The regulator and the licence
Every American online gambling licence is granted by a state regulator: a gaming commission or control board in most commercial states (New Jersey's Division of Gaming Enforcement and Casino Control Commission, Pennsylvania's Gaming Control Board, Michigan's Gaming Control Board, Nevada's Gaming Control Board and Commission), a lottery in the lottery-model states, and, for tribal gaming, the tribe's own gaming commission under a Tribal-State compact, with federal oversight from the National Indian Gaming Commission. These bodies descend from the land-based casino regulators of Nevada and New Jersey, and they brought the land-based tradition with them: exhaustive suitability investigation, licensing of individuals and vendors as well as operators, in-person hearings, and a presumption that gambling is a privilege the state grants rather than a service the market provides. Michigan's rules put it plainly: a licence is a revocable privilege, and the applicant carries the burden of proving its suitability by clear and convincing evidence.
That tradition produces a licensing process unlike Europe's. An applicant for an operator licence in a large state files a petition running to hundreds of pages, discloses its ownership to a low threshold, submits its officers and key employees to background investigation by the regulator's investigators, pays the investigation's costs, and waits, often for many months, for a decision, which in the commission states is taken at a public meeting. Temporary or provisional licences let operators launch while the investigation continues in many states, which is how the fast launches after 2018 were possible; the full licence follows, sometimes much later. DraftKings began taking bets in Massachusetts on a temporary licence in March 2023 and was granted its full five-year licence in July 2025.
Who is licensed
Operators hold the primary licence (called variously an interactive gaming certificate, a mobile wagering licence, a sports wagering operator licence) tethered, in many states, to a land-based licensee that holds the underlying gaming licence. In Michigan, for example, only a state casino licensee or a tribe that runs a casino in the state may hold an internet gaming operator licence, and New Jersey's online casinos operate through Atlantic City casino licensees.
Key employees and principals: officers, directors, owners above a threshold (Michigan requires notice, and a suitability determination, for anyone acquiring more than 5 per cent of an operator, with an exemption for institutional investors; Nevada requires a finding of suitability above 10 per cent of a registered public company, with waivers for passive institutional investors up to 25 per cent), and employees in specified functions (compliance, finance, security, trading, technology) hold individual licences or registrations after their own investigations. A finding of unsuitability against an individual can block a company's licence.
Vendors and suppliers: platform providers, game studios, aggregators, geolocation and identity vendors, payment processors and, in many states, affiliates and marketing partners must be licensed or registered, with the tier depending on how close to the gambling transaction they sit. Game and platform suppliers typically need a full supplier licence; marketing affiliates need a vendor registration or an affiliate licence depending on the state and on whether they are paid by revenue share. Michigan's rules, for instance, require a supplier licence of platform providers, geofence providers and affiliates paid a share of customer revenue. The Affiliate Compliance course covers the affiliate tiers state by state.
Testing laboratories are approved by each state to certify games and platforms against the state's technical standards.
Suitability
The suitability standard is the heart of American licensing. An applicant must demonstrate good character, honesty and integrity, along with the financial resources and business record the state requires, and the regulator investigates whether it does: criminal history, litigation, regulatory history in other jurisdictions, tax compliance, the source of the funds invested in the business, associations with unsuitable persons, and, the question that decides many applications, whether the applicant or its affiliates have offered gambling to Americans without a licence. Operators with grey-market histories have been kept out, conditioned, or required to part with the people involved. New Jersey put PokerStars' application into suspended status for two years in 2013, citing the unresolved federal indictment of its founder and its executives' involvement in American online gambling after the Unlawful Internet Gambling Enforcement Act; when it cleared Amaya in 2015 to bring the brand into the state, it relied on the complete separation of the Scheinberg family's ownership, required four employees to leave and barred ten named individuals from any role, after an investigation that reviewed more than 45,000 pages of documents and took 71 sworn interviews. An unlicensed American history remains the most serious obstacle a foreign operator can bring to an application.
Suitability recurs at every change of control (the approvals and closing lesson of the iGaming M&A course and the glossary's change-of-control entry cover the mechanics), and the regulator's continuing jurisdiction means an operator can be called back before the commission for anything that arises.
Operating requirements
Once licensed, an operator runs under a body of regulations and technical standards that is long and specific.
Geolocation. A customer's location must be confirmed within the state's borders using an approved geolocation provider, at log-in and at intervals after that: New Jersey's rules require a location check when the customer logs in and as often as the operator's approved submission specifies, with no wagers accepted while the customer is in an unauthorised area. Failures are enforcement matters.
Identity and age. Full identity verification before play (name, address, date of birth and, commonly, all or part of the social security number, checked against documents or third-party databases), with age 21 for online casino and for sports betting in most states. A few states have allowed sports betting from 18, but Kentucky, which did, raised its minimum to 21 from 15 July 2026. Accounts are screened against the state's self-exclusion and exclusion lists and other prohibited bettors: New Jersey's rules require the system to verify that the customer is 21, not self-excluded, not on the exclusion list and not otherwise prohibited.
Player funds. Segregated or reserved to cover balances, with regulator-specified reserve calculations and reporting. New Jersey requires a separate New Jersey bank account holding at least the total of customer balances, funds in play and pending withdrawals, with a monthly attestation to the regulator.
Technical standards. Certified platforms and games, in-state or approved server locations, change-control notifications, audit logging, security standards, and periodic system audits.
Responsible gambling. Deposit, wager, time and loss limits available to customers; cooling-off and self-exclusion; responsible-gambling messaging and help-line display; a compliance plan; staff training; and in the stricter states, requirements to identify and interact with at-risk customers. New Jersey requires daily, weekly and monthly deposit and spend limits and a daily time limit to be offered.
Advertising. State rules plus the American Gaming Association's Responsible Marketing Code for Sports Wagering: no messages aimed primarily at under-21s, no advertising on college campuses, no "risk free" language, a responsible-gambling message with a helpline, and an opt-out in every marketing email or text. State rules add their own limits, such as New Jersey's ban on sending gaming-related email to a customer whose account is suspended. Ohio bars describing a promotion as "free" when the customer must risk their own money, and in 2023 DraftKings paid $500,000 to settle Ohio cases over mailers sent to about 2,582 people under 21, advertising without clear problem-gambling messages, and "free" bet promotions.
Anti-money-laundering. Under the Bank Secrecy Act regulations, a casino licensed under state or tribal law with gross annual gaming revenue above $1 million is a financial institution, and that covers the licensed casinos through which online casinos operate. Such a casino must report cash in or out of more than $10,000 in a gaming day, file suspicious activity reports on suspicious transactions of $5,000 or more, and maintain a written compliance programme, with reports going to FinCEN, and apply customer due diligence. How far the federal regime reaches stand-alone sportsbooks is a matter of interpretation, and state rules add their own requirements: New Jersey's systems must detect and report suspected money laundering. The federal anti-money-laundering obligations sit alongside the state licence and are enforced by federal authorities.
Reporting. Monthly revenue and tax reporting, published by the regulator; incident and key-event reporting; and annual compliance certifications.
Tax and fees
The operator's tax stack in a state has four layers. The state's gaming tax on gross gaming revenue, at the rates lesson two and lesson three describe, with promotional deductions where permitted. The federal excise tax on sports wagers (0.25 per cent of the amount of each wager authorised under the law of the state where it is accepted). Licence, renewal and regulatory-cost fees. And state and federal corporate income tax on the business's profits. Together, in a high-tax state, they can take more than half of gross revenue before operating costs: in New York the state tax alone is 51 per cent of online sports betting revenue.
The customer's tax is separate: winnings are federal (and usually state) income, operators must report winnings at or above thresholds on Form W-2G (the minimum reporting threshold for payments made in 2026 is 2,000 dollars, indexed for inflation after that) and withhold 24 per cent where the winnings, net of the stake, exceed 5,000 dollars and are at least 300 times the wager, as on a large sports wagering win; and from tax year 2026 customers may deduct only 90 per cent of their wagering losses, and only against winnings. The Tax on Gambling Winnings by Country guide covers the customer side; for the operator, the reporting and withholding obligations are a compliance function of their own.
Enforcement
American enforcement is public and specific. Regulators publish complaints, consent orders and fines, with amounts running into the hundreds of thousands of dollars: Ohio's advertising settlement with DraftKings was $500,000, and in 2025 Massachusetts fined DraftKings $450,000 for accepting credit card funds, which WBUR reported as by far the largest sports betting fine the state had imposed, and ordered corrective action plans and an independent audit; individual licensees are named; and repeat failures bring conditions on the licence. The tone differs by state: New Jersey and Pennsylvania are formal and frequent; Michigan and Massachusetts have become active; Nevada, whose Gaming Control Board was created in 1955, is the model of regulator authority. Regulators also look at conduct in other jurisdictions: New Jersey's PokerStars investigation included meetings with regulators in Canada, the Isle of Man and Alderney, so a settlement in one state is likely to be read in the others.
What to take from this lesson
State regulators license operators, individuals and vendors after investigations in the land-based tradition, with suitability (including any history of unlicensed American operation) the decisive test. Operating rules are prescriptive: geolocation, full identity verification, player-fund reserves, certified technology, responsible-gambling tools, advertising codes and Bank Secrecy Act anti-money-laundering obligations. Tax stacks state gaming tax, federal excise, fees and income tax, and operators report and withhold on customer winnings. Enforcement is public, state by state, and cross-referenced.