Casino licensing authorities, September 2026

A licence is not a quality mark. It is a complaints procedure with a regulator attached.

That sentence is the entire argument of this page, and it is worth sitting with, because almost every casino site in this industry treats "licensed and regulated" as a full stop. It is not one. It is the beginning of a question: licensed by whom, holding what obligations, answerable to a body that does what when a player says the operator has behaved badly?

The answers differ enormously. A UK Gambling Commission licence and an Anjouan licence appear as identical badges in an identical row at the bottom of an identical page, and they represent obligations that are not in the same category as one another. One comes with statutory consumer protection, mandatory dispute resolution, a national self-exclusion register and a public enforcement record. The other comes with a certificate.

Each of the regulator pages covers one authority: what it requires, how you complain to it, what it has actually done. This page covers what those requirements are for, so that the differences between them mean something when you read them.

The three tiers, and what separates them

Regulators sort into three groups, and the dividing line is not strictness for its own sake, it is whether the regulator has any practical power over an operator on your behalf.

National regulators licence operators to serve one specific market and can remove that market. UKGC, GGL, Spelinspektionen, Kansspelautoriteit, DGOJ, ADM, Spillemyndigheden, ONJN, AGCO and the Estonian Tax and Customs Board all sit here. They are the strongest position a player can be in, because the operator's access to a revenue-generating market depends on the regulator's continued goodwill.

Established international regulators licence operators to serve many markets from one jurisdiction. The Malta Gaming Authority is the largest by a distance; Gibraltar, the Isle of Man and Alderney are smaller and, in the case of the latter three, notably selective about who they take. These carry real obligations and a real complaints process. What they lack is the national regulator's leverage: losing an MGA licence is expensive, but it is not the same as losing access to Germany.

Offshore regulators issue licences with light-touch supervision. Curaçao dominates this tier by volume, Anjouan has grown quickly, and Kahnawake occupies an unusual middle position with a longer record and a smaller book. A complaint here goes to a body with limited staff, limited appetite and, historically, limited follow-through.

What every regulator requires

There is a floor, and it is worth knowing so that the tier differences are visible against it. Any licence worth the word requires four things.

Segregated player funds. Your balance is held separately from the operating company's working capital, so that if the business fails the money owed to players is not simply an asset of the estate. How strictly this is enforced, and whether it is audited, is one of the sharpest differences between tiers.

Independent RNG certification. The random number generators behind the games are tested by a laboratory, eCOGRA, GLI and iTech Labs are the common names, and the certified return-to-player figures are the ones published. This is the part of casino regulation that works best, and game fairness is genuinely not where the problems in this industry are.

Anti-money-laundering procedure. Identity verification, source-of-funds checks above thresholds, transaction monitoring. This is the obligation players experience most directly and resent most, because it is the reason a withdrawal stops for documents.

Responsible gambling tools. Deposit limits, loss limits, session reminders, cooling-off, self-exclusion. Every licence requires them to exist. Only some require them to be prominent, and only some connect them to anything outside the single operator.

What only some regulators require

Above the floor, the differences are where a licence stops being a formality.

Mandatory alternative dispute resolution. An independent body that adjudicates player complaints, at the operator's expense, with a binding or near-binding outcome. The UK requires it and names approved ADR providers; Malta operates its own player support function and requires ADR referral. Offshore licences generally do not, which means the complaints process ends at the regulator's inbox.

Cross-operator deposit limits. Germany caps deposits at €1,000 per month across every licensed operator, tracked centrally. No other market goes this far, and it is the single most restrictive consumer protection measure in European gambling.

National self-exclusion registers. One registration locks you out of every licensed operator in the market. GAMSTOP in the UK, Spelpaus in Sweden, ROFUS in Denmark, OASIS in Germany, Cruks in the Netherlands, RGIAJ in Spain, RUA in Italy. This is the most important consumer protection any regulator provides and offshore licensing has no equivalent to it at all.

Stake and speed limits. Germany caps slot stakes at €1 per spin and enforces a minimum spin duration. The UK has introduced online slot stake limits. Most other markets have not.

Affordability and financial vulnerability checks. The UK has moved furthest here, requiring operators to run checks at defined loss thresholds. It is the most contested area of gambling regulation anywhere, disliked by operators for the friction and by a substantial share of players for the intrusion, and defended by the regulator on harm-reduction grounds.

Land-based and online are different licences

A casino brand you recognise from a high street or a strip does not automatically hold an online licence, and the two regimes are supervised separately almost everywhere.

This produces two traps. The first is brand borrowing: a well-known land-based name appearing on a website operated by an entirely different company under a licensing arrangement, with none of the physical operator's compliance history behind it. The second is the reverse assumption, that an online operator's licence covers a physical venue, or that a land-based regulator's oversight extends to the website.

Germany's OASIS register is the notable exception in that it spans both, which is why it is unusually effective as a self-exclusion tool. Most markets run parallel systems, so registering an exclusion online does not necessarily block you in a venue and vice versa.

The practical check is the same as always: the operating company on the website's terms, matched against the online register of the regulator named in the footer. A familiar name in the logo tells you nothing about who is holding your balance.

The gap between what players expect from a regulator and what regulators do is wide enough to cause most of the disappointment in this area, so it is worth stating both sides plainly.

What they will do. Set the conditions an operator must meet to hold a licence. Investigate operators against those conditions. Fine, suspend and revoke. Require ADR where the licence demands it. Publish enforcement decisions, which is more useful to you than it sounds. Operate or mandate participation in a national self-exclusion register.

What they will not do. Adjudicate your individual dispute in most cases. Recover your money. Move quickly, enforcement runs on a scale of months and years, not days. Act on a single complaint. Help you at all if the operator is not licensed by them, which is the situation most players who need help are actually in.

That last point deserves emphasis. If you play at an operator licensed in Curaçao while living in a market with its own regulator, your national regulator has no jurisdiction over that operator and the Curaçao authority has no meaningful presence in your market. You are, in practical terms, unregulated, regardless of what the footer says.

The path a complaint actually takes

Complaints have a sequence, and skipping a step usually means being sent back to it.

Step one: the operator. In writing, through the formal complaints channel rather than live chat, with dates, amounts and the specific clause in dispute. Live chat is a support channel and does not create a record the regulator will read. Most licences require the operator to respond within a defined window, commonly eight weeks.

Names worth knowing before you need them: IBAS and eCOGRA are the ADR bodies most often named on UK-facing licences, and the Malta Gaming Authority runs its own player support function that performs a comparable role for its licensees. Each publishes the scope of what it will consider, most will not touch a dispute about the outcome of a game, and all of them will consider a dispute about the application of a term. Knowing which category your complaint falls into before you file it saves a rejection and a restart, and the operator is required to tell you which body covers it.

Step two: alternative dispute resolution. If the operator's licence carries an ADR requirement, the operator must tell you which body and must fund the referral. The ADR body reviews both sides and issues a decision. This is where most legitimate disputes are actually resolved, and it is free to the player.

Step three: the regulator. Regulators do not usually adjudicate individual complaints, an important and widely misunderstood point. They collect them, look for patterns, and act against operators whose complaint volume indicates a systemic problem. Your complaint may not get your money back. It may well contribute to the licence review that stops the same thing happening to the next hundred players.

Step four: courts or payment reversal. Rarely worth it for typical sums, and card chargebacks against gambling transactions are difficult and can result in account closure. Realistic only for large amounts with strong documentation.

Keep records from the beginning: screenshots of terms as they were when you accepted them, transaction IDs, chat transcripts. Terms change, and the version you agreed to is the version that binds, but only if you can produce it.

Reading a regulator's enforcement record

Every serious regulator publishes its enforcement actions, and this is the most useful and least read public data in the industry.

The UK Gambling Commission's record is the most detailed: named operators, the specific failings, the penalty, and usually a description of the remediation required. The Malta Gaming Authority publishes decisions and licence suspensions. The Dutch, Swedish, Danish and German regulators publish their own. Reading a handful takes twenty minutes and it recalibrates what "licensed" means faster than any amount of general explanation.

The counter-intuitive part: a regulator with a long enforcement record is a good sign, not a bad one. It means the rules are enforced. A regulator with no public enforcement history has either an implausibly perfect licensee base or no enforcement function. When you compare Curaçao's public record against the UKGC's, the difference is not that Curaçao licensees behave better.

We read these records when we write our casino reviews, and where an operator or its parent company appears in one, we say so in the licensing section of the review rather than leaving it for a reader to find.

Segregated funds, and the day it matters

Most of the time the segregation rule is invisible. It becomes the only thing that matters on the day an operator stops paying.

Online casinos do fail. When one does, the question is whether player balances were ring-fenced in a separate account, in which case there is money to distribute and a mechanism to distribute it, or whether they were working capital, in which case players join the queue of unsecured creditors and the queue does not usually reach them.

Strong regulators require segregation, audit it, and in some cases require the funds to be held in trust or backed by a bank guarantee. Weak regulators require it on paper. You cannot verify which from the outside, which is exactly why the tier of the licence is doing so much work as a proxy.

The practical response is not to research corporate structures. It is to not leave a balance sitting at an operator you are not actively playing at. Withdraw after a session. It is the single most effective thing a player can do to limit exposure to an operator failure, and it costs nothing at a casino that pays fast, which is most of the fast-payout list.

A casino serving several markets needs a licence in each regulated market it serves, plus usually an international licence covering everything else. This is why the footer lists Malta, Sweden, Germany and the UK together.

The consequence for you is specific and often missed: you are covered by exactly one of them, whichever licence covers the market you are playing from. A German player at a multi-licensed operator plays under the German licence, subject to German stake and deposit limits, with recourse to the German regulator. The Maltese licence in the same footer is irrelevant to that player.

This is also why the same brand can look completely different in two countries: different bonus rules, different limits, different game availability, sometimes different withdrawal times. It is not inconsistency. It is four regulators.

Our review pages list every licence an operator holds and link each to its regulator page, so you can find the one that applies to you rather than assuming the strictest name in the list covers you.

The white-label problem

Many casinos are not companies at all. They are brands operating under someone else's licence, on someone else's platform, with the licence holder legally responsible for the operation.

White-label arrangements are legal and common, and there is nothing inherently wrong with them. What they change is who you are dealing with. The brand you know may be a marketing operation with no licence, no compliance function and no ability to resolve your complaint. The licence holder, a company you have never heard of, named in the small print at the bottom of the page, is the entity the regulator supervises.

Two practical consequences. First, when a white-label brand disappears, it can disappear very fast, because there is little to wind down. Second, when you complain, you complain about the licence holder, and you need its name, which is in the footer, in the terms, and in the licence register entry.

We record the operating company on every review for exactly this reason, and where one company operates several brands we note it, because "we compared five casinos" means something different when three of them are the same operator.

How to verify a licence in two minutes

Licence badges in a footer are images. Anyone can add one. The register is the source of truth and checking it is genuinely quick.

One. Find the licence number and the operating company name in the footer or the terms. If neither is stated, stop there, every legitimate licence requires both to be displayed, and the absence is the answer.

Two. Open the regulator's own public register directly, by typing its address rather than following the badge link. Every regulator on this site runs a searchable one.

Three. Search the company name, not the brand. White-label brands will not appear; their licence holder will.

Four. Check three things on the entry: that the status is active rather than suspended or surrendered, that the domain you are on is listed among the approved URLs, and that the scope covers casino games rather than only sports betting or B2B supply.

The domain check is the one that catches clones. A licensed brand's name attached to a domain that is not on the register entry is a different site wearing the same coat, and it happens often enough to be worth the fifteen seconds.

Curaçao's reform, and whether it changed anything

Curaçao ran the loosest significant licensing regime in the industry for two decades, built on master licences: a handful of holders sublicensed to hundreds of operators with minimal scrutiny and no direct relationship between the operator and the government.

The regime was overhauled. Master licences were replaced with direct licensing under a dedicated gaming authority, with application requirements, local presence obligations and a complaints mechanism that did not previously exist in any usable form.

Is it better? Yes, measurably, direct licensing with a named regulator beats a sublicence chain. Is it comparable to a national licence? No, and it is not trying to be. There is no self-exclusion register, no cross-operator deposit cap, no mandatory ADR, and the practical position of a player in a dispute is still considerably weaker than under MGA or UKGC.

The reform's clearest side effect was elsewhere: operators unwilling to meet the new requirements moved to Anjouan, which now occupies roughly the position Curaçao held before. Whenever a jurisdiction tightens, capital moves to the next-loosest one. That pattern is the most reliable thing in offshore gambling regulation.

This is the sharpest practical difference between licensing tiers, and if you take one thing from this page, take this.

A national register is a single registration that locks you out of every operator licensed in that market. An operator-level exclusion closes one account. The difference is not incremental, it is the difference between a tool that works and a tool that does not, because the failure mode of operator-level exclusion is opening a different tab.

• GAMSTOP, United Kingdom. All UKGC-licensed operators, six months to five years.
• Spelpaus, Sweden. All Swedish licensees, and it also stops gambling marketing reaching you.
• ROFUS, Denmark. Temporary or permanent.
• OASIS, Germany. Covers online and land-based, which few registers do.
• Cruks, Netherlands. Required at every licensed Dutch operator at login.
• RGIAJ, Spain.
• RUA, Italy.
• HAMPI, Estonia.
• ONJN register, Romania.
• Ontario, AGCO operates a provincial scheme.

Malta, Gibraltar, the Isle of Man, Alderney, Curaçao, Anjouan and Kahnawake operate no national register, because they licence operators serving many markets rather than one population. Exclusion at operators licensed there is operator-level only.

If you need to stop rather than slow down and no register covers you, device-level blocking software, Gamban, BetBlocker, does not depend on any operator honouring a request. GamCare, Gambling Therapy and BeGambleAware provide free confidential support and do not require you to have decided anything first.

Game fairness, and the part of regulation that works

Slot outcomes are produced by a random number generator, and at any licensed operator that generator has been tested by an independent laboratory. eCOGRA, Gaming Laboratories International and iTech Labs are the names you will see on certificates.

The testing covers two things: that outcomes are statistically random and unpredictable, and that the game returns the percentage the studio claims over a very large sample. The published RTP figure on a slot is a certified figure, not a marketing one, and the certification is re-run when a game is modified.

This is worth saying clearly because "the slots are rigged" is the most common accusation levelled at online casinos and it is the one least supported by evidence. The games are supplied by studios, Pragmatic Play, Play'n GO, Hacksaw Gaming, Nolimit City and the rest, which are separately licensed, separately audited, and have vastly more to lose from a rigging scandal than any individual casino has to gain. The casino does not control the maths.

One genuine caveat: some games ship in multiple RTP configurations, and the operator chooses which to run. A slot certified at 96.5% may be deployed at 94%. That is legal, disclosed in the game information panel, and worth checking, it is the same game with a materially worse edge. Our free game pages record the RTP variants where a title has them, and you can play any of them at zero stake to see the configuration for yourself.

Tax: who pays, and where you might

Gambling taxation is a matter of where you are resident, not where the casino is licensed, a distinction that operator marketing regularly blurs.

Across most of Europe, winnings are not taxable for the player, because the operator is taxed on gross gaming revenue instead. The UK, Germany, Sweden, Denmark, the Netherlands, Italy and Spain all broadly work this way for play at licensed operators, though the details differ and Spain's treatment of gambling income is its own subject.

Two situations change the answer. Playing at an operator not licensed in your market can move the income into a taxable category in some jurisdictions, because the domestic exemption is tied to the domestic licence. And professional gambling, rare, and defined narrowly, is treated as income in several countries.

Our tax-free casinos page groups operators licensed in markets where winnings are untaxed for residents of those markets. It is not tax advice and it is not a substitute for it. If real money is involved, ask someone qualified in your own country.

Geoblocking, and why you should not route around it

Licensed operators are required to block players from markets they are not licensed for, using IP geolocation, address verification and payment method checks. Circumventing that block with a VPN breaches the terms of every operator that has them.

The consequence is not a warning. It is confiscation. Play from a blocked jurisdiction and the operator is entitled to void winnings and close the account, and the regulator will not help you, because you breached a term that exists to satisfy a licence condition. This shows up at withdrawal, when the address on your ID does not match the country the account has been playing from.

There is no version of this that ends well, and the operators most relaxed about VPN use are precisely the ones least likely to pay a large win. Play where you are, at an operator licensed for where you are. The casino list filters by licence for that reason.

Strip out the theory and the difference is a short list of things that either exist or do not when something goes wrong.

At a national licensee: a register that covers every operator in your market; deposit limits that may apply across operators; an ADR body that adjudicates for free; a regulator that can remove the operator's access to your market; published enforcement decisions you can read before you deposit; and, in several markets, statutory limits on stakes and bonus terms that the operator cannot contract out of.

At an established international licensee: segregated funds with meaningful audit; a regulator with a real complaints function and a public record; ADR in most cases; but no national register, no cross-operator limits, and enforcement leverage that is commercial rather than market-access.

At an offshore licensee: RNG certification, generally. A complaints address. Very little else that you can rely on in a dispute, and no register at all.

None of this means an offshore-licensed casino will treat you badly. Plenty operate honestly, and some of the fastest payouts we have measured are at offshore operators with no pending period and no interest in friction. It means that if one does treat you badly, the recourse is thin, so the amount you are willing to have sitting in the account should reflect that, and the test withdrawal before you commit anything larger matters more, not less.

How we weight a licence in a rating

Licensing is one of the six components behind every score on this site, and it is weighted according to what the licence gets a player rather than the regulator's reputation in the abstract.

A national licence for the market a reader is in scores highest. Multiple national licences score higher still, because it means the operator has passed several independent suitability assessments and is exposed to several regulators simultaneously. An established international licence scores solidly. An offshore licence alone caps the licensing component, and we say why in the review rather than letting the number stand unexplained.

Two things move the score independently of tier. A parent company with recent enforcement action against it is marked down, because the pattern travels between brands. And an operator whose terms reserve broad discretion to void winnings is marked down at any tier, because a discretionary clause is only as good as the complaints procedure standing behind it, which brings the whole question back to the licence.

Every review states the licence, the licence number, the operating company and the dispute resolution route in the same table, and links each regulator to its page here. If a review cannot state all four, that is in the review too.

Questions we are asked most often

Is a Curaçao licence safe? Safe is the wrong axis. A Curaçao licence means the games are certified and there is a company with an address. It does not give you a self-exclusion register, an independent adjudicator or a regulator with leverage. Plenty of Curaçao operators pay quickly and behave well; if one does not, you have very little to escalate with. Size your balance accordingly.

Does more licences mean a better casino? Usually yes, but not for the reason people assume. It is not that the protections stack, only the one covering your market applies to you. It is that each national licence required a separate suitability assessment of the company, its funding and its people. Four regulators having independently approved an operator is meaningful evidence.

Can I complain to the MGA about a Curaçao casino? No. Regulators have jurisdiction only over their own licensees. This is the most common wasted complaint in the industry.

The casino says it is "regulated". Is that the same as licensed? No, and the word is used loosely on purpose. Ask for a licence number and an operating company name, then check the register yourself as described above.

My winnings were voided for breaching a term I did not read. Do I have any recourse? Sometimes. Regulators in several markets require terms to be fair and prominently presented, and a term buried in a document nobody could reasonably find has been struck down before. The route is ADR, and the evidence is the terms as they appeared when you accepted them.

Is my money safe if the casino goes bust? It depends on whether player funds were segregated and whether the regulator audited that. Strong regulators require and check it; weak ones require it on paper. The reliable protection is not holding a balance you are not using.

Why does the same casino look different in another country? Because a different licence applies. Bonus rules, stake limits, deposit caps and game availability are all set by the regulator for the market you are playing from.

Does a licence mean the games are fair? Yes, in the sense that matters, RNG certification is required by every licence worth the name and the testing is independent. Game fairness is not where this industry's problems are. The cashier and the bonus terms are.

What we watch, and why the picture keeps moving

Gambling regulation is not settled, and the direction of travel is consistent even where the details are contested. Markets that were open are closing; markets that were closed are opening under licence; and each time a jurisdiction tightens, some operators comply and others relocate to whichever regime asks least.

Three things we track across every regulator page. Enforcement volume, because a regulator that stops publishing penalties has usually stopped imposing them. Register participation, because a self-exclusion scheme is only as good as the share of the market bound by it. And the gap between licensed and unlicensed supply in each market, because a regulator whose rules push players toward offshore sites has achieved the opposite of its purpose, an argument made frequently by the industry and occasionally, uncomfortably, supported by the data.

We update the regulator pages when any of that changes, and every page here carries the date it was last reviewed and the name of the person who reviewed it. Where we are uncertain, we say so rather than rounding to a confident sentence.

The terms, in plain words

Licence

Permission from a regulator to offer gambling, subject to conditions covering funds, fairness, AML and player protection.

Licence holder

The company legally responsible for the operation. Frequently not the brand on the website.

White label

A brand operating under another company's licence and platform, where that company carries the regulatory responsibility.

Segregated funds

Player balances held separately from company operating capital, so they survive an insolvency.

ADR

Alternative dispute resolution, an independent adjudicator for player complaints, funded by the operator.

Self-exclusion register

A national scheme where one registration blocks access to every licensed operator in that market.

RNG certification

Independent laboratory testing confirming that game outcomes are random and match the published return-to-player figure.

Geoblocking

Preventing access from markets the operator is not licensed for. Circumventing it voids the account.

Enforcement action

A published regulatory penalty, fine, suspension or revocation, against a named licensee.

Where to go next

Each regulator has its own page here covering what it requires, how to complain to it and what it has actually enforced: Malta, the UK, Germany, Sweden, Denmark, the Netherlands, Spain, Italy, Romania, Estonia, Ontario, Gibraltar, the Isle of Man, Alderney, Kahnawake, Curaçao and Anjouan. Each lists the operators we have tested under it.

If you would rather start from the operator, the casino list filters by licence, and the tax-free and fast-payout pages group operators by the outcomes those licences tend to produce. The payment methods hub covers the cashier mechanics that most disputes are actually about, and the bonus hub covers the terms most confiscations are argued over. Our casino guides go further into individual regulators and complaint procedures, and the people who write all of it are named on every page.