The regulator and the licence
Every American online gambling licence is granted by a state regulator: a gaming commission or control board in most commercial states (New Jersey's Division of Gaming Enforcement and Casino Control Commission, Pennsylvania's Gaming Control Board, Michigan's Gaming Control Board, Nevada's Gaming Control Board and Commission), a lottery in the lottery-model states, and, for tribal gaming, the tribe's own gaming commission under the compact with federal oversight. These bodies descend from the land-based casino regulators of Nevada and New Jersey, and they brought the land-based tradition with them: exhaustive suitability investigation, licensing of individuals and vendors as well as operators, in-person hearings, and a presumption that gambling is a privilege the state grants rather than a service the market provides.
That tradition produces a licensing process unlike Europe's. An applicant for an operator licence in a large state files a petition running to hundreds of pages, discloses its ownership to a low threshold, submits its officers and key employees to background investigation by the regulator's investigators (often drawn from state police), pays the investigation's costs, and waits, commonly six to eighteen months, for a public hearing and a vote. Temporary or provisional licences let operators launch while the investigation continues in many states, which is how the fast launches after 2018 were possible; the full licence follows.
Who is licensed
Operators hold the primary licence (called variously an interactive gaming certificate, a mobile wagering licence, a sports wagering operator licence) tethered, in most states, to a land-based licensee that holds the underlying gaming licence.
Key employees and principals: officers, directors, owners above a threshold (commonly 5 per cent, with institutional investors exempted above that under conditions), and employees in specified functions (compliance, finance, security, trading, technology) hold individual licences or registrations after their own investigations. A finding of unsuitability against an individual can block a company's licence.
Vendors and suppliers: platform providers, game studios, aggregators, geolocation and identity vendors, payment processors and, in most states, affiliates and marketing partners must be licensed or registered, with the tier depending on how close to the gambling transaction they sit. Game and platform suppliers typically need a full supplier licence; marketing affiliates need a vendor registration or an affiliate licence depending on the state and on whether they are paid by revenue share. The Affiliate Compliance course covers the affiliate tiers state by state.
Testing laboratories are approved by each state to certify games and platforms against the state's technical standards.
Suitability
The suitability standard is the heart of American licensing. An applicant must demonstrate good character, honesty and integrity, financial stability and responsibility, and business competence, and the regulator investigates whether it does: criminal history, litigation, regulatory history in other jurisdictions, tax compliance, the source of the funds invested in the business, associations with unsuitable persons, and, the question that decides many applications, whether the applicant or its affiliates have offered gambling to Americans without a licence. Operators with grey-market histories elsewhere have been refused, conditioned, or required to divest; the New Jersey and Pennsylvania regulators' findings on this point have been the reference for other states, and an unlicensed American history remains the most serious obstacle a foreign operator can bring to an application.
Suitability recurs at every change of control (lesson one of the Affiliate Compliance course and the glossary's change-of-control entry cover the mechanics), and the regulator's continuing jurisdiction means an operator can be called back before the commission for anything that arises.
Operating requirements
Once licensed, an operator runs under a body of regulations and technical standards that is long and specific.
Geolocation. Every session and, under most rules, every wager must be confirmed to originate within the state's borders using an approved geolocation provider, with prohibited-zone handling for tribal lands and state lines. Failures are enforcement matters.
Identity and age. Full identity verification before play (name, address, date of birth, social security number match), with age 21 for casino and most sports betting (18 in a few states), and screening against the state's self-exclusion list and against exclusion lists for athletes, officials and other prohibited bettors.
Player funds. Segregated or reserved to cover balances, with regulator-specified reserve calculations and reporting.
Technical standards. Certified platforms and games, in-state or approved server locations, change-control notifications, audit logging, security standards, and periodic system audits.
Responsible gambling. Deposit, wager, time and loss limits available to customers; cooling-off and self-exclusion; responsible-gambling messaging and help-line display; a compliance plan; staff training; and in the stricter states, requirements to identify and interact with at-risk customers.
Advertising. State rules plus the industry association's responsible marketing code: no targeting of under-21s or college campuses, no "risk-free" or "free" where conditions apply, terms with every offer, opt-out for direct marketing, and, in several states, prohibitions on marketing to self-excluded or restricted customers. Enforcement actions for advertising breaches have multiplied since 2023.
Anti-money-laundering. Casinos, including online casinos, are financial institutions under the Bank Secrecy Act and must file currency transaction reports and suspicious activity reports with FinCEN, maintain an anti-money-laundering programme and apply customer due diligence; sportsbooks are covered by the same regime in most readings and by state rules in all. The federal anti-money-laundering obligations sit alongside the state licence and are enforced by federal authorities.
Reporting. Monthly revenue and tax reporting, published by the regulator; incident and key-event reporting; and annual compliance certifications.
Tax and fees
The operator's tax stack in a state has four layers. The state's gaming tax on gross gaming revenue, at the rates lesson two and lesson three describe, with promotional deductions where permitted. The federal excise tax on sports wagers (0.25 per cent of handle on legal bets). Licence, renewal and regulatory-cost fees. And state and federal corporate income tax on the business's profits. Together, in a high-tax state, they can take more than half of gross revenue before operating costs.
The customer's tax is separate: winnings are federal (and usually state) income, operators must report winnings above thresholds on Form W-2G and withhold 24 per cent above 5,000 dollars in specified cases, and from tax year 2026 customers may deduct only 90 per cent of losses against winnings. The Tax on Gambling Winnings by Country guide covers the customer side; for the operator, the reporting and withholding obligations are a compliance function of their own.
Enforcement
American enforcement is public and specific. Regulators publish complaints, consent orders and fines, with amounts from tens of thousands of dollars for advertising breaches to millions for geolocation, KYC, self-exclusion and reporting failures; individual licensees are named; and repeat failures bring conditions on the licence. The tone differs by state: New Jersey and Pennsylvania are formal and frequent; Michigan and Massachusetts have become active; Nevada, with a century of practice, is the model of regulator authority. An enforcement history in one state is disclosed in every other, so a settlement in New Jersey is read in Michigan.
What to take from this lesson
State regulators license operators, individuals and vendors after investigations in the land-based tradition, with suitability (including any history of unlicensed American operation) the decisive test. Operating rules are prescriptive: geolocation, full identity verification, player-fund reserves, certified technology, responsible-gambling tools, advertising codes and Bank Secrecy Act anti-money-laundering obligations. Tax stacks state gaming tax, federal excise, fees and income tax, and operators report and withhold on customer winnings. Enforcement is public, state by state, and cross-referenced.