Where to report in Kenya

Kenya has several bodies with separate roles for receiving reports about investment platforms. This page explains who receives what: the CMA for capital-market matters, the DCI for fraud and cybercrime, the Central Bank for banks and payment providers, and your M-Pesa provider for a payment already sent.

The CMA for capital-market matters

The Capital Markets Authority receives reports about entities carrying on capital-market activities without a licence. If a platform is offering investments, forex, or other capital-market products and you suspect it is unlicensed, report it to the CMA.

Bring the platform's name, website, and any communication you have. The CMA may use the report to issue a caution. It does not recover money for individuals.

The DCI for fraud and cybercrime

The Directorate of Criminal Investigations receives reports of fraud and cybercrime. If you have been defrauded, or if a platform has taken your money and disappeared, report it to the DCI.

Bring evidence: screenshots, payment records, and any messages. The DCI investigates criminal conduct. It does not guarantee recovery, but a report helps build a case.

The Central Bank for banks and payment providers

The Central Bank of Kenya regulates banks and payment providers. If a bank or payment provider has acted improperly, or if you have a complaint about a payment to a platform, you can report it to the Central Bank.

The Central Bank does not regulate investment platforms. It regulates the institutions that move money. A complaint about a bank's handling of a payment goes to the Central Bank.

Your M-Pesa provider for a payment already sent

If you have sent money by M-Pesa to a platform, contact your mobile-money provider immediately. The provider may be able to reverse the payment if it is still pending, or to freeze the recipient's account.

The provider is not a regulator. It cannot decide if a platform is legitimate, but it can act on the payment itself. Report the payment as soon as possible.

What to bring to any report

For any report, bring the platform's name and website, the legal entity if you have it, the dates and amounts of any payments, and copies of all communication. Screenshots and payment confirmations are evidence.

Write down the sequence of events before you report. A clear timeline helps the body you report to understand what happened.

No promise of recovery

No body can promise that you will get your money back. Reporting helps the authorities see the pattern and may lead to action against the platform. But recovery is not guaranteed.

A report is still worth making. It may prevent others from losing money. Keep your own records, and be cautious about anyone who promises to recover your money for a fee.

The CMA handles licence questions, not criminal complaints

When a platform is not on the CMA licensee list, the authority can confirm that absence and may already have published a caution. But the CMA is not the body that investigates fraud or freezes money. Its role is market conduct and licensing, and its enforcement options are administrative, not criminal. If you report to the CMA expecting an arrest or a refund, the file may simply sit.

The practical consequence is that a CMA complaint works best when it describes a licensing breach: an entity holding itself out as licensed when it is not, or offering a regulated product without approval. The CMA can then act within its mandate, which includes issuing cautions, suspending licensees, and referring matters to other agencies. It cannot compel a platform to return your M-Pesa.

That referral is where the order of operations matters. If you have lost money, start with the DCI for the criminal angle and your payment provider for the transaction record. The CMA report is a parallel step, not a substitute. Each body keeps its own files, and none of them will automatically tell the others what you have filed.

The DCI wants a paper trail that starts with your own records

The Directorate of Criminal Investigations does not open a file on a story alone. Detectives need the same artefacts a bank would ask for: the M-Pesa confirmation messages, the platform's account name, the phone numbers used, and the chat history from the group where the offer appeared. Without these, the complaint is an anecdote, and an anecdote does not move an investigation.

What many Kenyans miss is that the DCI's cybercrime unit works from the payment first, not the platform. M-Pesa leaves a trail that can be traced to the receiving wallet, and from there to the registered owner of that line. If you have sent money in several small amounts, collate them into one chronology before you visit the station. That single sheet saves the officer an hour of reconstruction and makes the file easier to escalate.

A common failure is reporting to the DCI before getting the transaction statement from Safaricom or your bank. The officer may ask for it, and you will make a second trip. Request the statement online or at a shop first, then attach it to your complaint. The DCI can subpoena records, but a complainant who brings their own evidence moves the case faster.

The Central Bank does not receive complaints about individual platforms

The Central Bank of Kenya licenses banks, microfinance banks, and payment service providers. It does not license forex brokers or investment platforms, and it does not take complaints from the public about a specific trading app. If you write to the CBK about a platform that took your money, the reply will tell you to go to the CMA or the DCI.

Where the CBK matters is when the payment itself went through a mobile money provider or a bank. If M-Pesa or a bank moved your money to a wallet that then vanished, the CBK's consumer protection guidelines apply to that payment institution, not to the platform. You can raise a dispute with the payment provider first, and if that fails, escalate to the CBK as the regulator of that provider.

The distinction readers get wrong is between the platform and the payment rail. The platform is not a CBK licensee unless it is a bank or payment provider. The payment rail is. So the CBK will not investigate the platform, but it can ask the payment provider why its systems allowed a suspicious wallet to operate. That is a separate complaint, and it is worth filing in parallel.

Your M-Pesa provider can sometimes reverse a payment, but only at speed

Safaricom and other mobile money operators have a window for reversing a mistaken or fraudulent payment. The window is short, often measured in hours, and it closes once the recipient has withdrawn the funds or moved them onward. If you realise something is wrong the same day, call the provider before doing anything else. Every minute spent composing a long explanation reduces the chance of a reversal.

The request must go through the provider's official channels, not through a social media contact. Dial the customer care line, use the app's dispute feature, or visit a shop with your ID. The provider will ask for the transaction ID, the amount, and the receiving number. It will not ask you to prove the platform was unlicensed, because the reversal is about the payment itself, not about the platform's conduct.

What people do not expect is that a reversal is not a refund. If the provider recovers the money, it returns the amount to your wallet. If the recipient has already cashed out, the provider will not compensate you from its own funds. That is why the first call matters, and why waiting for the CMA to act before contacting M-Pesa is a mistake. The two processes run on different clocks.

A report to one body does not automatically open a file at another

Kenya's regulatory landscape is split: the CMA for capital markets, the CBK for payments, the DCI for crime, and the mobile money provider for transactions. None of these bodies shares your report with the others as a matter of course. If you file with the CMA, the DCI will not know. If you file with the DCI, Safaricom will not be alerted unless the DCI sends a formal request.

The consequence is that a single report rarely covers all the bases. A complete response means filing with at least three places: the DCI for the fraud, the payment provider for the transaction, and the CMA for the licensing breach. Each filing should reference the others, but each must be made separately. There is no central intake desk for financial complaints in Kenya.

A practical order is to start with the payment provider because the reversal window is shortest, then go to the DCI with the transaction record, then file with the CMA as the market conduct regulator. If a bank was involved, the CBK complaint about the payment provider comes last. This sequence uses each body's strengths without waiting for one to finish before starting the next.

The CA and the ODPC receive complaints about the messages, not the money

The Communications Authority of Kenya regulates the networks and the content sent over them. If a platform advertises through bulk SMS or a WhatsApp group, the CA can act on the sender of that message, not on the platform itself. The complaint is about unsolicited or misleading communication, and the remedy is usually a block or a fine on the sender, not a refund to you.

The Office of the Data Protection Commissioner handles misuse of personal data. If a platform obtained your phone number from a leaked database or shared it without consent, that is an ODPC matter. But the ODPC will not investigate whether the platform was licensed or whether it defrauded you. Its focus is the data trail, and its orders can stop further misuse but cannot recover your money.

These two bodies are often forgotten because they do not deal with money directly. Yet they are the ones that can stop the adverts from reaching more people. Filing with the CA about a persistent SMS sender, or with the ODPC about a list your number appeared on, adds pressure on the people behind the promotion. It does not replace the DCI or the CMA, but it narrows the platform's room to operate.

A police abstract is not the end of the matter

When you report to a police station, you receive an OB number and, if you ask, a police abstract. That abstract records that you made a report; it does not mean an investigation has started, and it does not freeze any account. The abstract is useful for insurance claims or for showing a bank that you reported, but it is not a finding of fraud.

The file moves only when the DCI's cybercrime unit or the local CID takes it up. That requires a formal statement, copies of your evidence, and sometimes a follow-up visit. If you walk away with just the abstract and do nothing else, the report may never be acted on. The abstract is a receipt, not a result.

A common mistake is assuming that the police will contact you with updates. They will not, unless you call the investigating officer or visit the station. Keep the OB number, note the officer's name, and check in after a week. Persistence is what turns a filed report into an active investigation. The abstract alone will not recover your money or stop the platform.

Reporting after the fact changes what you can say, not what you can recover

Once money has moved through several wallets and been withdrawn as cash, the trail goes cold. The DCI can still investigate, but the chance of recovery drops sharply. Reporting late is still better than not reporting, because it creates a record and may help others, but the report will not bring back what is gone. The timing of your report matters more than the wording.

What you can say after the fact is different from what you could have said before. Before sending money, a check against the CMA licensee list and the cautions might have stopped you. After sending, the report is about the payment, the people, and the platform's conduct. It is a different kind of report, and it goes to different desks.

The lesson for the next time is not to rely on a single check. The CMA's lists are updated when the regulator acts, not in real time. A platform can be unlicensed and uncautioned today and cautioned next week. The check that matters is the one you do before each payment, and the report you file after a loss is the one that may protect the next person. Neither replaces the other.