Where is iGaming legal?

Legality is a map, not a switch

There is no single answer to "is iGaming legal" — it depends entirely on the market and the licence. This overview is a starting point; always confirm with local counsel and our regulations guide.

Europe

The most mature region — the UK (UKGC) and Malta (MGA) lead, with most EU states running national licensing.

North America

The US is regulated state by state; Ontario leads Canada and is North America’s fastest-maturing market.

LATAM, Africa & Asia

LATAM is opening fast (notably Brazil). Parts of Africa are regulated; much of Asia and MENA restricts or prohibits online gambling.

Four states a market can be in

One caveat first, and we mean it: this is engineering guidance, not legal advice. We build platforms to regulators' technical standards. We do not advise on the law, and any market's status can change with one bill or one court ruling. Confirm the current position with local gambling counsel before you enter a market, spend on it, or point a single advert at it. What follows is a way to reason that stays true when the map changes.

Operators tend to sort countries into legal and illegal. That model is wrong in the direction that costs money. There are four states, and the two in the middle are where launches die.

Licensed and regulated: a regulator publishes a technical standard and will accept your application. The price is a licence, a compliance build and permanent reporting. It is the only state where you can plan a business, because it is the only one where the rules are written down and someone is accountable for them. Our licensing guide covers what applying involves.

Monopoly or state-operated: gambling is legal, but only the state or an exclusive right-holder may offer it. There is no application to submit; budget does not help. Norway is the clearest example — as of the Norwegian regulator's published position in 2026, Norsk Tipping and Norsk Rikstoto hold the exclusive right to offer online gambling, and commercial licences are not generally available to private operators. Lotteritilsynet gained DNS-blocking powers in January 2025 and began ordering ISPs to block unlicensed sites that March. Whether the monopoly survives is a live political question there — which is precisely why you check the position yourself rather than trusting this page. A monopoly is not a hard market. It is a closed one.

Prohibited: offering to residents is unlawful. Your obligation is to keep those players out and prove you did — an engineering problem, not a policy statement.

Unregulated or grey: no framework exists. Nothing permits you and nothing forbids you. This is the dangerous one, because it looks like the opportunity.

Grey is a trap that looks like an opportunity

A grey market has traffic, no licence fee and no compliance build. That is the pitch. Here is the bill.

Banking and payments

Banks and payment providers do not underwrite you on "not illegal". They underwrite you on licence status, and gambling is a flagged category before anyone reads your name. No licence means no tier-1 acquiring: worse rates, rolling reserves, longer settlement and a termination clause someone can pull on a Tuesday. And a provider's risk appetite is not a term you control — a compliance review at their end and they exit the market. You did nothing; your deposits stop that afternoon. In a licensed market you hold redundant providers who all want the business. In a grey one you are down to the one or two who will touch it, so your redundancy is theoretical, and your cashier becomes the least reliable thing you own.

Advertising and affiliates

The major ad platforms gate gambling inventory on licence status, market by market. No licence, no paid channel — so grey acquisition runs on affiliates and SEO, channels you do not own. That creates the exposure operators underestimate: an affiliate spins up a landing page in a language and a market you never approved, because they are paid on volume and the downside is not theirs. To a regulator, that page is evidence you targeted their market — intent is inferred from artefacts like the marketing language, the domain, the currency and the local brand name.

The one that kills you: regulation is retroactive about you

When a grey market regulates, the new regime decides what to do about the operators already in it. Sometimes it grandfathers them. Often it does the opposite, because the incumbent industry and the treasury both prefer a clean slate.

The Netherlands is the worked example. When it opened its licensed online market in October 2021, the Dutch regulator — the Kansspelautoriteit — applied a cooling-off period: operators judged to have actively targeted Dutch players beforehand had to wait, ultimately up to 33 months from the infraction per the KSA's published position at the time, before a licence application would be accepted. The KSA confirmed the end of that general command in April 2022. It drew a line between actively targeting the market — Dutch-language marketing, .nl domains, local brand names — and passively accepting players who found you. Active targeting cost operators their place in the queue for the market they had spent years building.

Read the shape, not the rule. The years you spend building a grey player base can be the exact reason you are excluded from monetising it. "Not illegal" is not a licence — it is the absence of a decision, and when the decision arrives it is made about you, not with you. Some operators still run a grey market deliberately, as a time-boxed cash position, with no intention of ever holding that licence. That is a strategy. Running one by accident is not.

The player's location decides legality — not your server's

The old offshore model assumed the opposite: incorporate somewhere permissive, host the equipment there, and you were regulated by that place regardless of who played. Point-of-consumption regulation ended it.

Great Britain made the change explicit. Under the Gambling (Licensing and Advertising) Act 2014, in force from 1 November 2014, any operator transacting with British consumers needs a Gambling Commission licence wherever its equipment sits — and it is an offence to provide or advertise remote gambling without one where the operator knows or should know the facilities are likely to be used in Great Britain. Read that clause as an engineer: "should know" means the regulator will look at your logs. Our UK regulations guide covers what the UKGC standard asks of the software; Malta and Ontario each ask for something structurally different.

So where you incorporate and where you host are tax and latency decisions, not legality decisions. Legality is a function of where the player's finger is when it lands on the bet button.

IP alone is not geolocation

IP tells you where a packet came from, not where a person is. Databases go stale as ranges get reassigned. Carrier-grade NAT puts mobile players at their operator's egress, sometimes in the wrong country. Corporate VPNs relocate honest players to a head office; consumer VPNs relocate dishonest ones on purpose. Treating IP as authoritative buys both failure modes at once: you block players you are licensed to serve, and you accept players you are not.

Corroborate, then score

No single signal is trustworthy, so combine them and score the combination:

• Network: the IP, plus the ASN behind it. A hosting range, a known proxy or a Tor exit is not somewhere a person lives.
• Device: system timezone and locale against the claimed country; GPS where the licence requires it.
• Money: the issuing country of the card or bank account. Payment instruments are hard to relocate — the strongest cheap signal you have, and the one most platforms ignore.
• Identity: the address of record from KYC and AML checks, and whether every session contradicts it.

Set the threshold per market by risk, not convenience. And do not expect to beat VPNs outright — proxy lists work, decay and get refreshed forever. Run them, but put your confidence in corroboration: a player who verified with a bank account in a prohibited market is the signal, and the VPN is noise on top. Chase the contradiction between signals, not the tunnel.

Block at the wallet, not at the CDN

Blocking at the edge feels right — fast, cheap, keeps traffic off your origin. But it is a marketing-site control: it blocks the page, not the money. A session that starts in a permitted country and crosses a border, or has a VPN switched on mid-session, never touches the edge again. Native apps and API clients do not route through your web CDN. Cached pages and service workers serve your front end from local storage on a device that is now somewhere else. And a CDN block returns a page, where a wallet block returns a refused bet — only one of those is a compliance record.

So every deposit, bet and withdrawal re-evaluates jurisdiction server-side, at the moment of the transaction, and writes the decision plus its signals to an append-only log. When a regulator asks how you know you were not taking bets from their residents, that log is the answer; a policy document is not. And fail closed: if the geolocation service is unreachable, the bet is refused. An operator that fails open during an outage has taken unlicensed bets — which is why this belongs in the infrastructure design from day one, not in a ticket after certification.

Pick the regulator first, then build, then expand

Most doomed market-entry plans start with "build the platform, then get licensed". That reverses the dependency. A licence is not a certificate you bolt on at the end. It is a set of structural requirements that reach into your data model — and the divergence between markets is architectural, not cosmetic:

• Where player data may physically live, and whether the regulator wants a feed out of your systems into theirs.
• Whether self-exclusion is per-operator or national. A national register means your registration and login paths call an external service before a player can bet, and stay in sync with it. That is not a feature flag. It is somebody else's uptime inside your critical path.
• Which certification lab and which certificates the regulator accepts, and whether a certificate earned elsewhere carries over. Often it does not.
• What must be immutable, retained and producible on audit — and whether your bonus mechanics, affiliate arrangements and reality checks are permitted at all in the form you built them.

Each is a decision about your schema, your service boundaries and your critical path. Retrofitting them is a rebuild of the parts you built first, under certification deadline pressure — the worst condition in which to rebuild anything. So choose the regulator before the architecture, and build to the strictest one you intend to hold. Relaxing a control is cheap; adding one late is not. A platform built to a tier-1 standard serves a lighter market by turning things off. A platform built to a light standard cannot serve a tier-1 market by turning things on — the audit trail it never wrote does not appear retroactively.

Market two is the real test

The second market tells you whether your platform is genuinely multi-jurisdiction or merely configurable. The test is concrete: can you run two markets with different self-exclusion registers, reporting feeds, game certificates and responsible-gambling rules from one codebase, without forking it? If the answer is a fork, you have two platforms, two teams and two certification cycles, permanently. Design for it on day one and it is a jurisdiction abstraction, resolved per market at runtime rather than compiled in. Discover it at market two and it is a migration. This is what a multi-brand, multi-jurisdiction core is for.

Honestly, white-label is faster into a first market, and if one market is all you need that is a real advantage. The trade shows up at market two: a white-label platform hands you the supplier's jurisdiction list, not yours — when you want a market they have not certified for, you wait on their roadmap or you do not go. You also pay revenue share on every market you do reach, a tax that scales with your success rather than your costs. Owning the platform makes market entry your decision, and we set out that trade-off in custom development versus white-label.

None of this replaces counsel. Confirm any market's current status with a local gambling lawyer before committing budget — then bring us the regulator, and we will build to their standard. Start with the regulations overview if you are still mapping the field.