Online trading platform in Kenya? Check it before you deposit

Start with facts you can verify

A website, app or WhatsApp contact may offer forex, shares, commodities, crypto assets or managed trading. It may show live prices, account balances, successful withdrawals and messages from a helpful “account manager.” Those details can look convincing, but they do not answer the most important questions: what product are you buying, which legal entity holds your money, who regulates the activity, and how can you withdraw?

Do these checks before sending money or uploading an ID. They cannot guarantee a profit or prove that every future interaction will be safe. They can help you distinguish verifiable facts from sales claims and stop before an unexplained mismatch becomes a loss.

1. Define the product before checking the provider

Write down what the platform says you will receive. Is it access to trade currencies yourself, a managed forex account, a share or fund, a commodity contract, a crypto asset, a copy-trading service, training, or only trading signals? These are not interchangeable. The licence and protections that may apply depend on the actual activity, not the words “investment,” “broker” or “trading” in an advert.

Ask who will execute the trades, who will hold client money and assets, how the provider earns its fee, and whether returns depend on market performance or on recruiting new depositors. Get the terms in writing. If the explanation changes between the advert, salesperson, website and payment screen, pause until the provider resolves the difference.

The Capital Markets Authority describes online foreign-exchange brokers as firms that give currency traders access to a trading platform. It distinguishes dealing brokers, non-dealing brokers and money managers. That distinction matters: a company authorised for one role should not be assumed to have every other permission.

2. Match the exact legal name and licence category

Find the provider's legal name in its terms, privacy notice and account agreement. Record any trading name, company number, physical address and licence number it claims. Then open the current licensee register from the Capital Markets Authority's own website and match the exact legal or trading name, licence category and website.

Do not accept a similar name, logo, screenshot of a certificate or licence number typed into a chat as a match. Open the regulator's record yourself. If the platform says it acts through a different licensed company, ask for the written relationship and verify that company through contact details found independently.

The Central Bank of Kenya has advised the public to confirm the licensing status of online forex dealers through CBK or CMA before dealing with them. A result in one register still needs context: confirm that the listed category covers the product and service you are being offered now.

If you cannot find the provider, do not turn that absence into a public accusation. Ask which Kenyan regulator and licence apply, then verify the answer with that regulator. A foreign licence may tell you something about a provider abroad, but it does not automatically establish what Kenyan protection or complaint route applies to your account.

3. Check the website without treating domain age as a verdict

Type the address carefully. Compare every letter with the website shown in the regulator's record and with the address in the signed terms. A copied site can add a word, hyphen or different ending while reusing a real company's name and logo.

For generic top-level domains, ICANN directs users to its RDAP-based Lookup service for registration data. Use it to check the domain's creation date, registrar and technical status where those details are public. A recently created domain can be a reason for more verification if the site claims a long history. Hidden registrant details are common, however, and an old domain can change hands. Neither a new nor an old registration proves whether an offer is genuine.

Search the exact domain, legal name, phone number, email address and payment identifiers on ScamBusterKE and a general search engine. Treat community accounts as warning signals to investigate, not as a court or regulatory finding. No matching report does not prove safety; a new identifier may have no public history.

4. Verify the person contacting you through a second channel

Do not rely on a WhatsApp profile, social-media account, video call or knowledge of your name and previous messages. Contact the licensed entity through the phone number or email published in its regulator record or official website. Ask whether the representative, offer, account number and deposit instructions are theirs.

Be cautious when a contact moves you from a public advert to a private group, offers to trade on your behalf without clear authority, asks for remote access to your phone, or says a special return is available only if you deposit immediately. A legitimate verification step should survive a pause and an independent call.

Keep control of your account. CMA's investor guidance says investors should take responsibility for their own trading account and receive relevant transaction documents and statements. Do not give a salesperson your password, PIN, one-time code, screen-sharing access or control of the account.

5. Confirm where the deposit will go

Before approving an M-PESA, bank or card payment, compare the recipient name with the verified legal entity and the funding instructions inside your independently opened account. Stop if you are asked to pay a personal number, an unrelated business, a crypto wallet or a replacement account that is not confirmed through the provider's official channel.

Do not let a small first payment lower your guard. A platform may credit an on-screen balance without showing that money is held in a client account or that the displayed gains can be withdrawn. Record any fees, currency conversion and the party that will process withdrawals before you fund the account.

Never borrow simply because an agent says a trade is certain. CMA's investor information advises beginners not to borrow to invest and stresses that investments carry risk. A promise of guaranteed profit, recovery of earlier losses or a risk-free trade is a reason to stop and independently reassess the offer.

6. Read the withdrawal rules before funding

Find the minimum withdrawal, processing time, fees, identity checks, inactivity rules, bonus conditions and account-closing process. Save a copy of the terms that apply on the day you deposit. Ask who decides a dispute and which jurisdiction governs the agreement.

A successful small withdrawal can show that one request was paid; it does not prove that a later or larger request will succeed. Do not keep increasing deposits only because an app displays profits. If a withdrawal is refused, do not send a “tax,” “unlock,” “clearance,” “insurance” or “verification” payment to release the balance unless the charge is documented in the signed terms and independently confirmed through the regulated provider.

If the provider says market losses explain a lower balance, ask for the trade confirmations, prices, fees and account statement. An on-screen number by itself is not a transaction record.

7. Preserve a private record and report through the right channel

Keep the account agreement, adverts, domain, legal and trading names, claimed licence details, deposit instructions, receipts, trade confirmations, statements, withdrawal requests and support correspondence. Keep originals and note the timeline while it is fresh.

Do not publish an unredacted ID, bank statement, M-PESA message, account number, password, PIN, one-time code or unrelated private conversation. If you submit a community report, describe what you personally experienced and which public identifiers were used. Avoid declaring that a person or company committed a crime; reports are accounts from users, not findings of guilt.

For a complaint about a licensed provider, start with the provider's formal complaints process and keep its response. CMA says it can receive complaints touching the capital market and publishes a complaints route. If the concern involves a provider claiming a CMA-regulated role, use CMA's current complaints information rather than a contact copied from a stranger's message. Contact your bank, card issuer or mobile-money provider promptly as well if a payment or account may be at risk.

8. Use a stop rule before you deposit

Do not fund the account until all of these answers agree: 1. You can explain the product and its risks in plain language. 2. The legal entity and relevant licence category match a current official record. 3. The regulator's website, the platform domain, the agreement and the representative's identity connect through independently verified channels. 4. The payment recipient matches the verified funding instructions. 5. You have read the fees and withdrawal rules and kept a copy. 6. You can afford the loss without borrowing or sacrificing essential expenses.

One unresolved mismatch is enough to pause. Pressure to act before you can complete these checks is not a reason to skip them.