iGaming Compliance: Licensing, Certification and Jurisdictions

iGaming compliance decides whether the rest of your launch plan is legal, and it splits into two jobs that operators routinely confuse. One is the licence you hold in a market. The other is the technical certification carried by the software behind you. We take the second job: our platform and casino software are engineered to be certified at the platform level, so your team spends its time on the licence application instead of re-testing an engine that has already passed.

This page is the reference to hand your legal team when they ask who carries what. It maps which products are certified in which jurisdiction, describes what each regulator requires in practice, and shows how KYC, AML and responsible gambling are configured market by market. Where a figure is not yet confirmed for our own entity we mark it, because iGaming compliance is the one area where an optimistic claim costs far more than an honest gap.

What iGaming compliance actually covers

Operators hear the word and picture a certificate on a wall. In practice, iGaming compliance is four workstreams running in parallel, and each has a different owner.

• Licensing The right to offer gambling to players in a territory. This sits with you and is issued to your legal entity, never to a codebase.
• Technical certification Proof that the platform, RNG and games meet a regulator's named standard. This sits with us and is renewed on our side.
• Player protection Verification, AML screening, source-of-funds checks and responsible gambling limits, set to the rules of each market.
• Data and reporting Regulatory feeds, audit logs, retention rules and the question of who owns the player database.

Dividing iGaming compliance this way is what makes multi-market growth affordable. You add a licence. You do not rebuild the stack.

Platform-level certification and your operator licence

Platform-level certification means the provider carries the technical burden. The RNG, game engine, wallet and reporting layer go to an accredited test house, and the certificate belongs to the platform rather than to any single brand running on it. When you apply for a licence, you reference certified iGaming software instead of commissioning your own test cycle from scratch.

The split matters commercially. Certification is the slow, repeatable, expensive part of iGaming compliance, and repeating it per brand is pure waste. Licensing is the part only you can do, because a regulator licenses an entity with directors, capital and a named compliance officer.

One caveat belongs here rather than in the small print, because it is where iGaming compliance plans usually break. Certification is both jurisdiction-specific and product-specific, so a certificate covering the casino platform in one market says nothing about the sportsbook in another. That is why the section below is a matrix and not a badge.

iGaming compliance matrix: products by jurisdiction

This is the working view of our coverage: which product is certified, or in process, in which jurisdiction. Every row is marked and stays marked until the certificate is issued and filed. Read it as the structure we maintain and the roadmap we are executing, not as a claim already earned.

Our target coverage is 20+ jurisdictions, and the matrix grows market by market rather than in one announcement. If a cell you need is empty, the honest answer is a timeline, not a workaround.

International licences: Curacao, Kahnawake and Malta

Three international regimes carry most first launches, and choosing between them is the first real iGaming compliance decision an operator makes. They differ in cost, timeline, banking access and how regulators elsewhere treat them, which makes the choice commercial as much as legal. Our platform sits under any of them, so what changes is your application rather than the integration.

Gambling license in Curacao

The Curacao Gaming Authority now issues licences directly under the LOK framework, replacing the old master-and-sublicence arrangement. Applicants file a corporate, AML and fit-and-proper package, show local substance and submit certified software. It stays the common entry point for crypto-first and multi-brand operators because of breadth and speed, not because it is a loophole. A curacao gambling license does not open a market that demands a national licence, and treating it as though it does is the most expensive iGaming compliance mistake we see.

Kahnawake gambling license

The Kahnawake Gaming Commission in Quebec runs one of the oldest regimes in the industry and keeps a visibly tighter operator list. A kahnawake gambling license suits operators who want a recognised, long-standing regulator with a strong record on player-fund handling and a hosting requirement inside the territory. Obtaining a gambling license in Kahnawake means due diligence on directors and shareholders, a client-provider agreement and certified software from an approved supplier.

Gambling license Malta

The Malta Gaming Authority is the credibility benchmark of the sector. An MGA licence unlocks payment and banking relationships that offshore regimes struggle to reach, and it carries weight with regulators and partners across the EU. It also asks the most: audited financials, local presence, segregated player funds, a named compliance officer and continuous reporting. Anyone quoting a single malta gambling license cost is guessing, because the total moves with licence class, gross gaming revenue, capital requirements and audit fees, so we point operators to the current MGA fee schedule instead of publishing a number we cannot stand behind.

Comparing regimes side by side reads better visually than in prose, and the calculators and maps we publish are built for exactly that kind of comparison. Our regulation map tracks legal status by territory and updates as frameworks change.

When the shortlist narrows to one market, the questions turn local: tax treatment, payment rails, advertising limits and licence mechanics on the ground. Our Brazil market guide works through that list for the first country in the series.

National regulators and what they require

Where an international licence stops, national iGaming compliance begins. These regulators license operators for their own territory and will not accept an offshore licence as a substitute. What follows describes what each body requires factually. It is not a statement that we are licensed by them.

• Ontario (iGaming Ontario and AGCO) Operators register with AGCO and sign an operating agreement with iGO. Suppliers register separately, and the regime enforces strict advertising and inducement limits.
• Romania (ONJN) Class 1 licence for operators, Class 2 for suppliers, with local certification, monitoring access for the regulator and a local representative.
• Greece (HGC) Type 1 licence for casino and Type 2 for betting, with certified systems, a local entity and a safer-gambling framework the regulator supervises directly.
• Brazil (SPA) The Secretariat of Prizes and Betting licenses fixed-odds betting and online gaming nationally, requiring a Brazilian entity, local certification and integration with national player and monitoring systems.
• Denmark (Spillemyndigheden) Separate casino and betting licences, a certification programme against the regulator's own technical standards, and mandatory connection to the ROFUS self-exclusion register.
• Spain (DGOJ) General and singular licences per game vertical, a local entity, technical certification and connection to the RGIAJ self-exclusion register.
• Mexico (DGJS) Permits are issued under the federal gaming law and in practice most operators run under an existing permit holder, which makes contractual structure as important as technology.

The pattern repeats everywhere: a local entity or representative, certified software from an approved supplier, a live data feed to the regulator, and player-protection rules written for that market. The platform is built for exactly that pattern, which turns national iGaming compliance into a configuration exercise rather than a migration project.

Certified iGaming software: GLI, RNG and ISO 27001

Certification is a specific claim, not a marketing adjective. It means an accredited independent laboratory examined the system and issued a certificate against a named standard. These four terms are the working vocabulary of technical iGaming compliance, and each one means something exact.

• GLI-19 covers interactive gaming systems: server logic, wallet, session handling, game outcomes and reporting.
• GLI-33 covers event wagering systems, which is the standard a sportsbook is measured against.
• GLI-tested RNG means the random number generator was examined for statistical randomness and unpredictability, then locked to the tested build.
• ISO 27001 is not a gambling standard at all. It certifies the information security management system: how access, incidents, suppliers and risk are governed day to day.

We build to GLI-19, GLI-33, GLI-tested RNG and ISO 27001 and certify per market at launch. Each of those stays marked until the certificate is in our hands, because iGaming compliance claims are the first thing an auditor checks and the first thing a serious operator's legal team asks us to produce.

KYC, AML and responsible gambling per market

This is where iGaming compliance stops being a document and starts being product behaviour. KYC AML casino rules are never one global policy. They are a rule set per jurisdiction, and the platform treats them as configuration rather than code, which is the difference between entering a market in weeks and entering it in quarters.

• Identity and age verification Document, database or eID checks, with the trigger point set per market: at registration, at first deposit or at a threshold the regulator defines.
• AML monitoring Transaction thresholds, source-of-funds prompts, PEP and sanctions screening, and structured reporting to the local financial intelligence unit.
• Responsible gambling Deposit, loss, wager and session limits, reality checks, cool-off and self-exclusion, wired to the national register where a market runs one.
• Audit trail Every check, override and limit change is logged immutably, because iGaming compliance you cannot evidence is compliance you do not have.

Configurability is the entire point. One deployment runs different rules per market, so a Danish player and a Brazilian player meet different verification and responsible gambling logic while you operate a single platform and a single back office.

Who owns the player data

You do. The player database belongs to the operator at all times. We host and process it under contract, we do not disclose it to third parties, and if you move to another provider we are obliged to help you export it. This is the quietest clause in iGaming compliance and the one most worth reading in full rather than trusting a sentence on a vendor page.

Building your iGaming compliance roadmap

Sequence beats ambition. Pick the market that funds the next one, match the licence to it, then let a certified platform carry the technical load while you build the entity and the team.

1. Choose the revenue market first. Licence strategy follows where the players and the payment rails actually are, not the other way round.
2. Match the regime to the market. International licence for reach and speed, national licence where the market demands one, often both in sequence.
3. Confirm product coverage. Check the matrix above for your product and jurisdiction before you commit to a launch date.
4. Configure and launch. Verification, AML and responsible gambling settings are switched on per market, not rebuilt per market.

Operators who want licensing support and the launch handled as one workstream usually start from a turnkey casino and add regulated markets once the first brand is generating revenue.

Frequently asked questions

Talk to our iGaming compliance team

Tell us your target markets and your licence status, and we will map what you need to hold, what we certify, and the shortest legal route between the two.

Talk to our compliance teamBook a demo