked partly to the growing adoption of AI driven attacks, and to the limited awareness of phishing and other social engineering techniques. That in itself is enough to justify a more suspicious operating posture, and not automatically believe broker communication is genuine just because it arrives through voice or video chat. For more information, read the full KE CIRT/CC report here: https://www.ca.go.ke/sites/default/files/2025-07/Cyber%20Security%20Report%20Q4%202024-2025.pdf. The link goes to a PDF on the Communications Authority of Kenya web site.
Cloned brokerage sites can be incredibly convincing, even going as far as posting the entire name, address, and license details of the real authorized firms. A few tiny details tend to be different though, e.g. the contact channels and how to make your deposit. The fraudsters do not want you to reach out to the real support department, and they definitely don´t want you to make a deposit into an account they don´t control.
The practical warning sign can be subtle. If “support” asks you to log in through a link they sent, verify a wallet, install remote software, or move money to “upgrade” an account, be suspicious. The best course of action is to only go through the link posted on the CMA licensee directory and stay within that universe. Do not accept other invites, e.g. the ones that show up through adds, in finance chat groups on Telegram, or as promo codes from financial influencers in social media.
Use the CMA register, the broker’s official Kenyan domain, and properly verified contact details. It is especially important to never trust information sent through a non-verified channel that is creating some type of urgency, since that is such a common scam tactic. Both positive and negative urgency should be treated with suspicion. “Time-Limited Once In A LifeTime VIP Offer” is just as sketchy as “Act immediately to prevent your trading account from being suspended”.
The verification protocol is boring, which is exactly why it works. First, confirm the legal entity on the CMA license directory. Second, confirm that the domain or app you are using matches the licensed entity’s own published materials. Third, if you receive a call or message, hang up and contact the broker using a verified channel. Fourth, treat credential entry and money transactions with outmost care. If you are about to type your password, or verify a transaction, you should know exactly which entity you are dealing with.
Reporting a clone scam in Kenya
If you have actually sent any money or think the fraudsters might have your bank/payment credentials, time is of essence, and you need to report the clone scam to your bank and/or payment processor right away, and make sure they understand that this just happened and need immediate attention. Banks and payment processors (including credit cards) often have an emergency phone number to call in this type of situation. Since fraud is criminal, you can also report it to the police, but stopping the money flow should be your first priority. A bank or payment provider can block transactions that have not yet been fully processed, and, if conditions are right, attempt a transaction reversal if money has already left your account. This is very time sensitive, and your best chance of actually recovering any funds, or at the very least block future attempts.
If you have not sent any money or shared credentials, your should still report the clone site to help protect others, but the situation is less urgent.
Recommended order:
- Bank and payment processors, if you have send any money or shared bank/payment credentials. This is about money recovery (when possible) and preventing additional transfers.
- CMA
- KE-CIRT/CC
- DCI
- CBK
- The brokerage company that is being impersonated.
Reporting to multiple entities can increase impact.
- CMA: cma@cma.or.ke or at https://www.cma.or.ke/contact-us
- KE-CIRT/CC: info@ke-cirt.go.ke or at https://ke-cirt.go.ke/report-incident
- DCI (Cybercrime Unit): cybercrime@dcikenya.go.ke or nearest DCI station
- CBK: fin@centralbank.go.ke
Capital Markets Authority Kenya (CMA)
The CMA can investigate, confirm if the firm is legitimate or not, and issue public warnings. Since the CMA is responsible for licensing brokerage companies in Kenya, they take is very seriously when someone is impersonating one of their licensees.
National Computer Emergency Response Team / Coordination Centre (National KE CIRT/CC)
This is Kenya’s national cybersecurity incident response and coordination body. It is responsible for detecting and responding to cyber threats, handling phishing, malware, and scam website incidents, and coordinating cybersecurity information sharing. It is a government agency under the Communications Authority of Kenya (CA), and works closely with the DCI.
Directorate of Criminal Investigations (DCI)
The Directorate of Criminal Investigations (DCI) is part of the Kenya Police Service. The DCI investigates crimes such as cybercrime, fraud, homicide, and organized crime. There are several highly specialized units operating within the DCI, including units that investigate cybercrime and financial fraud.
Reporting to the DCI is especially important if you want legal action and case tracking, rather than simply alert the authorities of a possible clone site.
Central Bank of Kenya (CBK)
The Central Bank of Kenya (CBK) can get involved when payments went through baking channels or Kenyan mobile money systems. They handle system-level complaints rather than investigate one particular case. Still, it can be worth reporting even isolated events to the CBK, since many individual reports help paint a broader picture for the CBK.
The platform where you were contacted
Contacting the platform where you were contacted (if applicable) can help shut down scam network channels, e.g. WhatsApp / Telegram / Facebook / Instagram. The same is true for web sites and add networks that the scammers use to advertise their scams.
Clone Trading Site Scam Report Template
You don´t need to use a specific form or format to report a clone trading scam to the Kenyan authorities online. You can even do it anonymously if you want to, and this is quite common when someone has not been the victim of a scam and simply wish to alert the authorities to protect others.
However, since many retail traders feel unsure about exactly how to file a report, we have included a Clone Trading Site Scam Report Template here. It can be helpful when you want to compose a clear report and make sure you include the right details. Preferable include contact information in the report, because the relevant authorities might want to reach out to you to obtain more information. This is especially important if you have actually sent any money or personal information to the clone site.
When you report a clone scam to the legitimate brokerage company, you can use a much shortened version of the template, since they are not a governmental authority, and should simply be made aware that someone is impersonating them.
To: [CMA / DCI / KE CIRT/CC / CBK]
Subject: Report of Suspected Clone Trading Site / Investment Scam
My Details:
- Full Name: [Your Name]
- Contact Email: [Your Email]
- Contact Phone: [Your Phone]
- Location: [City, Country]
Incident Details:
- Name of Suspected Trading Site / Platform: [e.g., ExampleTrading]
- Website URL: [https://www.example-trading.com]
- Claimed Licensing / Regulatory Status: [e.g., claims to be licensed by CMA and UK FCA]
- Date of Interaction: [e.g., 10 October, 2026]
- How I Found the Site / Contacted: [e.g., WhatsApp message, social media, ad]
Description of the Scam / Suspected Fraud:
- The website/platform appears to be a clone of a legitimate trading firm.
- The website/platform appears to be a clone of the legitimate trading firm ExampleTrading.
- Promises of unusually high returns / guaranteed profits.
- Requests for deposits / transfers via bank, mobile money, or crypto.
- No withdrawals allowed, or withdrawal attempts blocked (if applicable)
- Any other suspicious behavior (phishing emails, impersonated individuals, fake verification documents, high-pressure sales tactics).
Financial Details (if applicable):
- Amount sent: [Ksh / USD / Crypto]
- Payment method: [Bank transfer, M-Pesa, crypto wallet, etc.]
- Date of transaction: [e.g., 10 October, 2026]
Supporting Evidence (attach if possible):
- Screenshots of website / emails / messages
- Transaction receipts
- Names / accounts of people who contacted you
Request / Action Sought:
- Please investigate this suspected clone trading platform.
- Take necessary regulatory or law enforcement action.
- Alert the public if confirmed fraudulent.
Declaration:
I declare that the information provided is true to the best of my knowledge.
Name: ___________________
Date: [e.g., 15 October, 2026]
This article was last updated on: April 7, 2026