The public conversation about gaming licences is almost entirely about jurisdictions and fees. That framing is misleading, because it implies the decision is a shopping exercise and the outcome is a matter of paperwork. In practice, applications are refused, deferred, or dragged out for months over issues that have nothing to do with which regulator was chosen.
What determines approval is whether the applicant can demonstrate three things to the regulator's satisfaction: that the people behind the business are fit to hold a licence, that the money funding it is clean and traceable, and that the operation has the structures in place to run compliantly from day one rather than promising to build them later.
This guide covers what regulators actually assess, in the order they assess it, and where applications most commonly stall.
The Corporate Structure Comes First, Not Last
A licence is issued to a legal entity, and the shape of that entity is the first thing under review. Applicants frequently arrive having already incorporated somewhere convenient, only to discover the structure does not satisfy the regulator they intend to apply to.
The recurring issues are jurisdictional mismatch, where the operating entity is incorporated somewhere the regulator will not licence or will only licence with additional conditions; opaque ownership chains, where the applicant sits beneath two or three holding layers that obscure who ultimately controls the business; and nominee arrangements, which most regulators now treat as an obstacle to be unwound rather than a legitimate privacy measure.
Substance requirements also matter more than they did five years ago. Several jurisdictions now expect evidence of genuine local presence - directors who are actually resident, decision-making that demonstrably occurs in the jurisdiction, and operational functions that are not entirely outsourced offshore. An entity that exists only as a registered address and a mailbox increasingly fails this test.
The practical implication is that structuring should be designed around the target licence, not repaired afterwards. Restructuring mid-application is the single most common cause of a six-week process becoming a six-month one.
Beneficial Ownership and Personal Probity
Every credible regulator conducts fitness and propriety assessment on ultimate beneficial owners, directors, and in most cases anyone holding above a defined shareholding threshold. This is a personal review, not a corporate one, and it is where applications most often encounter difficulty that the applicant did not anticipate.
The assessment typically covers criminal record disclosure across every jurisdiction of residence, previous regulatory history including any licence refused, suspended or revoked anywhere in the world, insolvency and bankruptcy history, civil litigation of a nature relevant to honesty or financial probity, and adverse media screening.
The critical point is that a difficult history is frequently survivable but a concealed one rarely is. Regulators run their own checks and will find what is not disclosed. A prior regulatory issue that is disclosed proactively, with context and evidence of resolution, is a manageable conversation. The same issue discovered independently after a declaration that no such history exists ends the application and follows the individual to every subsequent one.
This mirrors the dynamic on the transaction side, where undisclosed regulatory history is one of the most reliable deal-killers, as covered in our guide to compliance preparation before a sale. Regulators and acquirers apply the same logic for the same reason.
Source of Funds and Source of Wealth
Regulators require evidence of where the capital funding the operation came from, and the standard is higher than most first-time applicants expect. The two concepts are distinct and both are assessed. Source of funds is the origin of the specific money being deployed into the business. Source of wealth is how the applicant accumulated their overall net worth.
Documentary evidence is expected rather than explanation. Acceptable evidence typically includes audited accounts of prior businesses, completion statements from a previous sale, employment and remuneration records, investment account statements showing a traceable history, and tax filings corroborating the picture.
Where the capital originates in cryptocurrency, the evidential burden increases rather than disappears. Regulators will expect wallet address disclosure, on-chain transaction history, exchange account records showing the fiat entry point, and blockchain analytics screening of the relevant addresses. Capital that arrived through a mixer, a privacy protocol, or a chain of unattributable transfers is extremely difficult to evidence to a regulator's satisfaction, regardless of its actual legitimacy. Applicants with crypto-derived wealth should assemble this documentation before applying, not in response to a request.
The AML Framework Has to Be Operational, Not Aspirational
Every applicant submits an AML and counter-terrorist financing policy. What separates applications that clear review from those that generate rounds of follow-up questions is whether the framework describes something that will actually function.
Regulators assess whether the risk assessment is genuinely specific to the business - its markets, payment methods, and player profile - or generic language that could describe any operator. They look at whether customer due diligence thresholds are calibrated to that risk assessment rather than set at a convenient default. They examine whether the enhanced due diligence triggers are defined precisely enough to be applied consistently by staff. They check whether transaction monitoring rules are specified with actual parameters rather than described in principle.
Two elements receive particular scrutiny. The first is the money laundering reporting officer: this must be a named individual with appropriate seniority, demonstrable competence, and genuine authority to file reports without commercial override. A nominal appointment of someone who holds the title but neither the expertise nor the independence is identifiable and is treated as a material weakness.
The second, for crypto-accepting operators, is blockchain analytics. Regulators expect a named provider, defined screening thresholds, and a documented process for what happens when an address is flagged. Stating that crypto transactions will be monitored without specifying how satisfies nobody.
Technical and Platform Readiness
Licensing is not purely a documentary exercise. Most regimes require technical evidence before a licence issues or shortly after, and the lead times on this work are frequently underestimated.
The common requirements are random number generator certification from an accredited test house, game-level certification for proprietary titles, platform certification covering the wider system, and evidence that player account and transaction data is retained in a form the regulator can access. Where the operator has built its own games, this testing sits on the critical path and cannot be compressed by paying for it faster.
Player fund protection is assessed separately and is increasingly a hard requirement rather than a preference. Regulators want to see player balances segregated from operating capital, held in a way that survives operator insolvency, and reconciled on a defined cycle. For crypto operators this raises specific questions about hot and cold wallet architecture, custody arrangements, and how segregation is evidenced when balances are denominated in volatile assets.
Responsible Gambling Is No Longer a Formality
Responsible gambling provisions have moved from a policy annex to a substantive assessment area across every credible jurisdiction. Regulators expect deposit limits, session reminders, and self-exclusion to be functionally implemented rather than technically present, integration with any applicable cross-operator exclusion scheme, a documented process for identifying and intervening with players showing markers of harm, and staff training records evidencing that the process is understood by the people expected to apply it.
This is also a forward-looking commercial consideration. Responsible gambling failures are among the most frequent causes of enforcement action against licensed operators, and enforcement history follows a business into any subsequent transaction. Building the framework properly at application stage is materially cheaper than remediating it under regulatory pressure later.
Banking and Payments: The Step After the Licence
A common and expensive misconception is that securing a licence resolves the payments question. It does not. The licence is a precondition for opening acquiring and banking relationships, not a guarantee of them.
Payment providers and banks conduct their own due diligence, and their risk appetite is shaped by the licence jurisdiction, the markets served, the payment methods offered, and the ownership structure. An operator that secures a licence without having scoped its payment relationships in parallel can find itself licensed and unable to process.
The correct sequencing runs payment provider conversations alongside the licence application rather than after it, so that the structure being licensed is one that providers will actually support.
Choosing a Jurisdiction on Fit Rather Than Reputation
The right jurisdiction is determined by where the operator intends to accept players, what payment infrastructure it needs, what its product mix is, and what compliance capability it can realistically sustain. A tier-one licence carries genuine advantages in market access, banking, provider relationships and, in due course, exit valuation, as discussed in our crypto investor guide to iGaming. It also carries ongoing obligations that require real compliance resourcing.
An operator that selects a demanding regime without the capacity to maintain it is worse positioned than one that selects a proportionate regime and operates it well. Regulatory difficulty is not a badge of quality if it produces a compliance record that will not survive scrutiny.
Jurisdictional conditions also shift. The ongoing reform of the Curaçao framework, covered in our iGaming M&A market outlook for 2026, has changed the application requirements and the ongoing obligations materially. Advice based on how a jurisdiction operated two years ago is a liability rather than a shortcut.
Sequencing and Realistic Preparation
The applications that proceed cleanly are the ones where preparation happened before submission rather than in response to regulator queries. In practical order: settle the corporate structure against the target regime, assemble the full personal disclosure and source of wealth documentation for every UBO and director, build the AML framework around a genuine risk assessment and appoint a credible MLRO, initiate technical certification early because it is usually the longest lead item, design player fund segregation and document how it is evidenced, and open payment provider conversations in parallel.
Submitting before this work is done does not accelerate anything. It converts a structured preparation phase into a sequence of regulator queries answered under time pressure, which is slower and produces a weaker file.
Why the Licence Matters Beyond Day One
A licence is an operating permission, but it is also an asset with independent value. Licence quality and demonstrable transferability are among the strongest determinants of what an operator is ultimately worth, as set out in our guide to how to value an online casino business. A clean regulatory record built from the first application forward is what allows that value to be realised.
The corollary is that decisions made at application stage - the corporate structure, the disclosure approach, the quality of the compliance framework - are decisions about the eventual exit. Structures assembled for short-term convenience routinely become the obstacle that delays or reprices a transaction years later.
How IGABroker Supports Licensing
IGABroker advises operators through gaming licence applications across the jurisdictions we work in, from jurisdiction selection and corporate structuring through personal disclosure preparation, AML framework design, technical certification coordination, and regulator liaison to issue. We also handle change of control and licence transfer workstreams for operators acquiring or disposing of licensed businesses.
Because we work on both licensing and transactions, our advice is shaped by what happens to a structure later. The questions an acquirer asks in diligence are the questions we address at application stage.
Submit a confidential inquiry to discuss a licence application, a jurisdiction assessment, or a change of control. All engagements are handled under mutual NDA.