How to get a license for your own casino

1) Where to start: Strategy and model

Please answer four questions before applying:

1. Product perimeter: casino/slots, live casino, bets, lotteries, tournaments, crypto payments.

2. Wallet model: custodial (hold player funds) or non-custodial/via provider. This determines the requirements for capital, technical base and VASP responsibilities when working with virtual assets.

3. Geography: in which countries do you want to legally accept players and where will you advertise/accept payments.

4. Platform architecture: proprietary vs. white-label/turn-key platform, external game providers, and KYC/AML.

2) Choosing a jurisdiction: what to look at

Rate jurisdictions by matrix:

Products that are licensed (slots/live/bets/crypto reception).
Required capital and fees (application + annual fee, audit, supervision).
Speed and predictability of the process (SLA regulator, question/interview practice).
License reputation (traffic conversion, PSP/bank openness, content partners).
Tax burden (GGR/profit/VAT, deductions).
Presence of a VASP mode for crypto and onchain screening requirements.
Language/localization (whether notarization, apostille, sworn translation is necessary).

💡 Tips: start with a jurisdiction where your actual market and payment rails are achievable; avoid "paper" licenses without payments/partners.

3) What the regulator checks

3. 1 Company and owners

Transparent ownership structure (beneficiaries, chain of companies).

Fit & Proper directors and key persons: no convictions/sanctions, experience in the gambling/financial sector.

Source of funds (SoW) and capitalization: confirmation of the origin of funds, minimum authorized/operating capital.

3. 2 Platform and suppliers

Platform and RNG certification by an independent laboratory; logging and retention.

Game content - contracts with studios, RTP/volatility, judicial settings.

Hosting/infrastructure: availability, redundancy, monitoring, privilege control, penetration test.

3. 3 Compliance and player protection

KYC/AML/sanction screening (including PEP and adverse media), Travel Rule where required.

Responsible Gambling (RG): deposit/loss/time limits, timeouts, self-exclusion, behavioral monitoring, VIP policy.

Complaints and ADR/Ombudsman, SLA responses, public policies.

Data and privacy: DPIA, encryption, retention periods, incident plan (72 hours for notifications - if applicable).

3. 4 Marketing and geo-blocking

Advertising and affiliates: age and geo-targeting, prohibition of "risk-free/easy money," control of creatives and partners.

Geocontrol: IP/GPS/ASN filters, block of prohibited jurisdictions, VPN rules.

4) Package of documents (main list)

Constituent documents, charter, extracts from the register, ownership diagram.

Fit & Proper questionnaires (directors/beneficiaries): passports, certificates of no convictions, CV, recommendations.

Policies and procedures: KYC/AML/sanctions, RG, complaints/ADR, information security, data retention, incidents, marketing/affiliates.

BWRA (Business Broad Risk Assessment) and risk matrices by product/country/channel.

Agreements and SLAs with providers: platforms, games, PSP/crypto processing, CCM/online analytics, hosting.

Platform/RNG/Gaming Lab Certifications (or Scheduled Certification Letters, if applicable).

Financial plan (12-24 months), player funds segregation policy, bank/custodial agreements.

Advertising and responsible marketing policy, warning layouts/18 +.

5) Timeline and milestones (typical roadmap)

1. Prescoping (2-6 weeks): choice of jurisdiction, GAP analysis of requirements vs. your model, certification plan.

2. Package preparation (4-12 weeks): collection of certificates, finalization of policies, contracts with providers, tech dossiers.

3. Submission of an application → Q&A (8-20 weeks): responses to the regulator, interviews of key persons, document adjustments.

4. Conditional approval → technical audit (2-6 weeks): verification of the environment, logs, integrations.

5. License issuance → go-live: domain registration, payment connection, commercial launch.

💡 Ranges are approximate and depend on jurisdiction, package completeness, and platform availability.

6) Budget (benchmarks)

One-time costs: state fee for the application, legalization/transfers, laboratory certification, consulting/lawyers.

Annual: license fee, supervisory payments, audits, renewal of certificates, KYC/AML/onچeyn providers, ombudsman/ADR.

Operating: hosting/CDN, monitoring/log management, anti-fraud, case-management, personnel training.

💡 Plan a 6-12 month OPEX cushion before going cash flow neutral.

7) Technical and compliance circuits (minimum)

KYC/AML stack: document verification, liveness/biometrics, sanctions/PEP/AML, online screening (for crypto), confirmation of the owner of the payment method.

RG tools: limits, timeouts, self-exclusion, reality check, behavioral alerts, case management, integration with CRM/marketing filters.

Logging and retention: WORM logs, player/session/transaction search, export "for inspection."

Security: RBAC/MFA, media separation, transit/rest encryption, pentest/bugbounty, DR/BCP.

Marketing compliance: warning templates, white lists of creatives, exceptions to self-exclusions.

8) White-label, turn-key or "build it yourself"?

White-label: quick and cheaper start, but limited jurisdiction/content/payments, lower margin, dependence on license provider.

Turn-key (native license + plug-ins): balance of speed and control.

In-house platform: maximum control/cost, long-term certification, higher state requirements (DevOps, Sec, RG/AML, Data).

9) Frequent errors of applicants

"First marketing and traffic - then license." Platforms/banks/advertising block this; risks of fines and bans.

Underestimation of RG/AML. Politicians "on paper" without real tools and logs.

No RNG/game certification or incomplete tech package (architecture, logs, access rights).

Weak geoblocking and affiliates: traffic from prohibited countries, "risk-free" creatives.

Lack of segregation of players' funds, unclear payment agreements.

Applicants without specialized experience in key positions, failure of the "fit & proper" interview.

10) Preparation checklists

10. 1 Box of documents

Constituent and beneficiaries disclosed, apostille/translations ready.
Fit & Proper questionnaires, non-conviction certificates, resumes.
Policies: KYC/AML/sanctions, RG, complaints/ADR, safety, retention, marketing/affiliates.
BWRA/risk matrices.
Contracts: content, PSP/crypto processing, CCM/onchain, hosting, ombudsman.
Finplan, regulations for segregation of player funds.

10. 2 Technique and processes

Platform/RNG/Game Certification started or completed.
WORM logs, RG/AML deshboards, case manager.
SSO/RBAC/MFA, pentest, DR/BCP.
Geo-blocking, VPN/ASN control, marketing filters 18 +/responsible game.
Complaint SLA and ADR procedures, ready-made response templates.

11) 90/180 Day Roadmap

0-30 days - strategy and GAP:

Choice of jurisdiction, product perimeter, wallet model.
GAP analysis of requirements, certification plan, selection of providers (KYC/AML/PSP/content).

30-90 days - package and infrastructure:

Policies/procedures, contracts, financial plan, tech dossiers.
Audit stand, WORM logs, RG/AML in sales, geoblock.
Submission of an application, responses to RFI from the regulator.

90-180 days - certification and audit:

Completion of RNG/game certificates, correction of comments.
Test calculations of RTP/payments, ombudsman/ADR, personnel training.
Pre-interview fit & proper, final audit and go-live.

12) Mini-FAQ

Do I need a VASP license if we accept crypto?

Depends on jurisdiction and model (custom/exchange). Often - yes. Lay the onchain screening and Travel Rule.

Is it possible to start with a white-label, and then switch to your own license?

Yes I did. Plan for data migration, recertification, and player/provider communications.

How much to keep KYC data?

Usually 5-7 years for financial requirements; exact terms - according to local law and retention policies.

Is it necessary to certify "provably fair" if there is an RNG certificate?

"Provably fair" builds credibility but does not replace mandatory RNG/game certification where required.

When can I receive traffic?

Only after obtaining a license/permit and passing a technical audit, with geoblocking and RG/AML enabled.

13) Disclaimer

The material is general and not legal advice. Before submitting documents, consult the laws of the chosen jurisdiction and work with a specialized lawyer/consultant.

Online casino licensing is not "one document," but a system: transparent owners and capital, a certified platform and content operating KYC/AML/RG, data protection and understandable marketing/payout rules. Choose jurisdiction for your business model, prepare provable processes and logs, use "compliance-by-design" - and you will receive a license, payment partners and player trust, which is converted into sustainable growth.