A licence is a bundle of conditions
New entrants often picture a gambling licence as a certificate on the wall: you get one, and then you are allowed to operate. It is more useful to picture it as a contract with the state. The regulator permits the business to offer gambling, and in return the business accepts a set of conditions it must meet continuously, a set of fees and taxes it must pay, and the regulator's right to inspect, direct and, if necessary, remove the permission. The certificate is the least important part.
This lesson covers what licences exist, who needs which, what it takes to get one, what it costs, and what holding one obliges a company to do every day.
Types of licence
The names differ by jurisdiction but the categories are consistent.
Business-to-consumer (B2C), or operator, licences permit a company to offer gambling to the public under its own brand. These are what a sportsbook or online casino holds, and they carry the heaviest obligations because the licensee deals with players directly.
Business-to-business (B2B), or supplier, licences permit a company to provide gambling products or critical services to operators: game content, a betting platform, a random number generator, sometimes payments or hosting. Many regulators require suppliers to be licensed or registered in their own right so that the whole supply chain is under supervision. Britain, for example, requires a gambling software operating licence to manufacture, supply, install or adapt gambling software.
Product-specific licences. Some jurisdictions license by vertical: a sports betting licence, a casino licence, a poker licence, a lottery or bingo licence. An operator offering several products holds several licences or a combined licence with product endorsements. Britain's Gambling Act 2005 lists separate operating licences for casinos, bingo, general betting, pool betting and lotteries, among others.
Remote and non-remote. Online gambling and land-based gambling are often licensed separately, with different rules: in Britain every operating licence must state whether it is a remote licence, and a remote licence cannot also authorise non-remote activity. In some US states a land-based casino licence is the route to an online one: Pennsylvania's Gaming Control Board may authorise a slot machine licensee to conduct interactive gaming, and those licensees are the state's casinos. In other markets the two licences are applied for separately.
Personal licences. Several regulators require named individuals in key roles (the chief executive, the head of compliance, the money-laundering reporting officer, sometimes directors and major shareholders) to hold a personal licence or approval, so that responsibility attaches to people as well as to the company. In Britain, personal management licences are required for the heads of overall management, finance, regulatory compliance, marketing, gambling IT and anti-money laundering.
Key function approvals. Where a personal licence is not required, the regulator usually still has to approve the people performing certain functions and must be told when they change. Malta, for instance, requires approval before a Key Function is appointed, and assesses the person's fitness and propriety.
Who has to hold one
The rule that answers most questions is point of consumption: if you offer gambling to people located in a jurisdiction that licenses it, you generally need that jurisdiction's licence, wherever your company sits. Britain made this explicit in 2014, when it applied its licensing requirement to remote gambling used in Britain even where none of the operator's equipment is there. A licence from Malta does not permit an operator to serve customers in Sweden: Sweden's Gambling Act requires a licence to provide gambling in Sweden, and online gambling that is not directed at the Swedish market does not count as provided there. Suppliers face the same principle in the jurisdictions that license them.
The practical consequence is that a multi-market operator holds many licences, each with its own regulator, conditions, fees, reporting calendar and tax. Managing that portfolio is a large part of what a compliance function does.
What it takes to get one
An application has the same broad shape everywhere, though the depth varies from a few weeks of work in a light-touch jurisdiction to a year in a demanding one.
Corporate and ownership disclosure. Who owns the company, through what structure, up to the ultimate beneficial owners. Regulators want to see through holding companies to the people. Britain's Commission, for example, asks for an ownership chart naming anyone with 3% or more of the equity.
Suitability of people. Directors, senior managers and significant shareholders complete personal declarations covering identity, employment history, financial history, criminal record and any past regulatory involvement. The regulator checks these against its own and other agencies' records.
Source of funds and financial standing. Where the capital came from, whether the business can meet its obligations, and sometimes a requirement to hold reserves or a guarantee covering player balances. Pennsylvania, for example, requires a separate player funds account holding at least the total of player balances, funds in play and pending withdrawals.
Policies and procedures. Written anti-money-laundering, responsible gambling, customer verification, complaints, data protection and technical security policies, and evidence that they are implemented rather than merely written.
Technical compliance. Games and platforms tested and certified by an approved testing house; a technical audit of the systems; requirements on where data is hosted and how the regulator can access it.
Fees. An application fee, then an annual licence fee, often scaled by revenue or by product. Plus the testing and legal costs of preparing the application.
Timelines are set by the regulator, not the applicant, and a well-prepared application in an open-licensing market can still take several months. Britain's Commission currently quotes 16 weeks for an operating licence application, and does not guarantee it.
What it costs to hold one
Beyond the licence fee, the recurring costs are:
Gaming tax. Charged on gross gaming revenue in most modern regimes, at rates that range from single figures, such as Nevada's top rate of 6.75% of gross gaming revenue, to over half, such as Pennsylvania's 52% state tax on online slot revenue, sometimes with different rates by product. This is usually the largest single cost of being licensed. A few jurisdictions tax turnover rather than revenue, which changes the economics of low-margin products entirely: Germany, for example, taxes online slots at 5.3% of the stake.
Compliance staffing and systems. Verification providers, transaction monitoring, responsible gambling tooling, testing, audit, legal. These scale with the number of markets.
Levies and contributions. Several jurisdictions require payments toward research, prevention and treatment of gambling harm. Britain's statutory levy, in force since April 2025, charges online operators 1.1% of their gambling yield.
Reporting. Regular returns to the regulator on revenue, player numbers, complaints, self-exclusions, suspicious activity and more. Each is a recurring task with a deadline.
What holding one obliges you to do
The conditions attached to a licence typically require the operator to:
- Verify every customer's age and identity before they can gamble, or within a defined window. In Britain age must be verified before a customer can deposit, play free versions of games or gamble.
- Run anti-money-laundering controls proportionate to the risk.
- Provide responsible gambling tools and intervene with customers showing signs of harm.
- Protect customer funds, at a disclosed level, separately from operating money.
- Advertise only in permitted ways and never to children.
- Offer only certified games and keep the platform to the technical standards.
- Handle complaints through a defined process and, in many markets, an independent adjudicator. In Britain a complaint unresolved after eight weeks must be referable to a free alternative dispute resolution service.
- Report specified events, sometimes within days: a data breach, a key person change, a change in ownership above a threshold, a material financial deterioration. Britain requires key events, such as a new shareholder with 5% or more, to be reported within five working days.
- Cooperate with the regulator: answer information requests, allow inspections, act on directions.
Breaching a condition is the route to enforcement, which lesson six covers.
Keeping the licence
A licence is maintained, not just obtained. Renewals may be periodic: Sweden grants licences for at most five years, while a British operating licence continues in effect until it lapses, is surrendered or is revoked. Changes in the business (new products, new owners, new key people, a new platform) usually require prior approval or notification. The regulator may audit or inspect at any time. And the rules under the licence change, so an operator compliant in January can be non-compliant by December if it has not kept up.
The next three lessons take the three most important obligation areas in turn: knowing the customer, protecting the customer, and marketing to the customer.