iGaming Compliance Guide: A Handbook to Building, Running a Regulated Business in 2026

Explore the contours of iGaming compliance for global operators, brands, sportsbooks, and businesses engaged in online gambling. Get clued in on the vast spectrum of compliance factors across regulations, player compliance, financial and marketing controls, technology and data-based mandates that are required in most jurisdictions. Build your own compliance checklist which helps you get ahead of penalties and violations, ensuring business continuity and no financial loss.

What is iGaming Compliance?

Within the iGaming industry, compliance is a very broad term, which includes legal and regulatory factors (such as AML or licensing) as well as statutory and good-to-have aspects (such as advertising norms, responsible gaming, etc).

In simple terms: compliance within iGaming includes all those aspects which must be validated, certified and signed off on by regulatory and licensing bodies before an online casino, sportsbook or online gambling business goes from idea to live status..

Does that mean iGaming compliance is a one-time affair? Absolutely not. You see, the rules within iGaming keep developing, and new requirements may be introduced (which businesses must adopt). Additionally, who’s to say a casino is following the rules year-after-year since they received their license? 

To keep up a healthy system of check-and-balances in this kind of risky business, compliance itself becomes an ongoing activity. An online gambling operator must maintain iGaming compliance across:

• Time,
• Region or jurisdiction,
• Areas of operation, and,
• Changing regulations.

Broadly, the entire ecosystem within which the business operates (including the operation, suppliers, affiliates, users and so on) must satisfy the laws and legal conditions or technical standards placed in a given jurisdiction to successfully carry out legally allowed operations.

It is vital to note that iGaming compliance is not a single item or checklist. It varies by the player’s location, the gambling products and services being offered, the operation’s structure and the jurisdiction.

What are the Broad iGaming Compliance Requirements, at a Glance?

iGaming compliance means meeting the licensing, KYC, AML, responsible gambling, advertising, privacy, payment, security and other rules that apply to an online gambling business in each market where it operates.

Now that seems oddly simple. But there is a great deal of nuance within this matter in an operational sense. You see, even within a harmonised bloc such as the European Union, there is no blanket norm which applies. Countries may choose to make regulations common, but this isn’t uniformly applicable.

Let’s take a look at the broad areas of compliance, and what they require from sportsbooks, online casinos and operators.

Compliance Areas	General Requirements	Evidence Required
Gambling License	Permission to offer the relevant gambling product in a jurisdiction	Licence, approvals, ownership disclosures, key-person approvals
KYC and Identity Checks	Establishing that the customer is who they claim to be	Identity verification, document or database checks, duplicate-account controls
Age Verification	Preventing underage gambling	DOB checks, electronic verification, escalation processes
AML, CFT	Identifying and mitigating money-laundering and terrorist-financing risk	Risk assessment, CDD, EDD, transaction monitoring, SAR and STR reporting
Responsible Gambling	Preventing and responding to gambling-related harm	Self-exclusion, limits, interventions, safer-gambling information
Advertising	Ensuring online gambling promotions are lawful and responsible	Creative approval, age targeting, bonus disclosures, affiliate controls
Affiliate Oversight	Controlling third-party promotion of the operator	Contracts, approved creatives, monitoring, audit logs, sanctions
Data Privacy	Lawfully and securely processing player data	Privacy notices, lawful bases, retention policies, rights processes
Cybersecurity	Protecting gambling systems and customer information	Access controls, encryption, incident response, testing or audits
Technical Compliance	Ensuring games and systems meet regulatory standards	Certification, testing reports, change management
Payments	Controlling deposits, withdrawals and prohibited payment methods	Payment verification, reconciliation, fraud monitoring
Geolocation	Keeping play and promotion within legally permitted markets	Location verification, VPN or proxy detection, jurisdiction rules
Regulatory Reporting	Providing required information to regulators and FIUs	Reports, audit trails, incident notifications
Recordkeeping	Preserving evidence of regulatory compliance	KYC files, transactions, affiliate logs, communications

This is a comprehensive list of compliance required in summation, across all jurisdictions. This entire list may not be needed in every jurisdiction though.

Consider the fact that the UK LCCP, for example, imposes conditions across licensing and conduct, while EU AML rules explicitly require customer due diligence, monitoring and suspicious-transaction reporting from obligated entities. 

Who is Responsible for Compliance at iGaming Businesses?

It may appear that having a legal department is the end of iGaming compliance. However, that would be a mistake. 

Since compliance in online gambling is all-encompassing, and applies across multiple functional disciplines, it is critical that everyone within the organization be evenly informed, and play their part in maintaining and upholding the various facets of compliance implementation.

To make compliance easy-to-implement, set up three lines of defense at any stage, for any area of concern. Think of it like this: if there is an implementation or execution layer, there should be two more compliance review steps to ensure what’s being carried out is within the bounds of permissible compliance.

To limit the technicality, here’s some of the areas where the responsibility for uphold iGaming compliance can lie:

• The board or senior management, which can set accountability and risk appetite for the entire organization.
• A compliance leader or MLRO can be present to interpret obligations and monitor controls for every single business function where compliance may be breached.
• Then, operational teams execute strategies which are compliance-approved.
• Technology and security teams can implement technical controls that are focused on enabling accurate, timely certifications and checks on them.
• Marketing and affiliate teams remain responsible for promotional compliance, where advertising and geolocation rules must be noted and followed.

In iGaming, it is often the case that third-parties are involved in the execution of business. It’s essential to note that the very presence of such third parties does not automatically transfer regulatory responsibility away from the operator or sportsbook. Instead, the business is responsible for the presence or absence of compliance on the end of B2B suppliers (which makes the use of compliant software and support practically mandatory).

The operator normally retains ultimate responsibility for activities carried out under its licence, even where certain functions are outsourced. Again, the particulars can vary by jurisdiction but this is applicable as a broad rule.

What Regulations do Online Casinos Need to Comply With?

iGaming compliance is not a checklist, or a simple framework which can be implemented through individual steps. Rather, think of it as a layered strategy for better business across all countries, in line with the expectations placed within each jurisdiction.

Thinking of the process in layers also eases your ability to achieve 100% compliance across all the relevant jurisdictions. Each step carries equal value and cannot be skipped, but if taken as a whole, it becomes overwhelming very quickly.

Let’s consider the iGaming compliance list that operators and brands are expected to follow:

Gambling Legislation

There are legally binding rules for the entire online gambling vertical in many countries. You may be familiar with the Brazilian legislation which led to the opening of their market to iGaming recently (in 2025). 

A series of Bills passed by the Chamber of Deputies initiated a historic change within the legal recognition of online casinos and sportsbooks, giving the very basis of eliminating the entire grey and black market from the country.

Many countries have such laws which explicitly define what’s permitted and to what extent, what’s prohibited and what penalties such restricted activities carry.

As a rule, it is mandatory to stick by the letter and rule of the law in any jurisdiction where you operate or are based out of.

Licence Conditions or Regulator Standards

Then comes a permission to operator — usually dispensed through business licensing from recognised regulatory bodies. Before any live operations can begin for your online gambling business, you need to have a license.

Some of the licenses are broader in application: you can get one and it works in multiple jurisdictions. Then, there are also specific ones such as the UKGC license which is absolutely necessary if you wish to serve the UK population.

Depending on what the regulatory standards (read: laws of the land) dictate, you need to get a single or multiple licenses to ensure proper compliance.

AML and CFT Legislation

Anti-money laundering (AML) and countering the funding of terrorism (CFT) are measures that show an iGaming business to be legit, and free of the shadow of doubt. This requirement exists because throughout history, the practice of gambling itself has been heavily associated with money laundering and related illegal activities.

For iGaming compliance on this front, operators and brands will need to verify identities of those transacting on their platform, and monitor and report suspicious activity immediately.

KYC and Age-Verification Requirements

Gambling is a restricted activity, which can only be carried out by people of a particular age (usually 18+ or 21+). However, there is no single stipulation, and the minimum age to engage in online casinos or gambling institutions is defined individually in regulations and laws.

Player Protection Rules

There is always the fear that individuals may play excessively to recoup losses or over-engage simply due to gambling addiction. That’s why player protection rules (also often referred to as responsible gambling rules) apply in various forms across countries. Platforms are expected to incorporate practices which enable players to safely engage without the risk of losing everything.

Advertising and Consumer-Protection Requirements

User acquisition within online casino and gambling formats can be tricky. Therefore, clear guidelines and stipulations have been laid out to withhold ads which are misleading, inaccurate, harmful in intent, unclear and without warnings.

Across most jurisdictions and operative environments, online gambling advertising laws are in place to guardrail active promotions for online gambling in such a manner that consumers remain protected from harm caused by excessive or incorrect usage of such platforms. Additionally, children and other vulnerable groups need to be shielded from content which can be triggering or lead to poor conduct.

Privacy or Data Laws

Financial transactions are the very basis of online casino activity. Consider the placement of a wager or the incidence of a single gameplay. If real-money gambling is being practiced, there is a default transfer of funds from individuals to the business and back (in case of a win, bonus and so on).

That’s why protecting sensitive information — such as who is solvent, to what extent, with a credit card from which bank and so on — becomes a clear responsibility of the iGaming platform (and a super important area within iGaming compliance).

Game Testing Requirements

As with any other trade, games need to be fair and give users an actual change to win. Usually within iGaming, RNG certifications enable players to know the game is free from manipulation and has been validated by accredited third-party bodies.

There are also other areas of fairness which can be built into an online gambling website such as RTP or return to player, which defines how much will return to players on average across a set number of gameplays. 

Tax and Reporting Obligations

Is there tax on online gambling activity? Well, that again comes down to jurisdictional discretion, and applies differently everywhere. While by and large, there are taxes placed on businesses (especially those which are identified to cause potential ‘harm’), the amount or extent of taxation and reporting of annual business income varies.

The transparency in sharing financial conduct enables law enforcement agencies to trust iGaming businesses as law abiding, and not engaged in things like money laundering. The taxes paid out by such businesses also further humane causes set out by governments for the citizens’ welfare.

Supplier or Vendor Rules

Who an online gambling casino or sportsbook can do business with is also a factor within iGaming compliance and usually a guiding factor in the gaining and maintenance of licenses. Only registered, recognized and certified B2B suppliers for iGaming software such as game providers, affiliate software providers and so on are encouraged across most countries.

As allied businesses, the ‘allowed’ ones tend to be those which are transparent, with taxes filed and other areas of operation disclosed for government organizations and other businesses to vet and verify.

Does an Operator need KYC, Age Verification Before Deposits?

Not necessarily before every deposit in every jurisdiction. KYC and age-verification timing differs between markets. 

Regulators may require verification before gambling, account activation or other specified stages, while enhanced checks can be triggered later by risk or activity. Operators should therefore avoid treating “verification before deposit” as a universal global rule.

Consider the manner of operation in the UK, where having a clear understanding of the player’s age and identity is vital before they actually gamble. The Gambling Commission has even made provisions for instances where age could have been verified before withdrawal but wasn’t.

Under the broad aegis of KYC and age verification, there are four broad areas which iGaming compliance requires:

Age Verification

The goal of verifying a player’s age before the incidence of participating in the offerings of a sportsbook or online casinos simply to vet whether a user is old enough. Since there are minimum ages of participation listed clearly in all regulated geographics, it is vital for licensed operators and brands to check whether this requirement is being met or not.

Identity Verification

Often, in case of online casinos and such, users may play through an alias or not use their real names for the purpose of disconnecting their identities to such activities. That is a valid option, which players should be allowed to exercise.

From the business perspective, it becomes important to ensure that despite such anonymity, there is no instance of stolen credit cards or identity theft involved — actual crimes which can be enabled, if not checked.

It’s also crucial to eliminate online gambling fraud of various kinds, amongst which various forms of misrepresentation are common.

CDD or Client Due Diligence

As part of mandatory iGaming compliance norms, businesses are required to check the identity of all players and verify their risk appetite. This process is sometimes also known as KYC or ‘know your customer’. 

The goal here is to limit money laundering, underage gambling and the like. 

Such assessments can also go one step further, with sportsbooks checking user profiles against global watchlists and criminal databases alongside lists on politically exposed persons (PEP).

It may seem like such screening should be a one-time endeavor only. However, spreading it across the player’s lifetime is important, since accounts can fall into the wrong hands at any stage after their creation.

EDD (Enhanced Due Diligence) or Source-of-funds Checks

Beyond simple CDD is an even greater level of checks and balances, which enable effective compliance with expectations in the iGaming industry. It can be expected that players must disclose their funds’ source while gambling, to ensure no crime is committed, and no overspending occurs from their end.

In the UK, such checks are common. 

Other aspects of this screening process include adverse media screening to locate controversies and problems of legal nature. In high-risk transaction formats, such as with crypto casinos and gambling businesses, this can be a basic expectation as well since cryptocurrencies tend to get associated with criminal activity.

What AML Rules Apply to Online Gambling?

Anti-money laundering (AML) compliance in online gambling goes beyond checking a player’s identity at registration. iGaming businesses need a risk-based framework that addresses customers, products, payment methods, jurisdictions and transaction activity. 

Enterprise-wide ML/TF Risk Assessment

General iGaming compliance checks require a documented money laundering and terrorist financing (ML/TF) risk assessment covering customers, products, payment methods, countries and geographies, acquisition channels, third parties and transaction patterns.

This should be reviewed when the business, products, markets or risk exposure changes and when new threats emerge.

Where Do Risk Ratings Come in?

Online casinos should assess customers according to their potential ML/TF risk. A risk-based framework may classify customers as low, standard or high risk based on factors such as geography, payment behaviour, customer profile and transaction activity.

Risk ratings should be updated when customer behaviour or circumstances change.

Ongoing Transaction Monitoring

AML controls must continue after registration to uphold and maintain iGaming compliance. Operators and brands should monitor deposits, withdrawals, wagering patterns, payment methods and linked accounts for potentially suspicious activity.

The UK’s 2026 risk assessment highlights risks including mule accounts, linked accounts, smurfing and customers using multiple operators to disguise the source of funds. It also identifies emerging threats involving AI-generated documents, deepfakes and face-swapping technology.

How Does Suspicious Activity Reporting Work?

Where activity creates a suspicion of money laundering or terrorist financing, operators must follow applicable suspicious activity reporting requirements and report to the relevant financial intelligence unit (FIU) or competent authority.

Processes should define who investigates alerts, makes reporting decisions and escalates cases.

What’s the Value of Recordkeeping in AML Checks?

Online gambling businesses should retain evidence of their AML controls, including customer verification, risk assessments, EDD decisions, transaction monitoring alerts, investigations and suspicious activity reports.

iGaming compliance retention requirements vary by jurisdiction and licence.

Training and Governance

AML compliance requires clear ownership and escalation procedures. Employees involved in onboarding, payments, risk management and investigations should receive appropriate training and understand their responsibilities.

What is Changing in 2026 Within AML Requirements for iGaming?

The UK’s Gambling Commission continues to regard remote casino activity as high risk for money laundering. Its 2026 assessment highlights fraudulent documentation, mule accounts and AI-assisted identity fraud as evolving threats.

The EU is also preparing for its new AML framework, which includes the Anti-Money Laundering Regulation (AMLR), AML Directive VI and the new Anti-Money Laundering Authority (AMLA). 

Key parts of the framework apply from July 2027.

Why is AML ≠ KYC, you may wonder? KYC is one component of a broader AML framework. AML also covers risk assessment, transaction monitoring, enhanced due diligence, suspicious activity reporting, recordkeeping and governance.

Effective AML compliance therefore operates throughout the customer lifecycle. Registration checks establish who the customer is, while ongoing controls assess whether their activity makes sense, identify unusual behaviour and provide a documented process for investigation and escalation.

Responsible Gambling and Player Protections in Compliance

There’s another zone of iGaming compliance which requires sportsbooks and operators to prevent excessive gambling, identify vulnerable behaviour and intervene when appropriate. Here’s what it usually means in real terms.

Minimum-age Controls

Operators must prevent underage customers from accessing gambling services. This typically requires age verification during registration and appropriate controls to prevent customers who fail verification from depositing or gambling.

Age checks should be supported by ongoing account controls where required by the applicable regulator.

Self-exclusion

Self-exclusion allows customers to restrict or stop their gambling for a defined period, and falls in line with popular responsible gambling rules. Offering such a functionality is a mandate within most iGaming compliance norms.

Brands and businesses should provide clear self-exclusion processes, prevent excluded customers from accessing gambling services and take reasonable steps to prevent them from reopening accounts during the exclusion period.

Operators should also apply marketing suppression so excluded customers do not continue receiving promotional communications.

Breaks and Time-outs

Shorter breaks and time-out tools allow customers to temporarily restrict gambling without committing to full self-exclusion. Where required, operators should make these options accessible and ensure the chosen restriction is enforced consistently across the relevant account or accounts. 

Consider instances of long-term engagement such as live dealer games or table-based games, where players may keep going despite losing on each turn.

Deposit, Spending and Time Limits

Sportsbooks may be required to provide controls that allow customers to set limits on deposits, spending or gambling time. Where mandatory, these controls must operate according to the regulator’s compliance requirements and should not be designed in a way that undermines the customer’s chosen restriction.

Reality Checks and Session Information

Reality checks can provide customers with information about how long they have been gambling (since it is easy to miss the movement of time in the virtual space), how much they have spent or other relevant activity. Session information should be clear and accessible so customers can make informed decisions about continuing to play.

Player-risk Monitoring

How do you locate the problematic players — the ones who are more likely to end up with an addiction? By monitoring indicators of potentially harmful gambling, such as rapid increases in spending, extended sessions, repeated deposits, chasing losses or significant changes in gambling behaviour.

Risk indicators should trigger appropriate review or intervention based on the operator’s responsible gaming policies and iGaming compliance obligations.

Customer Interactions and Interventions

When risk indicators are identified, online gambling businesses may need to contact customers and provide targeted interventions. These can include discussing gambling activity, encouraging breaks or limits, providing information about support services or applying stronger restrictions where required.

Interactions and their outcomes should be documented so the operator can demonstrate that identified risks were addressed.

Treatment and Support Information

Customers should have access to clear information about responsible gambling, problem gambling support and relevant treatment services. Information should be easy to find and presented at appropriate points across the customer journey.

Employee Training

Employees involved in customer support, compliance, payments, marketing and responsible gambling should understand the relevant player-protection controls. Training should cover risk indicators, customer interactions, escalation procedures and the handling of self-exclusion and marketing restrictions.

Evidence and Recordkeeping

Records can include self-exclusion requests, limits, risk assessments, customer interactions, interventions, training and marketing suppression actions.

Good recordkeeping allows operators to demonstrate compliance and identify gaps in their responsible gambling processes.

What’s Next for iGaming Compliance in Terms of Responsible Gambling?

Ontario introduced its centralized self-exclusion system, BetGuard, in May 2026. It allowed players to self-exclude across Ontario’s regulated iGaming market through a centralized process, strengthening protection beyond individual operator-level controls.

Brazil’s responsible gambling framework under Portaria 1.231/2024 includes measures addressing self-limitation and warnings relating to gambling time and spending.

The UK is also introducing further player-protection requirements. The UK’s gross deposit-limit requirement took effect on 30 September 2026. The broader principle is straightforward: responsible gambling compliance requires measurable controls, appropriate intervention and evidence that those controls are working. 

Sportsbooks and brands should design their systems around the requirements of each market rather than relying on a generic responsible gambling policy.

The Rules for Advertising Compliance in iGaming

iGaming advertising compliance starts before an advertisement is published and continues through targeting, distribution and recordkeeping. Operators, affiliates and other marketing partners need to ensure that every campaign complies with the rules of the market where it is shown.

Is Gambling Advertising Legal?

The first question is whether gambling can legally be advertised in the target market and through the chosen channel. Operators should confirm the applicable online gambling advertising laws, licensing and platform requirements before launching a campaign.

Is the Operator Licensed?

Advertising should promote only operators and products that are legally authorised in the relevant jurisdiction. This is particularly important for affiliates, publishers and ad platforms that may promote gambling brands on behalf of operators.

Age and Audience Targeting

iGaming marketing tech must not be used to target minors or execute content that is likely to appeal strongly to underage audiences (as per basic compliance norms). In Great Britain, gambling marketing must comply with CAP and BCAP advertising codes and must be socially responsible, with specific protections for children and vulnerable people.

Claims, Bonuses and Promotions

Advertising should not mislead consumers about potential winnings, odds, risks or the nature of an offer. Bonus and promotional terms should be presented clearly, including material conditions that affect eligibility or how an offer can be used.

Responsible-gambling Messaging

Where required, advertisements should include the applicable responsible-gambling information and warnings. These requirements can vary significantly by market and format, as per requirements for local iGaming compliance.

Influencers, Affiliates and Direct Marketing

Celebrity and influencer campaigns require particular scrutiny because audience composition, messaging and endorsement rules can create additional compliance risks. Affiliates must follow the same applicable advertising restrictions as other marketing partners.

Direct marketing should also respect consent requirements, customer preferences and suppression lists. Customers who have self-excluded or should otherwise be excluded from promotional communications must not continue receiving marketing.

Geographical Targeting

A campaign that is compliant in one jurisdiction may be prohibited in another. Operators should therefore control campaigns by geography (i.e. applying geofencing) and account for local licensing, advertising, age, promotional and responsible-gambling requirements.

Creative Approvals and Records

Operators and brands should retain approved versions of creatives, promotional terms, targeting decisions, approvals and relevant campaign records. This creates an audit trail if a regulator, platform or internal compliance team questions an advertisement.

How Do Advertising Compliance Rules Actually Apply?

Let’s understand through what occurred in Brazil in 2026. Significant advertising changes were introduced in July 2026. Portaria SPA/MF 1.964 requires fixed-odds betting advertisements to display one of three prescribed warnings, including that betting can cause addiction, cause financial loss or is not an investment. 

The warning must be clear, legible and occupy at least 10% of the advertisement. New rules also prohibit advertising directed at children and adolescents and require advertisers to verify that operators are authorised.

The practical lesson is that advertising compliance should be managed as a controlled lifecycle: verify the operator and market, approve the creative and claims, apply audience and geographic controls, suppress restricted customers, monitor distribution and retain evidence of every approval.

Do iGaming Affiliates Need Licences to Promote?

In simple and basic terms, there is no universal iGaming affiliate licence. Whether an affiliate needs a licence, registration or other authorization depends on the jurisdiction and the marketing activities the affiliate performs. Even where an affiliate may themselves not require a gambling licence, their marketing activity may remain subject to gambling-advertising rules and oversight from the business end (through the sportsbook or online casino).

The answer, unfortunately, isn’t a ‘yes’ or ‘no’ quandary. It needs to be checked on a case by case basis. Here’s 4 instances which make the requirement for licenses among iGaming publishers even more apparent.

An Instance of Affiliate Activity	Regulation Application
Content marketing	Jurisdiction-based iGaming compliance based on advertising norms and allowed or disallowed words for such content.
Paid acquisition or media buying	Advertising and targeting requirements become particularly relevant.
Handling of player accounts of funds	May come directly under regulations.
Supply of regulated gaming functions or B2B vendor supply within iGaming	Supplier or vendor licensing rules may apply, based on region of supply/receipt.

We can also examine this issue in terms of jurisdictional application across specific places where iGaming is allowed.

In Malta, there is a distinction between gaming services and gaming supplies. The latter requires licensing for ancillary services — which B2B suppliers of iGaming add-ons such as games and payment providers in a whole different category from affiliates themselves.

Or, consider what happens in Brazil. The existing framework in the country treats affiliate marketing publishers as part of the operator or sportsbook’s marketing activity. Therefore, SPA’s strict rules around iGaming advertising apply directly to all activities undertaken to promote the business, including affiliate marketing.

The iGaming Compliance Rules for Data Privacy, Security

Businesses routinely process large volumes of personal and potentially sensitive information. This can include identity and KYC information, payment and financial details, gambling activity, device and location data, and information generated for fraud, risk and compliance purposes. 

How this data must be collected, used, stored and protected depends on the privacy and data-protection laws applicable to the operator and its players.

There are 7 principles which govern data protection for privacy under GDPR (which is a law with EU-wide application):

• Lawfulness
• Fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

The ICO has continued updating its guidance following the UK’s Data (Use and Access) Act 2025, including updated purpose-limitation guidance published in 2026. For online casinos, these translate into practical applications, including:

• Maintaining an inventory of personal data and processing activities,
• Identifying an appropriate lawful basis for processing,
• Providing clear privacy notices,
• Restricting access according to roles and business needs,
• Establishing retention and deletion schedules,
• Putting appropriate agreements in place with processors,
• Conducting Data Protection Impact Assessments (DPIAs) for high-risk processing where required,
• Using encryption or pseudonymisation where appropriate,
• Conducting security testing and maintaining breach-response procedures, 
• Managing international data transfers, and,
• Providing mechanisms for individuals to exercise applicable data-protection rights.

ICO emphasises a concept: “data protection by design and by default”, which means appropriate technical action and action must be taken across the organization, rather than a one-time implementation for a specific instance.

Are there Rules for Payment Security under iGaming Compliance?

While paying is a crucial aspect within iGaming to avail of the services offered by businesses, the compliance norms for the actual payment and related information follows on what is widely accepted across most industries, i.e. the PCI DSS v4.0.1. It establishes technical and operational requirements for protecting payment account data.

There could also be another case. Security obligations can also arise directly from gambling regulation. 

In Great Britain, remote gambling operators in specified licence categories must undergo an annual independent security audit against relevant “Remote Gambling and Software Technical Standards” security requirements. These requirements are based on relevant sections of ISO/IEC 27001:2022, giving operators a concrete regulatory security benchmark beyond general advice to simply “keep player data secure.”

Why Does Location Enforcement Matter to Operators and Affiliates?

Where the player is physically located is a core consideration for the practical application of iGaming compliance rules. Without it, which rules apply is a matter of contest. From the perspective of the business itself, the “where” affects eligibility for offers, license scope and permissible marketing activity.

There are three aspects or layers to the enforcement of location-driven rules.

1. Player legality

In jurisdictions that permit online gambling only within defined geographic boundaries, operators may need to establish that a customer is physically present in an authorised territory before allowing regulated gambling activity. A registered account or residential address alone may not establish where someone is when they attempt to play.

2. License scope

Permission to offer gambling services in one jurisdiction does not automatically authorise an operator to accept customers or gambling activity in another. Online gambling businesses therefore need controls aligned with the geographic scope of each licence and the specific rules of the relevant regulator.

3. Advertisement

Affiliates should not deliberately target or acquire players in territories where the promoted gambling service cannot legally be offered. Sports betting and online gambling operations should, therefore, consider geographic restrictions not only at the wagering stage, but also when establishing affiliate terms, approving campaigns and monitoring traffic sources.

How Does Location Enforcement Work for iGaming Compliance?

There are several signals which can be used to assess a player’s location. Depending on the platform and regulatory requirements, these may include: 

• IP geolocation, 
• Device-location data, 
• Wi-Fi or other location signals, 
• VPN and proxy detection, 
• Device-integrity indicators, and, 
• Repeated location checks during a session. 

Where signals conflict or indicate unusual activity, the transaction or account can be blocked, reviewed or escalated according to the operator’s controls.

The objective is generally not to depend on a single location indicator, but to use appropriate controls to establish whether regulated activity is occurring within an authorised area.

Take the instance of how the lottery works in Delaware, a state in the US. The Delaware Lottery currently states that Internet Gaming users must be at least 21 years old and physically located within Delaware when playing. This illustrates why an operator’s geographic controls need to establish a player’s actual location rather than relying solely on account information.

iGaming Regulations by Country, Jurisdiction

UK iGaming Compliance

The UK Gambling Commission (UKGC) regulates commercial gambling in Great Britain. Businesses providing remote gambling facilities to consumers in Great Britain generally require the appropriate UKGC operating licence, even where the operator itself is based overseas.

Licensed operators must comply with the Licence Conditions and Codes of Practice (LCCP). 

Sportsbooks and other operators must also meet applicable Remote Gambling and Software Technical Standards and other sector-specific requirements.

KYC controls include verifying a customer’s age and identity before they are permitted to gamble. AML controls require risk assessment, customer due diligence where applicable, transaction and customer monitoring, appropriate policies and controls, record-keeping and suspicious-activity reporting. 

The UKGC’s July 2026 ML/TF risk assessment continues to classify the remote casino sector as high risk for money laundering. It also highlights increasingly sophisticated attempts to bypass identity checks using fraudulent documents, AI-generated documents, deepfake videos and face swaps.

When it comes to promotions, there is a requirement to satisfy UKGC licence requirements as well as applicable CAP Code and ASA requirements. iGaming businesses also remain responsible under relevant LCCP provisions for contracted third parties, including affiliates. 

Remote operators in specified licence categories must additionally undergo independent security audits against applicable technical-security requirements.

Malta iGaming Compliance

Malta’s regulator is the Malta Gaming Authority (MGA) whose licensing structure distinguishes primarily between a Gaming Service Licence, used for B2C gaming services, and a Critical Gaming Supply Licence, used for B2B activities involving material gaming elements, regulatory records or relevant control systems.

Malta also uses four game types within its licensing framework. Depending on the type of offerings available with an operator, ideally they should assess the specific licence and game classification applicable to their activities.

But, here iGaming compliance extends beyond licensing. Relevant operators must address:

• AML/CFT, 
• Player protection, 
• Self-exclusion, 
• Responsible-gambling measures, 
• Technical controls, 
• Reporting, 
• Governance, and, 
• Designated key functions. 

Commercial communications are also subject to Malta’s gaming advertising framework, including the Gaming Commercial Communications Regulations.

It is vital to note that for AML/CFT, relevant B2C operators are subject to risk-based obligations and supervisory scrutiny. Player-protection rules include mechanisms such as self-exclusion and safer-gambling controls.

Curaçao iGaming Compliance

The old description of Curaçao as a system of master licences and sub-licences is a thing of the past. The National Ordinance on Games of Chance, or LOK, came into force on 24 December 2024 and established the current framework overseen by the Curaçao Gaming Authority (CGA). 

Existing licences under the previous NOOGH regime moved into transitional arrangements, including conversion to provisional licences. 

Under the LOK framework, an online gaming licence is required to offer online gaming in or from Curaçao. The CGA states that this requirement also extends to entities that directly or indirectly control player databases and player transactions.

Accordingly, the frame of reference of iGaming compliance has shifted. It encompasses licensing, corporate establishment and governance, player protection, AML/CFT, reporting and continuing regulatory supervision. The CGA also performs AML/CFT supervisory functions for the sector.

The major practical point is that Curaçao should now be treated as an “actively supervised direct-licensing jurisdiction”.

Supplier licensing here also requires careful dating. The LOK provides for supplier licences covering certain gambling-related critical services and goods, but implementation of individual supplier obligations is subject to transitional and commencement provisions.

United States iGaming Compliance

The United States does not have a single national online-casino licence. Online casino regulation is primarily state-based, which means operator, supplier, affiliate, technical and game-approval requirements vary considerably by state.

Running a campaign in the US involves checking where such activity is legal.

During 2025, seven states had lawful commercial online casino markets: Delaware, New Jersey, Pennsylvania, Michigan, West Virginia, Connecticut and Rhode Island, according to the American Gaming Association’s 2026 State of the States report.

Here’s a list of the regulators applicable in licensed states and what they cover in terms of activity.

State	Regulator	Recognised Activities
New Jersey	Division of Gaming Enforcement or Casino Control Commission	Regulated internet gaming
Pennsylvania	Pennsylvania Gaming Control Board	Regulated iGaming
Michigan	Michigan Gaming Control Board	Licensed online casino gaming
Connecticut	Department of Consumer Protection	Regulated online casino market
Delaware	Delaware Lottery	Authorized internet gaming
Rhode Island	State gaming framework	Regulated online casino market
West Virginia	West Virginia Lottery	Regulated iGaming
Maine	Gambling Control Unit	Legal framework enacted

Federal rules can still overlay state regulation. In particular, casinos subject to the Bank Secrecy Act must address applicable online and mobile gambling activity within their AML programmes.

Ontario iGaming Compliance

For private operators, authorization involves two key components in the region of Ontario: registration with the Alcohol and Gaming Commission of Ontario (AGCO) and execution of an Operating Agreement with iGaming Ontario (iGO). 

Operators cannot enter Ontario’s regulated private market (i.e. the Ontario licensed market) until both steps have been completed

Operators must meet the Registrar’s Standards for Internet Gaming, covering areas such as game integrity, player protection, responsible gambling, underage access, advertising, technical systems and related compliance. Suppliers may also require AGCO registration and independent technical certification.

In 2026, BetGuard, Ontario’s centralized self-exclusion programme was launched. It allows a person aged 19 or older to self-exclude from all regulated Ontario online gambling sites through one system and prevents access to existing accounts, creation of new accounts and direct marketing during the exclusion period.

Brazil iGaming Compliance

The fully regulated federal market has operated since 1 January 2025, and authorized operators use approved “.bet.brdomains”. The Ministry’s current list expressly identifies authorizations effective from that date.

Compliance includes SPA authorization, permitted-game requirements, certification, responsible gambling, payments, reporting, advertising and AML/CFT controls. Portaria SPA/MF 1.143/2024 establishes important AML obligations, including customer-risk controls and record-keeping.

In 2026, Decree 13.033 introduced mechanisms aimed at financially disrupting unauthorized betting operations. The Central Bank subsequently issued rules addressing blocking of accounts and transactions connected with unauthorized operators.

Advertising rules also tightened in 2026, once some of the waters had been tested. New measures require standardized gambling-risk warnings and expand obligations for parties involved in betting advertising.

What Does iGaming Compliance Look Like in Europe?

The thing about Europe is that it does not have one unified gambling licence. Gambling regulation remains substantially national. Each EU state determines its own gambling-policy objectives and licensing framework, subject to EU Treaty principles and CJEU case law. 

So obtaining iGaming compliance in any given state has multiple layers. Let’s understand what these look like.

Layer	Example
The National Law	Licensing, permitted products, local advertising rules
EU Privacy Framework	GDPR and related data-protection obligations
EU AML Framework	Current AML directives plus incoming AMLR/AMLD VI architecture
Consumer Laws	Protection from unfair commercial practices (which is already enforced strictly)
Payments and Financial Rules	Applicable EU and national financial requirements

The cost of compliance here is spread — it’s required to ‘pass’ when it comes to the larger organization, in addition to serving national or state-wide goals.

The new AML Regulation (AMLR) and AMLD VI framework is set to go live from July 2027, which will require more compliance from sportsbooks and online casinos. This time in between serves as a perfect opportunity to review and reframe organizational norms to match what’s coming.

Asia-Pacific and MENA: Market-Specific Restrictions

Regional generalizations simply do not apply to the Asia-Pacific zone. The regulatory position can differ dramatically between individual markets, so operators will always need to assess each jurisdiction on its own terms, depending on their business needs.

Here’s a snapshot for reference, based on a comparison between four different countries in this very region:

Australia

The Interactive Gambling Act establishes restrictions on certain online gambling services, with the Australian Communications and Media Authority (ACMA) responsible for enforcement. ACMA uses website blocking against illegal gambling and affiliate services. As of 2026, that includes 1,774 websites.

Singapore

Remote gambling is tightly controlled in this country. Offering unlicensed remote gambling services in or into Singapore is unlawful, while Singapore Pools remains the only GRA-licensed remote gambling operator.

India

The Promotion and Regulation of Online Gaming Act, 2025 introduced a national framework addressing online money games or real-money games, including restrictions on their offering, advertising and associated financial transactions. 

The Online Gaming Authority of India has also been established. Consequently, older explanations that portray India solely through its state-level gambling laws may no longer accurately describe the online-gaming landscape.

UAE

The UAE should not simply be characterised as a jurisdiction with a blanket prohibition on gambling. 

The General Commercial Gaming Regulatory Authority (GCGRA) now provides a federal licensing and regulatory framework covering areas such as internet gaming, sports wagering, lotteries and land-based commercial gaming. Operating commercial gaming activities without the required GCGRA authorisation remains unlawful.

iGaming Compliance Checklist for Operators

The following checklist can help operators identify key controls and maintain evidence for regulators, auditors and internal reviews.

Areas to Check	What Should iGaming Operators Verify?	Evidence
Market Legality	Can we legally offer this product to this customer in this jurisdiction?	Legal assessment
License	Do we have all licences, registrations or approvals required?	Licence and registration records
Ownership Structure	Are ownership disclosures and key-person approvals up to date?	Regulatory filings
KYC	Have we adequately established the customer’s identity?	Verification records
Age-gating	Has the customer’s age been verified in accordance with local requirements?	Age-verification records
AML	Have customer and transaction risks been assessed appropriately?	Risk assessments
EDD	Have enhanced due-diligence measures been applied when required?	EDD and source-of-funds evidence
Sanctions or PEP-risk	Are relevant customers and transactions screened effectively?	Screening records
Monitoring	Are unusual transactions and customer behaviour being identified and reviewed?	Alerts and case files
Responsible Gambling	Are required safer-gambling measures functioning?	Limits and customer-interaction records
Self-exclusion	Is self-exclusion applied across all channels and brands where required?	Exclusion records
Advertising	Has marketing been reviewed against applicable rules before publication?	Creative approvals
Affiliates	Are affiliates properly contracted, supervised and audited?	Contracts and monitoring records
Geolocation	Are customers prevented from accessing services where they are not legally permitted?
Game Compliance	Have games and technical systems received required testing or certification?	Certificates and test reports
Data Privacy	Is player information collected and processed lawfully and transparently?	Privacy documentation and certifications
Security	Are security and operational controls tested and maintained?	Audit and testing reports
Payments	Are payment methods and transactions handled in accordance with applicable requirements?	Transaction records
Reporting	Are required regulatory and FIU reports submitted within applicable deadlines?	Submission confirmations
Regulatory Changes	Are legislative and regulatory developments identified, assessed and assigned to owners?	Regulatory change register (maintained internally by legal teams).

iGaming Compliance Requirements for Affiliates

Affiliate compliance is not simply about checking whether an affiliate is licensed. For sportsbooks, online casinos and gambling brands, operators need to demonstrate effective oversight of the businesses and individuals promoting their services.

What Should Businesses Check Before Onboarding?

Operators should complete due diligence covering:

• Corporate identity: Verify the affiliate’s business, ownership and relevant individuals.
• Market coverage: Confirm which countries and audiences the affiliate intends to target.
• Traffic sources: Understand whether traffic comes from websites, search, social media, influencers, email or other channels and implement traffic scoring.
• Sub-affiliates: Establish whether the affiliate uses third parties and how those relationships are controlled.
• Regulatory history: Check for previous enforcement action, warnings or significant compliance issues.
• Prohibited methods: Identify promotional practices that cannot be used before traffic is accepted.

What Aspects of the Affiliate Contract Enable iGaming Compliance?

Affiliate contracts should clearly establish some of the following aspects to be broadly in line with regulatory requirements across geographies:

• Permitted markets, products and channels
• Creative approval requirements
• Prohibited claims and misleading representations
• Rules for bonuses, promotions and responsible-gambling messaging
• Conditions for using sub-affiliates
• Recordkeeping requirements
• Operator audit and information rights
• Suspension and termination provisions

The affiliate contract should give the operator practical control when an affiliate breaches regulatory or brand requirements. The best way to keep a check is to conduct regular audits.

How to Verify Compliance During Affiliate Promotions?

Affiliate oversight should continue throughout the relationship. Operators should monitor the following aspects as campaigns go live and partners pitch in for promoting brands and businesses:

• Creative version control: Confirm that published materials match approved versions.
• Landing pages: Check that destination pages remain compliant.
• Geography: Monitor whether traffic is coming from approved jurisdictions.
• Traffic quality: Investigate unusual volumes, patterns or conversion activity.
• Brand bidding: Enforce agreed search-engine bidding restrictions.
• Incentives: Check that affiliates are not using prohibited or misleading incentives.
• Social and influencer activity: Monitor promotional content across relevant platforms.
• Suspicious traffic: Investigate potentially fraudulent or manipulated traffic.
• Complaints: Maintain a clear process for escalating and resolving compliance concerns.

What Evidence Should Operators Retain?

A well-managed affiliate programme should create a clear audit trail and conduct regular affiliate compliance monitoring. For this purpose, useful records include:

• Affiliate identity and due-diligence records
• Current contract version
• Approved geographies
• Approved offers and promotions
• Campaign IDs and referral URLs
• Approved creative versions and approval history
• Click and conversion timestamps
• Traffic anomalies and investigations
• Compliance warnings and remediation
• Suspension, termination and reinstatement history

The goal is to demonstrate more than the existence of affiliate rules. Operators should be able to show who was promoting the brand, where they were operating, what they were publishing and how potential breaches were identified and addressed.

How Does Affiliate Management Technology Support iGaming Compliance?

Affiliate management technology does not make an operator compliant by itself. Instead, it can support the controls and evidence required by a broader compliance programme.

For sportsbooks, online casinos and other iGaming brands, the value is often in making affiliate activity easier to control, monitor and document.

Type of iGaming Compliance Needed	How Affiliate Marketing Software Supports the Requirement
Approved-partner access	Structured onboarding and partner permissions
Market restrictions	Geographic and campaign configurations available on a global and campaign-basis
Campaign traceability	Tracking links, campaign IDs and activity logs
Creative governance	Approval flow for campaign and advanced creative controls
Traffic monitoring	Click, conversion and anomaly visibility
Fraud oversight	Suspicious-traffic detection and blocking tools
Affiliate accountability	Partner-level performance and activity records
Audit trails	Historical campaign and transaction data
Rapid enforcement	Pausing or suspending partners and campaigns (if needed)
Reporting	Centralised partner and campaign reporting

This becomes particularly useful when an operator needs to demonstrate not only that controls exist but that they are actively being used.

Affnook can support this operational layer by bringing affiliate management, tracking and performance information into one environment. For compliance teams, the benefit is less about replacing legal or regulatory controls and more about improving visibility over affiliate activity and maintaining accessible records.

Technology cannot determine whether a campaign is legally permitted in every market or replace an operator’s compliance responsibilities. However, a well-configured affiliate platform can help turn compliance requirements into repeatable operational controls while making relevant activity easier to monitor, investigate and evidence — which you can always see, present and keep for future instances.

For growing casino affiliate programmes, this can provide a more structured way to manage partners without relying entirely on spreadsheets, disconnected tracking systems or manual reporting.

FAQs