In Part Four of this series, we stepped away briefly from the data trail and followed the money into Muthaiga, where Pax Manor enters the Odibets story as the luxury face of a betting economy that began with ordinary Kenyans staking small amounts on their phones and ended with elite property, diplomatic neighbourhood branding, staff complaints and the quiet confidence that usually comes when gambling wealth starts dressing itself as respectable business.
Part Five returns to the documents because every serious corporate scandal eventually leaves the polished mansion and walks back into company records, licences, regulators, directors, shareholders, bank accounts, compliance files, customer acquisition systems and the official paperwork that powerful people rely on when they want to look clean in public.
Odibets is not just a colourful betting brand. Behind the name sits Kareco Holdings Limited, the company associated with the Odibets platform and now placed inside a wider scandal involving alleged Safaricom subscriber data, the 11.5 million punters profile, and the questions raised before investigative and regulatory agencies over whether Odibets, Kwikbets and other betting companies benefited from unlawfully obtained customer information. The public sees odds, jackpots, bonuses and adverts, but investigators are now being pushed towards the architecture behind the platform, because the real story of any betting empire is never only on the front page of the app. It sits in the company structure, licensing history, directors, beneficial owners, payment systems, data sources, marketing agencies and regulatory files.
This is where Kenya’s gambling industry has always enjoyed dangerous comfort. Betting companies have been allowed to sell hope aggressively to a wounded population while hiding the most important parts of their operations behind corporate language, licensing paperwork and public relations. They present themselves as entertainment businesses, yet their business model depends on repeated deposits, constant targeting, fast customer acquisition and the ability to keep punters returning even after losses. Once the Safaricom data scandal entered the picture, the question stopped being whether the companies had licences and became whether the customer databases that powered their growth were acquired lawfully.
The complaint placed before the Directorate of Criminal Investigations and the Gambling Regulatory Authority of Kenya alleges that former Safaricom employees accessed and sold customer data between June 2018 and May 2019, including names, identification details, M-Pesa transaction histories, geolocation information, device identifiers, betting patterns, gambling frequency, amounts wagered and preferred betting platforms. It also places Odibets, Kwikbets and other betting companies within the wider trail requiring scrutiny over the alleged receipt, use or commercial benefit from unlawfully obtained Safaricom subscriber information.
That is where the regulator’s failure begins to look too large to ignore.
A gambling licence should not be treated as a decorative certificate hanging on a wall while the real business happens in databases, third-party marketing arrangements and customer profiling systems that nobody audits properly. A licence should mean that the regulator understands who owns the company, who funds it, who controls it, how it acquires customers, how it stores data, how it targets users, how it protects vulnerable gamblers and how it proves that every customer database used in marketing was lawfully obtained. Anything less turns licensing into theatre.
Odibets grew inside a market where the regulator was always chasing the industry from behind. Betting companies were moving faster than oversight. Apps were spreading faster than policy. SMS promotions were reaching punters faster than consumer protection. Young men were losing money faster than public officials could understand the psychology of digital gambling. By the time government started pretending to tighten the sector, the major players had already built brands, databases, political networks, supplier chains, payment systems and public visibility.
That is how corporate comfort is created. First the company grows quickly, then the regulator starts treating its size as legitimacy, then the public becomes used to seeing the brand everywhere, then politicians start appearing near the money, then the company becomes too visible to question without triggering lawyers, lobbying and quiet phone calls from people who benefit from the ecosystem.
Kareco Holdings now sits inside that exact problem.
The question is no longer merely whether Odibets was licensed to operate. The question is whether the licensing authorities ever properly interrogated the company’s data foundations, customer acquisition history, marketing suppliers, third-party data vendors, associated intermediaries and the beneficial actors behind its rapid rise. A betting company can have a licence and still have serious questions to answer about how it built the database that made the licence profitable.
That distinction matters because the real value in betting is not the licence alone. The real value is the customer. The real value is knowing who bets, how often he bets, how much he can lose, where he is located, when he deposits, which games attract him and how he responds after losing. A licence merely opens the door. Data determines how much money comes through that door.
This is why the alleged Safaricom punters file is so dangerous. It allegedly gave access not just to ordinary subscribers, but to behavioural information around gamblers. In a clean market, a betting company earns that knowledge slowly from customers who willingly sign up, deposit, bet and interact with the platform. In a dirty market, a company buys a shortcut from people who already know where the gamblers are. That is the difference between competition and predation.
The records around Odibets, Kareco Holdings, Kwikbets and other betting companies must therefore be read as a corporate maze, not as isolated brand names. The maze includes the licensing documents, company ownership records, beneficial ownership disclosures, tax filings, supplier contracts, payment processors, marketing agencies, data vendors, communication logs, bank accounts, M-Pesa records, internal campaign records and any third-party agreements entered during the period when the Safaricom data was allegedly moving.
This is where Kenya’s regulators have repeatedly failed the public. They look at companies as paperwork instead of systems. A company files documents and gets a licence. A company pays fees and continues operating. A company advertises responsibly in public while its real acquisition machinery remains hidden. A company claims it follows the law, yet nobody opens the servers, nobody audits the marketing databases, nobody traces the data vendors, nobody examines whether the people being targeted consented to the use of their information.
That weakness created room for the betting industry to grow aggressively inside the private lives of Kenyans.
The Gambling Regulatory Authority cannot examine this scandal only as a licensing matter. It must be understood as a data-driven customer acquisition scandal, where the central question is how betting operators obtained the lists, numbers, profiles and behavioural intelligence used to reach punters. The Data Commissioner cannot treat it only as a Safaricom breach, because the downstream commercial use of stolen information is where the real harm matures. Law enforcement cannot stop at former telco employees, because the value of stolen data is completed only when a buyer turns it into business advantage.
The Odibets files show why Kenya must begin treating data as the new currency of corruption. In the old economy, cartels fought for tenders, land, procurement and public contracts. In the new economy, the most valuable thing is the private behaviour of citizens. A company that knows where people are weak can build wealth faster than a company that merely advertises. A betting company that knows who is already gambling enters the market with an advantage that cannot be seen on billboards.
That is why the corporate structures matter.
The public must know who really controls Odibets, who benefits from Kareco Holdings, who handled customer acquisition, which agencies were contracted, which consultants appeared during the period under review, which accounts paid for marketing data, which persons linked to Safaricom insiders communicated with betting interests, and which internal officials approved the use of external lists. This is not about curiosity. It is about establishing whether the betting empire was built only through lawful competition or whether stolen telco intelligence helped build the machine.
Corporate scandals in Kenya usually survive because they are made boring. The moment the issue enters company law, regulatory language, beneficial ownership, compliance files and licensing procedure, the public begins to lose interest. That is the point at which the powerful people relax because they know ordinary Kenyans are more likely to understand a stolen phone than a stolen database, more likely to understand a fake tender than a customer acquisition file, and more likely to understand a brown envelope than a data vendor contract.
This series will not allow the scandal to hide inside boring language.
Kareco Holdings must be understood as the corporate vehicle behind the Odibets brand. Odibets must be understood as one of the betting platforms whose rise is now being examined against the background of the alleged Safaricom data breach. The regulator must be understood as the public body that was supposed to ensure that betting operators did not build market power through unlawful customer profiling. The Data Commissioner must be understood as the office that must follow personal information beyond the moment of theft and into the commercial systems where it was allegedly exploited.
The public also needs to understand how customer databases become corporate assets. A betting platform with a huge database can raise money, attract partners, negotiate suppliers, expand into new markets, run campaigns, sell confidence to investors and appear stronger than competitors. The database becomes part of the company’s value even when the public never sees it. If any portion of that database was built from unlawfully obtained Safaricom information, then the problem is not just privacy. It becomes corporate enrichment from stolen personal data.
That is where asset recovery enters the conversation.
If stolen customer data helped create market share, revenue, brand value and business expansion, then the financial benefit cannot be measured only by the price allegedly paid for the data. It must be measured by the profits generated from customers targeted through that data, the valuation built from those customers, the properties bought from the resulting wealth and the corporate power accumulated during the period when regulators were asleep. A stolen database can become a betting platform’s invisible engine, and once that engine produces money, the proceeds move into property, influence and respectability.
This is why Pax Manor, discussed in Part Four, was not a distraction. It was a lifestyle footprint. The corporate records now complete that picture by showing that gambling wealth must be followed from the punter’s phone into the company structure, from the company structure into the bank accounts, from the bank accounts into assets and from the assets into the social power that makes owners appear untouchable.
The public must also look at the role of political protection in the betting industry. No sector that handles billions, targets millions of citizens and operates through heavily regulated licences grows without building relationships with power. Betting companies need regulatory comfort, tax comfort, advertising room, payment channels, legal protection and political silence. Once such companies become rich enough, they stop behaving like ordinary licensees and start behaving like institutions that can negotiate with the state.
That is dangerous because a regulator that fears the companies it supervises has already failed.
The Odibets and Kareco Holdings trail now exposes the central weakness in Kenya’s regulatory culture. Public agencies wait until damage has already occurred, then issue letters, hold meetings, request explanations and create the impression of movement. But a serious regulatory system would have already audited customer acquisition methods in the betting sector, forced operators to disclose data sources, examined third-party marketing arrangements, punished unlawful targeting and protected vulnerable gamblers from being hunted through stolen intelligence.
The scandal also exposes Safaricom’s unfinished responsibility. Safaricom cannot only present itself as a victim of rogue employees while millions of customers are left wondering where their data went and who used it. If the company’s systems allowed such sensitive customer information to be extracted, then Safaricom’s duty does not end at cooperating with investigators. It must also help establish which companies received the data, which customers were exposed, what information was compromised and how the victims will be protected from continuing commercial exploitation.
The public has been told for years to trust digital systems. Register your SIM card. Use M-Pesa. Link your identity. Pay through the phone. Bet through the phone. Borrow through the phone. Save through the phone. Live through the phone. Yet when the private information inside those systems allegedly walks into the betting industry, the same public is expected to remain calm while companies hide behind procedure.
That calm is exactly what the powerful rely on.
Part Five therefore places the corporate maze at the centre of the scandal. Odibets is not just a brand. Kareco Holdings is not just a company name. Kwikbets and other betting companies are not just side characters. The regulator is not just a licensing office. Safaricom is not just the breached telco. Together, they form the architecture of a scandal where data, gambling, money, licensing and public silence meet.
This series will now move deeper into the corporate records, licence history, ownership questions, customer acquisition machinery, data sources and regulatory blind spots that allowed Kenya’s betting industry to grow while the private behaviour of millions of citizens allegedly became a commercial asset.
In Part Six, we will examine the 11.5 million punters themselves, the human beings behind the file, the men who were not just gambling but being studied, and how Kenya’s economic pain became the raw material for one of the most aggressive betting economies in Africa.