iGaming licensing separates two roles. Operators offering games to players need one kind of authorization. Companies supplying the software and platform behind those games need another. Both carry technical obligations that shape how the software is built, tested and monitored, which is why licensing belongs in the architecture conversation rather than only in the legal one.
What are iGaming licenses and why do they matter?
iGaming licenses are regulatory authorizations that permit a company to supply gambling software or to offer gambling services to players. They exist because online gambling is a regulated activity in most markets, with rules covering game fairness, player protection, financial conduct and anti-money-laundering obligations.
The consequences of operating without appropriate authorization are severe and go beyond fines. Unlicensed operations lose access to the services a platform needs to function. Payment processors, banking partners and advertising networks generally decline to work with unlicensed gambling businesses, which makes the commercial model unworkable regardless of how the platform is built.
Licensing also shapes the technical requirements. Regulators specify what the software must do: how outcomes are generated, what records are kept, which player-protection tools are available, how data is stored. These are not documentation exercises. They are functional requirements that belong in the technical specification from the start, because retrofitting them into a live platform is expensive.
Which jurisdictions license iGaming software and operators?
Several jurisdictions maintain established licensing regimes, and each sets its own requirements. The overview below describes structure rather than detail, because the detail changes and should be verified at source.
Malta. The Malta Gaming Authority operates under the Gaming Act 2018. It issues a B2C Gaming Service Licence for operators offering games to players, and a B2B Critical Gaming Supply Licence for suppliers providing platforms and games to those operators. Games are grouped into four types, and a single licence can cover several of them. The 2018 reform replaced an older structure based on separate classes per product, so material describing Malta in terms of Class 1 to Class 4 licences predates the current framework.
United Kingdom. The Gambling Commission operates one of the more demanding regimes. Operators serving British players require an operating licence. Companies supplying gambling software to those operators require a gambling software licence. The Commission places particular weight on player protection and on advertising conduct.
Curaçao. This jurisdiction changed substantially. The National Ordinance on Games of Chance came into force in December 2024, replacing the long-standing master and sub-license model. Legacy sub-licenses expired in January 2025, and licences are now issued directly by the Curaçao Gaming Authority, with its own public register and enforcement powers. Guidance describing Curaçao as a low-cost jurisdiction with minimal obligations reflects a system that no longer exists.
Other established regimes include Gibraltar and the Isle of Man, both built around extensive due diligence and continuing supervision.
Regulated national markets across Europe and in individual US states operate their own frameworks, often stricter and narrower than the jurisdictions above. Several European countries restrict some or all online gambling to a state operator, which means that in those markets no private licence is available for certain verticals regardless of how well prepared an applicant is. Where you intend to serve players is therefore a more important question than where you intend to be licensed.
What is the difference between operator and supplier licensing?
Operator licensing authorizes offering gambling services directly to players. Supplier licensing authorizes providing the technology behind those services to licensed operators. The two carry different obligations.
Supplier obligations center on the software: fairness of outcomes, integrity of the random number generator, security of the platform, and the ability to produce the records regulators require. Suppliers typically do not hold player funds, but their software must support every compliance feature the operator is obliged to provide.
Operator obligations are broader and commercial as well as technical: segregation of player funds, anti-money-laundering procedures, customer service standards, responsible gambling measures, marketing conduct and regular reporting to the regulator.
The two combine into a chain of accountability. A licensed operator running licensed software gives the regulator two supervised parties rather than one. In practice this means that a supplier’s technical shortcomings become the operator’s regulatory problem, and vice versa, which is why contractual allocation of these responsibilities matters as much as the licences themselves.
Some jurisdictions permit one company to hold both authorizations. That combination brings the obligations of both, so it increases regulatory load rather than simplifying it.
What must the software itself do?
This is the part of licensing that determines how a platform is built, and it is stable enough to describe with confidence.
Random number generation must be independently tested and certified. Approved laboratories verify that outcomes are genuinely random and cannot be influenced. Certification is periodic, not one-off.
Game fairness extends beyond the RNG to mathematical models, return-to-player values and volatility. Testing houses examine the game logic against what the game claims to do.
Responsible gambling features must be built in: deposit limits, session limits, self-exclusion, reality checks and access to support resources. The platform must also monitor player behavior for patterns that warrant intervention.
Data protection requires encryption, controlled storage and privacy controls consistent with GDPR and any additional local requirements.
Auditability requires detailed transaction logs, player activity records and system access monitoring, retained for the periods the regulator specifies and produced on request.
Every item on that list is a functional requirement. Treating them as compliance paperwork to be added later is one of the more expensive mistakes we see in this sector. A newer compliance layer sits alongside licensing now too — see what the EU AI Act means for WordPress-based iGaming platforms.
How do requirements differ across gaming verticals?
Requirements vary by product, because the risks differ.
Casino products generally carry the broadest requirements, covering slots, table games and live dealer offerings, each with its own fairness and player-protection standards.
Sportsbook requirements focus on integrity of odds, settlement procedures and monitoring for suspicious betting patterns, often with obligations toward sports governing bodies.
Poker requirements center on fairness between players, tournament integrity and transparency of rake, with fund segregation rules that differ from casino products.
Bingo and lottery products attract additional consumer-protection requirements related to prize funds and draw integrity.
A platform offering several verticals needs authorization covering all of them, and must maintain consistent standards across the whole system rather than per product.
Where does software development fit, and where does it not?
We build software. We do not advise on licensing, and this article does not attempt to.
What the distinction means in practice: our work concerns the layers that carry technical obligations rather than regulatory ones. Content platforms, affiliate portals, comparison sites, multi-brand and multi-language front ends. These integrate with licensed operator platforms through APIs, and the transactional core, meaning player wallets, game sessions and bet settlement, sits in systems built and certified for that purpose.
That distinction is not a disclaimer. It is an architectural position. Consistency of transactions, auditability and certification requirements exceed what a content management platform is designed for, and we advise against building that layer on one.
The content and affiliate layer carries its own obligations, which are frequently underestimated. Advertising rules, geo-targeting, restricted-market blocking and responsible gambling messaging apply to the surfaces players actually see. On the data side, that content and affiliate layer also carries GDPR obligations specific to affiliate marketing websites. Under several frameworks, including the reformed Curaçao regime, the operator carries responsibility for affiliate-generated traffic, which makes the technical implementation of geo-blocking and territory verification a compliance matter rather than a feature request.
How do you verify current requirements?
Do not rely on secondary sources for this, including this article. Frameworks change, and material describing superseded regimes stays online and ranks well.
- Go to the regulator directly. Each authority publishes its current framework, fee schedule and licence conditions.
- Check the public register. Established regulators maintain searchable registers of current licensees, which is also how you verify a partner’s status.
- Note the date on any guidance you read. The Malta and Curaçao examples in this article both show how quickly published material becomes wrong.
- Engage counsel in the target market. Licensing questions are jurisdiction-specific and depend on your corporate structure, funding and product mix.
FAQ
Do software suppliers need their own license?
In established jurisdictions, generally yes. Supplying platforms or games to licensed operators is a licensed activity in its own right, separate from the operator’s authorization. What counts as a licensable supply is defined by each regulator and is worth confirming before assuming your work falls outside it.
Does Malta still issue Class 1 to Class 4 licenses?
No. The Gaming Act 2018 replaced the class-based structure with two licence categories, B2C Gaming Service and B2B Critical Gaming Supply, alongside four game types. Guidance still describing Maltese licence classes predates that reform.
Is a Curaçao license still an easy option?
The framework changed in December 2024. The master and sub-license model was abolished, legacy sub-licenses expired in January 2025, and licences are now issued directly by the Curaçao Gaming Authority under a regime with substantive obligations. Any comparison based on the previous system is out of date.
How much does licensing cost and how long does it take?
Both vary widely by jurisdiction, licence type and applicant, and both change over time. We do not publish figures for this reason. Current fee schedules are published by the regulators, and realistic timelines are best assessed by counsel familiar with the specific application.
Does a content or affiliate site need a gambling license?
That depends on the jurisdiction and on what the site actually does. Sites that do not offer gambling themselves may still fall under advertising, marketing and consumer-protection rules, and operators are increasingly held responsible for affiliate traffic. This is a question for counsel in each target market, not one to resolve by analogy with another operator’s setup.
Can a gambling platform be built on WordPress?
The content, marketing and affiliate layer, yes, and that is where we work. The transactional core handling player wallets, game sessions and bet settlement, no. Those requirements call for systems designed and certified for transactional integrity.
This article is informational and does not constitute legal advice. Verify current requirements with the relevant regulator and with qualified legal counsel before acting.
Building the content, affiliate or multi-brand layer for a licensed operation? We will start with the architecture and the division of responsibility between systems. → Talk to us
