- Minimum age
- 21+
- KYC timing
- At account creation. For every deposit and withdrawal the licensee checks whether the information is inconsistent, unverified or in breach of its terms; if so it must ask for more information within 24 hours and, failing verification, suspend the account, bar wagering, surrender winnings to the Commission for the problem gambling fund, refund deposits and deactivate the account (COMAR 36.10.18.05 E).
- AML regime
- A licensee with at least $1 million in annual gross revenue is a "gaming establishment" for the federal Bank Secrecy Act (§ 9-1E-01(c)). Licensees must promptly report to the Commission suspicious or illegal wagering, including funds derived from illegal activity, laundering, use of agents and false identification (§ 9-1E-11(c)(1)(iv)).
- AML supervisor
- Federal Bank Secrecy Act regime, with suspicious wagering also reported to the Commission
- Deposit limits
- Platforms must let bettors set daily, weekly and monthly deposit limits; increases take effect only after the current limit period expires (COMAR 36.10.14.04 A(1), C).
- Loss limits
- Bettors can set daily, weekly or monthly loss limits that block further wagers for the rest of the period (COMAR 36.10.14.04 A(2)).
- Session limits
- Bettors can set a daily time limit measured from login to logout and a temporary suspension for a chosen number of days; decreases to time limits apply no later than the next login (COMAR 36.10.14.04 A(5), A(6), D).
- Data localisation
- All wagers must be initiated, received and otherwise made within the State unless the Commission determines otherwise; intermediate routing of data outside Maryland does not change where a wager is made (§ 9-1E-13).
- KYC requirements
- Only registered bettors may bet online; registration is in person at a licensed facility or online through an approved app (§ 9-1E-09(c)). The licensee records and keeps for five years the bettor's legal name, date of birth, residential address, phone number, email, Social Security number (or an approved equivalent), confirmation that the bettor may wager, and the source of identity authentication, such as a government ID number or approved remote multi-source authentication (COMAR 36.10.18.05 B, C). Identity must be verified through secure online databases and age verification must block under-21s (COMAR 36.10.16.05). Multi-factor authentication is mandatory for all accounts (COMAR 36.10.18.05 F).
- Stake limits
- Bettors can set wager limits per day, week or month and a maximum single wager (COMAR 36.10.14.04 A(3), A(4)). No licensee may accept more than $5 million from one patron on one sporting event (COMAR 36.10.14.01 D).
- Mandatory player messaging
- Websites must carry banners with the Commission's gambling assistance message and the underage warning "No bettor under the age of 21 is permitted to participate in sports wagering" (COMAR 36.10.10.03 B). Platforms must describe the consequences for underage or out-of-state bettors (§ 9-1E-11(b)(2)). Each licensee must file a responsible gaming plan before launch and annually (COMAR 36.10.10.02).
- Reporting obligations
- Prompt reports to the Commission of criminal or disciplinary proceedings, abnormal betting patterns, match fixing and suspicious wagering (§ 9-1E-11(c)); annual report by 1 July on minority and women ownership, employment and contracting (§ 9-1E-14(a)); quarterly promotional play reports and an annual promotional play report within 90 days of fiscal year end (COMAR 36.10.13.39 D, G); promotion terms filed at least two days before launch (COMAR 36.10.13.41 B). Sports wagering data must be kept securely for at least five years (§ 9-1E-03(c)).
- Game content restrictions
- Only events and wager types in the Commission's approved catalogue may be offered (COMAR 36.10.14.01, .02). No wagering on high school events or, unless approved, other amateur events (§ 9-1E-01(i)(2); COMAR 36.10.14.03). Esports only where every participant is at least 18. Interested parties may ask the Commission to ban a type of wager after a public hearing (§ 9-1E-11(e)).