Gaming & casino licensing.
Curaçao. Malta. Costa Rica. UAE.
End-to-end legal counsel for online and physical gaming operators — jurisdiction selection, operator licensing, AML/CFT framework, payment processing, software-supplier agreements, player-protection, and crypto-casino structuring. Cross-border execution under one engagement.
Six gaming jurisdictions.
One coordinated engagement.
Each jurisdiction suits a different operator profile. Selection depends on target market, payment-processing strategy, cost sensitivity, brand positioning and the operator's tax-residency outcome. Neo Legal advises across the full set.
- Single GCB Master Licence (post-2024 reform)
- Broad activity coverage: casino, sportsbook, poker, bingo, lotteries
- Crypto-payment friendly
- No personal corporate tax on gaming-licensed entities (subject to substance)
- B2C and B2B (software/platform) classes
- EU-passportable for cross-border operations
- Recognised by banks and payment processors globally
- Robust player-protection and ADR framework
- No gaming-specific licence required
- Operator registered as standard corporate services entity
- Payment-processing relationships are the key practical constraint
- Player-protection framework is operator-defined (no statutory minimum)
- Crypto and fiat operator licence
- Compact regulatory regime
- Lower fees than Curaçao or Malta
- Growing recognition but still emerging
- Physical casino licensing (integrated resort model)
- Operator and class-licence frameworks emerging
- Online gaming directed at UAE residents remains restricted
- Pre-application engagement essential
- UK Gambling Commission — UK market essential
- Isle of Man — B2B and white-label specialists
- Gibraltar — legacy UK and EU dual-licensing
- Kahnawake — Canadian-First-Nations framework
Selecting the right
gaming jurisdiction.
A side-by-side framework comparing the three operator-licence options most commonly weighed by online casino sponsors. UAE GCGRA and specialist licences are tracked separately.
| Dimension | Curaçao (LOK) | Malta (MGA) | Costa Rica |
|---|---|---|---|
| Regulator | Curaçao Gaming Control Board | Malta Gaming Authority | None (data-services registration) |
| Licence type | Single Master Licence (post-2024 LOK) | B2C / B2B class licences | No gaming-specific licence |
| EU market access | Limited (case-by-case) | Full EU passporting | None |
| Crypto-payment friendly | Yes (explicit support) | Yes (regulated framework) | Operator-defined |
| Timeline to operate | 4-12 weeks | 6-9 months | 2-4 weeks |
| AML/CFT depth | Material (post-LOK reform) | Very high (EU AMLD) | Operator-defined |
| Player-protection | Defined framework | Comprehensive (ADR included) | Operator-defined |
| Tax on gaming entity | Effective 0% on gaming income (with substance) | 5% gaming tax + corporate income tax | 0% gaming tax (services company) |
| Best for | Early/mid-stage operators, crypto, broad activity | European market, institutional brand | Lean MVP, low-cost setup |
Indicative figures. Real engagement varies by operator profile, scale and integrations. Cross-jurisdiction structures (e.g. Curaçao operator + Malta secondary licence for EU access) are common.
Every workstream of an
online or physical casino operation.
Operator licensing.
End-to-end application across Curaçao, Malta, Costa Rica, Anjouan and adjacent jurisdictions. Pre-application diligence, regulatory business plan, fit-and-proper, capital arrangement, technical-systems testing (GLI / iTech Labs / eCOGRA), and post-licence integration.
AML/CFT & compliance framework.
Full AML/CFT policy suite per gaming-jurisdiction-specific FATF Recommendations 22-23. Customer due diligence, source of funds, transaction monitoring, suspicious-activity reporting, beneficial-owner identification. Crypto-casino wallet-screening and travel-rule integration.
Payment processing.
Acquirer agreement negotiation, PSP integration, chargeback management, KYC-at-deposit framework, source-of-funds at withdrawal threshold. Crypto on-ramp/off-ramp via VARA-licensed payment service providers where applicable.
Software-supplier agreements.
B2B supply agreements with platform providers (SoftSwiss, EveryMatrix, BetConstruct, Playtech) and game studios (Pragmatic Play, Evolution, NetEnt, Hacksaw, Push Gaming). Revenue-share, content licensing, RNG certification flow-through, technical-services SLAs.
Player protection & T&Cs.
Terms and Conditions, Privacy Policy, Responsible Gambling Policy, Bonus T&Cs, KYC/AML notices, withdrawal-policy disclosure, complaints framework, ADR/ODR integration, age-verification, self-exclusion mechanisms.
Cross-border structuring.
Operator entity in gaming jurisdiction; treasury/finance entity in DIFC / ADGM; payment-processing entity under VARA (where crypto in scope); IP-holding entity in tax-favourable jurisdiction. Coordinated under one engagement with Cornwalls Group for AU/UK-side and PRC-side counsel where needed.
Crypto-casino structuring.
Hybrid Curaçao gaming + DMCC VARA-licensed payment-processor structure. Wallet-screening framework (Chainalysis, TRM Labs, Elliptic integration). Stablecoin treasury arrangement. Tokenised loyalty programmes under VARA Category 1 framework where applicable.
Physical casino setup.
For UAE GCGRA-track and other physical casino projects: integrated-resort regulatory architecture, junket and high-roller protocols, cash-handling AML framework, surveillance-system regulatory specification, employee licensing, host responsibility framework.
The crypto-casino structural answer.
Crypto-casinos represent one of the fastest-growing operator categories globally — and one of the most structurally demanding. The framework requires simultaneous compliance with gaming regulator AML/CFT and virtual-asset regulator requirements.
The institutional architecture that works in 2026:
- Gaming-operator entity — Curaçao or Anjouan, holding the gaming licence. Performs the gaming activity, holds player accounts, makes payouts.
- Payment-processor entity — DMCC, VARA-licensed for relevant VA activity. Handles on-ramp/off-ramp, stablecoin custody, wallet-screening.
- Treasury entity — DIFC or ADGM, holding firm reserves and managing FX and stablecoin treasury.
- IP holding — jurisdiction-neutral, holding brand, software licences and content arrangements.
- Wallet-screening framework — Chainalysis / TRM Labs / Elliptic integrated at deposit, withdrawal and transfer.
- Travel-rule compliance — for crypto deposits and withdrawals above threshold, FATF Recommendation 16 information-sharing.
Neo Legal has structured this architecture for multiple top-tier crypto-casino operators globally. The Cornwalls Group connection provides AU-side and broader international counsel coordination where operator principals relocate or restructure across jurisdictions.
Questions operators actually ask.
Which jurisdiction is best for an online casino licence?
The answer depends on three factors: target markets, payment-processing strategy, and tax-residency. Curaçao is the fastest and most affordable for early-stage operators . Malta (MGA) is the institutional gold-standard for European-facing operators . Costa Rica is the leanest data-processing licence (no gaming-specific licence; operates as data-processing services company). Crypto-friendly operators increasingly use Anjouan or hybrid Curaçao + DMCC for VARA-coordinated activity.
How long does a Malta MGA licence take?
6-9 months from initial application is typical. The MGA process involves a robust fit-and-proper review, full business-plan submission, AML/CFT framework verification, technical systems testing, player-protection framework, and pre-launch on-site audit. The MGA is the European institutional gold standard; faster jurisdictions are available but with materially less prestige and market access.
Can you operate a casino in the UAE?
Physical casino licensing in the UAE is now formally available under the General Commercial Gaming Regulatory Authority (GCGRA), established by Federal Decree-Law No. 50 of 2023. The first land-based integrated resort casino is being developed in Ras Al Khaimah. Operator and class-licence frameworks are emerging; pre-application engagement is essential. UAE online gaming directed at UAE residents remains restricted.
What about crypto-casinos and Web3 gambling?
Crypto-casinos operate within the same gaming-licensing framework as traditional online casinos, with additional virtual-asset overlays. Common structures: Curaçao gaming licence held by an operating entity, combined with a UAE / DMCC structure for treasury and virtual-asset payment processing under VARA where applicable. The framework must satisfy both gaming regulator AML/CFT and virtual-asset regulator requirements simultaneously.
What is the GLI / iTech Labs certification requirement?
Most gaming jurisdictions require RNG (Random Number Generator) and game-fairness certification by an accredited test house — Gaming Laboratories International (GLI), iTech Labs, eCOGRA or BMM Testlabs are the major providers. Certification typically takes 4-8 weeks and costs K depending on game count and complexity. Some jurisdictions accept reciprocal certifications; others require local re-testing.
How is gaming-operator AML/CFT different from financial-services AML/CFT?
Gaming AML/CFT operates under FATF Recommendations 22-23 (Casinos) and equivalent jurisdictional rules. Key differences from financial services: extensive use of cash and chips in physical casinos, high-frequency low-value player wagers complicating monitoring, beneficial-owner identification for high-stake winners, source-of-funds checks at withdrawal thresholds, and integration with payment-processor SAR frameworks. Crypto-casinos add wallet-screening and travel-rule complexity.
Can I run a B2B software supplier business from one jurisdiction and B2C from another?
Yes — this is a common multi-entity structure. B2B (platform / software supplier) entities are often Malta-licensed (Class 4 B2B) for institutional credibility with operators; the operating B2C entity is separately licensed in Curaçao, Anjouan or other operator-jurisdiction. Cross-licensing between the entities is documented through SaaS / platform-supply / revenue-share agreements.
Build the gaming legal architecture.
Senior counsel only. Direct engagement with the partner who will run your matter. Neo Legal advises operators, software suppliers, payment processors and integrated-resort developers globally.
Engage Neo Legal →