The iGaming Industry Explained

iGaming is the business of offering real-money gambling over the internet: online casino games, live-dealer tables, poker, bingo, lottery products and, in most usage, online sports betting. Behind every consumer brand sits a supply chain of platform vendors, game studios, test labs, payment firms and marketing partners, and a regulator who decides which of them may serve which country.

This page is the map. It explains how the industry is put together, how money moves through it, how the main licensing regimes differ, and where the compliance pressure sits in October 2026. Each section ends at the reference page that covers the subject in depth, built from regulators’ own registers, statutes and published decisions.

What counts as iGaming?

iGaming covers any game of chance or betting product where the stake, the result and the payout happen through a remote connection rather than across a physical counter. Regulators group it into a handful of product verticals, and the vertical decides which licence an operator needs, how its games are certified and what tax it pays. The same company can run several verticals under different permissions.

Sweden is a useful example of how this is written into law. Its Gambling Act (Spellag 2018:1138) groups online casino and online betting as separate licensable game types, while state lotteries sit in a different licence class. Germany splits the picture further: virtual slot machines, online poker and sports betting are licensed nationally under the State Treaty on Gambling 2021 (GlüStV 2021), but online roulette and blackjack remain a matter for each federal state.

How is the iGaming supply chain structured?

An online casino brand is usually the visible end of five or six separate businesses. The operator holds the licence and the player relationship; a platform vendor runs the player accounts and wallet; aggregators connect hundreds of games from studios; test labs certify those games; payment and identity firms move money and verify customers; affiliates send traffic. Each link has its own contracts, fees and, increasingly, its own licence.

1. Operator (B2C). Holds the gambling licence, sets bonus terms, carries the anti-money-laundering and safer-gambling duties, and pays the gaming tax.
2. Player account management (PAM) platform. Registration, wallet, bonus engine, back office and reporting. Vendors include EveryMatrix, SOFTSWISS and Kambi on the sportsbook side; some large operators build their own.
3. Aggregator. One integration that brings games from many studios, handles round reporting and often settles studio fees.
4. Game studios and live studios. Build the content. Evolution is the best-known live-casino supplier; RNG studios number in the hundreds.
5. Testing laboratories. Firms such as GLI, BMM Testlabs, eCOGRA and iTech Labs test RNGs, game mathematics and platforms against each regulator’s technical standard.
6. Payments, KYC and geolocation. Acquirers, open-banking and e-wallet providers, identity-check vendors and, in North America, geolocation services that prove a player is inside the licensed state.
7. Affiliates and media. Comparison sites, streamers and publishers paid per depositing player or by revenue share.

Regulators have pushed licensing down this chain over the past decade. Sweden has required a separate licence for gambling software since 1 July 2023; Malta licenses “critical gaming supply”; Great Britain issues remote gambling software licences; Ontario’s AGCO registers gaming-related suppliers. Our B2B supply-chain guide sets out who needs what, and the testing-labs page covers certification.

Which operating model fits a new brand?

A new operator can own its licence and technology, rent both, or sit in between. The choice decides launch speed, margin and who answers to the regulator. Under a white label, the licence holder is the platform company and the brand owner is a marketing partner; under a turnkey deal, the brand holds its own licence but rents the platform; a proprietary build owns both and carries the full engineering cost.

Regulators have become wary of white labels in national markets because responsibility blurs. Several now expect the brand owner to hold its own licence, or at least to be named and vetted, before a site may face local players. Hub regimes such as Curaçao ended the old master-licence and sub-licence structure with the 2024 reform, which moved every operator onto a direct licence.

Which technical standards apply to games and platforms?

Regulators publish technical standards that games and platforms must meet before launch, and accredited labs test against them. Great Britain has its Remote gambling and software technical standards (RTS); Sweden sets its rules in SIFS 2022:3, which includes a minimum of three seconds per game round including autoplay; GLI-19 is the widely used laboratory standard for interactive gaming systems. Each certified game carries a report the operator must keep.

The standards cover more than randomness. Return-to-player figures must match the certified maths; game rules must be displayed; incomplete rounds must be resolved fairly after a disconnection; and any later change to a certified component usually needs change-management approval. A studio that sells into many markets therefore holds a stack of certificates for the same game, one per standard, which is a large part of the cost of distribution.

How does money flow through an iGaming business?

The base number is gross gaming revenue (GGR): stakes minus winnings paid out. From GGR the operator deducts bonus costs to reach net gaming revenue (NGR), pays gaming tax on whichever base the law sets, and shares a slice with the businesses that supplied the games, platform and players. What remains has to cover payments, compliance, marketing and staff.

Three features of that flow matter to anyone entering the market.

• The tax base differs by country. Sweden taxes licensed operators at 22 percent from 1 July 2024 (18 percent before). Germany levies 5.3 percent on the stake itself for virtual slots, online poker and sports betting, which is far heavier in practice than the headline rate suggests, because it is charged before any winnings are paid. Great Britain raised Remote Gaming Duty to 40 percent of profits from April 2026.
• Supplier fees are usually a share of GGR. Game studios, aggregators and platform vendors commonly charge a percentage of the GGR their product generates, plus set-up or minimum fees. Rates are commercial and rarely published.
• Affiliate pay is either a one-off or a share. Cost per acquisition (CPA) pays a fixed amount per first-time depositor; revenue share pays a percentage of the NGR a referred player generates over time; hybrid deals combine both. Australia’s 2026 reforms ban activity-based affiliate commissions from 2027, according to the ACMA.

Payment costs are a line of their own. Gambling is a high-risk category for card schemes, cards cannot be used for licensed gambling in Great Britain or for licensed wagering in Australia, and Sweden added a ban on gambling on credit from 1 May 2026. The payments page walks through cards, open banking, e-wallets and crypto.

How did online gambling regulation develop?

Online gambling began offshore in the mid-1990s and was pulled onshore over the next three decades, market by market. Antigua and Barbuda licensed some of the first internet casinos from 1994, and Kahnawake began online licensing on 8 July 1999. National regulation followed in waves: Great Britain in 2005 and 2014, the Nordic and southern European markets from 2011, and the large continental markets between 2019 and 2025.

The direction is consistent: a jurisdiction that tolerated or ignored offshore play eventually writes a licence requirement, sets a tax, connects operators to a national self-exclusion register and starts blocking those who stay outside. Grey markets shrink over time, and a business plan that depends on one is a plan with an expiry date. Brazil is the warning in the other direction: a licensed market can also be closed by its own government, so political risk belongs in the plan as well.

Which licensing regimes matter most?

Twelve regimes cover most of the conversations in this industry: the “hub” licences used to serve many countries (Malta, Curaçao, Gibraltar, Isle of Man, Kahnawake, Anjouan) and the national or provincial licences that a market requires before an operator may target its residents (Great Britain, Sweden, Denmark, Germany, the Netherlands, Ontario). The table shows who regulates each one and where its register lives.

The hub licences answer a different question from the national ones. An MGA or Curaçao licence lets a company operate lawfully from that jurisdiction; it does not give a right to target players in a country that requires its own licence. Spelinspektionen made the point when it banned Claymore Malta on 8 January 2026, and the Court of Justice of the European Union confirmed on 16 April 2026 (case C-440/23) that member states may make online casino games subject to their own permission. Fees, timelines and obligations for each regime are compared in our licensing comparison; the two most common hub choices are set side by side in MGA vs Curaçao.

How do you verify a gambling licence?

Verification takes four steps and about five minutes: identify the legal entity, open the regulator’s own register, match the entity and licence number, then match the domain. The weak point is the badge. Logos and seals are images that anyone can copy, so the only proof is a live register entry that names the same company and, where the register lists them, the same website.

1. Find the entity. Read the site’s footer and terms for the company name, registration number and licence number. If none of these is given, that is already an answer.
2. Go to the register directly. Type the regulator’s address yourself rather than following a link from the site under review.
3. Match the details. Company name, licence number, licence type (B2C or B2B) and status. Curaçao’s register, for example, distinguishes licences granted under the new law from applications still being assessed.
4. Match the domain. Several registers list approved domains. For Anjouan, start from the seal ID on the licensed site: a bare-domain search can return invalid even for a licensed operator. Curaçao’s register is also in transition: on 7 October 2026 the CGA said its old portal and digital seal will not return and a replacement proof of licensed domains is coming.

The same check applies when a supplier or affiliate partner claims a licence. Our Curaçao licence guide explains how the new register works after the 2024 reform.

How do companies choose a market to enter?

Market selection starts with the legal model rather than the size of the prize. A country either licenses private operators, keeps gambling as a state monopoly, or prohibits remote gambling and enforces with blocking and payment controls. Only the first is open to newcomers. After that come the tax base, the cost of local compliance, advertising limits and the share of play that already happens on licensed sites.

Before any of that, five questions sort a long list of countries into a short one:

1. Is there a licence a private company can actually obtain? A law that licenses only the national lottery is a closed market, however large.
2. What is taxed, and at what rate? A tax on stakes behaves very differently from a tax on gross gaming revenue at the same headline percentage.
3. Which products are allowed? Some markets license betting but not casino games, or slots but not live tables.
4. What does local compliance cost? Local representatives, data hosting, national self-exclusion links, certified game versions and reporting interfaces all add fixed cost.
5. How much play is already licensed? Regulators that publish channelisation figures show how much of the market a licensed newcomer can realistically reach.

Some reference points as of October 2026:

• Europe remains a patchwork. Sweden reported that 84 percent of gambling took place with licensed operators in 2025; Germany’s GGL counted 129 licensed operators and 229 permitted websites on its whitelist in September 2026; Finland plans to open a licensed market on 1 July 2027; Norway keeps its monopoly and has used DNS blocking since 1 January 2025.
• North America is regulated state by state. Eight US states have legalised online casinos and seven of those markets are live; Ontario is the only Canadian province with an open, multi-operator market.
• Latin America shows how fast a market can turn. Brazil’s regulated betting and online gaming market under Law 14.790/2023 began on 1 January 2025, but Provisional Measure 1.394 of 25 September 2026 prohibits fixed-odds betting and online games and ends existing authorisations; it still needs Congress to convert it into law and faces a challenge at the Supreme Federal Court.
• Australia prohibits online casino games for operators under the Interactive Gambling Act 2001, and the ACMA blocks offshore sites.

The market-entry guide covers each region, and European markets are compared country by country.

What do regulators expect on compliance?

Three obligations run through every serious regime: know who the customer is and where the money comes from, protect people who are being harmed by gambling, and keep marketing within the rules. Licences are rarely lost over game fairness. They are lost, fined or suspended over anti-money-laundering failures, weak safer-gambling interventions and advertising that reaches the wrong audience.

Anti-money laundering and KYC

EU law treats online gambling operators as obliged entities. Under the Fourth Anti-Money Laundering Directive (EU) 2015/849, casino customers must be identified when they stake or collect EUR 2,000 or more, including linked transactions. The new EU Anti-Money Laundering Regulation (EU) 2024/1624 will replace much of the directive framework from 10 July 2027. Our AML and KYC page covers due diligence, source-of-funds checks and reporting.

Safer gambling

Limit tools, reality checks, time-outs and self-exclusion are now standard licence conditions. National self-exclusion schemes such as GamStop in Great Britain, Spelpaus in Sweden, ROFUS in Denmark, OASIS in Germany and CRUKS in the Netherlands bind every licensed operator in their market. Germany adds a cross-operator deposit limit of EUR 1,000 a month, managed through its LUGAS system. The responsible-gambling page compares the requirements.

Advertising and affiliates

Most regulators hold the operator responsible for what its affiliates publish. That has made affiliate compliance a contract and audit function rather than a marketing afterthought. Sweden has gone further and acted directly against a domestic media site for promoting unlicensed brands. Rules by market are set out in our affiliate compliance guide.

Who is personally accountable inside a licensed operator?

Regulators do not only license companies; they also approve the people who run them. Great Britain requires personal management licences for people in specified management roles; Malta requires key function holders, such as the compliance and anti-money-laundering officers, to be approved by the MGA; and most EU regimes require a named money-laundering reporting officer who answers personally to the financial intelligence unit.

In practice this creates a small set of roles that every licensed business must fill before launch and keep filled afterwards:

• Compliance lead. Owns the licence conditions, regulatory reporting and the relationship with the regulator.
• Money-laundering reporting officer (MLRO). Decides which suspicions are reported to the financial intelligence unit and signs off the business-wide risk assessment.
• Safer-gambling lead. Runs the markers-of-harm model, interaction scripts and the escalation path when a customer shows signs of harm.
• Technical or information-security lead. Keeps certified systems under change control and reports security incidents where the licence requires it.

Those approvals follow the person, not the company. A change of compliance officer or a new shareholder above the regulator’s threshold usually has to be notified, and sometimes approved, before it takes effect. Due diligence on people is therefore as much a part of a licence application as the business plan, and a weak point in many first applications.

What are regulators fining companies for?

Large penalties cluster around the same failures: missed money-laundering red flags, customers allowed to lose heavily without checks, and marketing aimed at the vulnerable or underage. In Great Britain, Entain agreed to pay GBP 17 million in August 2022 and William Hill GBP 19.2 million in March 2023 for social responsibility and anti-money-laundering failures. Dated cases from several regulators are logged in our enforcement tracker.

Enforcement has also moved outward, from the licensed operator to the businesses around it. Germany’s GGL reported that 178 websites were cut off from payment channels in 2025 and that 1,843 illegal sites were no longer reachable from Germany after its interventions. Payment providers, hosting firms and promoters are now regular targets of blocking orders and warnings, which is why due diligence on partners matters as much as an operator’s own licence.

For a business owner, the practical lesson is to price compliance in from the first spreadsheet. Fines are the visible cost, but remediation programmes, independent audits ordered by the regulator, and the management time spent on them often cost more, and a licence review can freeze expansion plans for months while it runs.

What changes are coming in 2026 and 2027?

Several dated changes will reshape costs and compliance over the next eighteen months. Finland’s licensed market opens on 1 July 2027; the EU Anti-Money Laundering Regulation applies from 10 July 2027; Australia’s affiliate-commission ban starts in 2027; and operators in Great Britain are absorbing the 40 percent Remote Gaming Duty that took effect in April 2026. Each one moves money or obligations, not just paperwork.

• Stake limits are spreading. Great Britain capped online slot stakes at GBP 5 per spin for adults aged 25 and over from 9 April 2025, and at GBP 2 for 18 to 24 year olds from 21 May 2025. Germany keeps EUR 1 per spin as the baseline but since 1 July 2026 allows a staged exception: up to EUR 3 only for players aged 21 and over, and up to EUR 5 only after at least 90 days of unremarkable play under operator monitoring, until 31 December 2027.
• Payment controls are tightening. Credit bans now cover Great Britain, licensed Australian wagering and, from 1 May 2026, Sweden, while Germany’s GGL uses payment blocking against unlicensed sites.
• Crypto is regulated on the payments side. The EU’s Markets in Crypto-Assets Regulation has applied in full since 30 December 2024, and the travel rule under Regulation (EU) 2023/1113 makes crypto transfers traceable. Few national gambling regulators allow crypto deposits at all.
• Hub licences are under pressure. Curaçao’s new law requires local substance and a direct licence; Malta’s Article 56A of the Gaming Act, which lets Maltese courts refuse to enforce some foreign judgments against MGA licensees, remains contested in other EU states.

Where should you start?

Start with the question you actually have. The site is organised so that each hub answers one of them, with sources at the foot of every page and a glossary for the acronyms.

Everything here is information for professionals, not legal advice. Rules change, and the regulator’s current text and a qualified adviser should settle any decision with money or a licence at stake.

Frequently asked questions

What does iGaming mean?

iGaming is the industry term for gambling offered over the internet or on mobile devices: online casino games, live-dealer tables, poker, bingo, lottery products and, in most usage, online sports betting. It covers both the consumer-facing operators and the B2B suppliers that build their platforms, games and payment links.

Is iGaming legal?

It depends on the country, and often on the state or province. Some markets license private operators (Great Britain, Sweden, Ontario, New Jersey), some keep a state monopoly (Norway, most of Finland until 2027), and some prohibit online casino games outright for operators, as Australia does under the Interactive Gambling Act 2001.

What is the difference between B2B and B2C in iGaming?

B2C companies are the operators that hold the player relationship, take bets and pay winnings. B2B companies sell to those operators: player-account platforms, game studios, aggregators, live-casino studios, sportsbook feeds, payment and identity services. Many regulators license or register both layers separately.

How do I check whether a gambling licence is real?

Find the licensing entity named in the site’s footer or terms, open the regulator’s own public register from the regulator’s website, search by company name or licence number, and confirm that the domain and the licence status match. A seal or badge on its own proves nothing, because it can be copied.

What is GGR?

Gross gaming revenue is the total amount players stake minus the winnings paid back to them, before bonuses, taxes and other costs. Most regulators and tax authorities use it, or a close variant, as the base for gaming duty and for licence fees, so it is the number every layer of the industry quotes.

Do suppliers need a gambling licence too?

Increasingly, yes. Malta licenses critical gaming supply, Great Britain issues remote gambling software licences, Sweden has required a separate software licence since 1 July 2023, and Ontario registers gaming-related suppliers with the AGCO. A studio or platform selling into those markets needs the local permission as well as its home licence.

Who are the main iGaming regulators?

Among the most-cited are the Malta Gaming Authority, the UK Gambling Commission, the Curaçao Gaming Authority, the Gibraltar Gambling Commissioner, the Isle of Man Gambling Supervision Commission, Spelinspektionen in Sweden, the Danish Spillemyndigheden, Germany’s GGL, the Dutch Kansspelautoriteit and the AGCO in Ontario.