How to Obtain a Gambling Licence: The Process Step by Step

Licensing processes vary in detail from regulator to regulator, but they share a common logic. A regulator needs to be satisfied about three things: who is behind the business, where its money comes from, and whether its systems and policies will protect players and the integrity of gambling. This article sets out the typical stages. It is a general explainer, not legal advice — applicants should work with specialist counsel in each jurisdiction.

Stage 1: Decide where — and why

Before any paperwork, an applicant must decide which market it is entering and under which model.

• Local (point-of-consumption) licence. Required to target players in a regulated country such as the UK, Sweden, Denmark, Germany, the Netherlands, Spain, Italy or Ontario. See the country profiles on the regulation hub.
• Hub licence. Malta, the Isle of Man, Gibraltar and Curaçao license operators that may serve several markets. A hub licence does not by itself authorise activity in countries that require local licences.
• Restricted-number markets. Some markets issue a fixed number of licences by tender or auction, such as Italy’s concessions or New Zealand’s online casino licences. Timing is dictated by the regulator, not the applicant.

The choice also determines cost and timeline; see licensing costs compared and the market entry checklist.

Stage 2: Corporate structure and ownership transparency

Regulators look through the corporate structure to the ultimate beneficial owners — typically anyone holding 10% or more, though thresholds vary. Expect to provide:

• a group structure chart down to individual owners;
• certified constitutional documents for each entity;
• details of all shareholders above the threshold, including trusts and nominee arrangements;
• evidence of any local company, registered office or local representative requirements.

Opaque structures, bearer shares or unexplained offshore layers slow applications sharply and can lead to refusal.

Stage 3: Fit-and-proper and source-of-funds checks

This is usually the longest stage. For each beneficial owner, director and key function holder, regulators commonly require:

• personal disclosure forms and identity documents;
• criminal record certificates from each country of residence;
• CVs demonstrating relevant competence;
• evidence of financial standing.

Source of funds and source of wealth for the capital invested must be documented — bank statements, sale contracts, audited accounts, tax returns. Regulators want to be satisfied that money is not the proceeds of crime and that the business is adequately capitalised. Some require minimum share capital or a bank guarantee: Germany, for example, requires a security deposit, and Spain requires guarantees per licence.

Stage 4: The business plan

A credible business plan usually covers:

• products to be offered and target markets;
• three-year financial projections and funding;
• marketing approach, including use of affiliates;
• organisational chart and staffing, especially compliance resources;
• outsourcing arrangements and key suppliers.

Regulators read the plan for realism. Aggressive projections paired with a thin compliance team are a warning sign.

Stage 5: Policies and procedures

Applicants submit a suite of policies, which the regulator may review line by line:

• AML and counter-terrorist financing policy, including a business-wide risk assessment (AML in gambling);
• KYC and age verification procedures;
• safer gambling policy: limits, reality checks, interaction, self-exclusion integration;
• complaints handling and alternative dispute resolution;
• protection of player funds;
• marketing and bonus terms;
• information security, data protection and business continuity.

These must reflect the target market’s rules, not a generic template. A Swedish application that ignores Spelpaus, or a Dutch one that ignores CRUKS, will not get far.

Stage 6: Technical systems and certification

In parallel, the technical workstream:

• Platform certification. An approved testing laboratory audits the gaming system against the regulator’s technical standards.
• Game certification. Each game (and each RTP variant) is tested and certified for the market.
• Integrations. Connections to national self-exclusion registers, central monitoring systems, tax reporting or data vaults. Germany’s LUGAS limit file and Italy’s central systems are examples.
• Geolocation and domain rules. Some markets require a local domain extension or strict geolocation.

Missing a certification is one of the most common causes of delay between licence approval and go-live.

Stage 7: Application review, questions and decision

The regulator reviews the file, issues questions, and may interview key personnel. Some charge a non-refundable application fee regardless of outcome. Finland, for instance, charges a processing fee of €29,000 whether the decision is positive or negative. Approval may come with conditions — additional reporting, a pre-launch audit, or limits on certain products.

Stage 8: Pre-launch and go-live

Before taking real-money play, an operator typically must:

• pay the first annual fee;
• complete a pre-launch or operational audit;
• confirm live connections to required systems;
• have approved key staff in post;
• register any affiliates or suppliers where required.

Stage 9: Life as a licensee

A licence is the beginning of supervision. Ongoing obligations commonly include:

• regular regulatory returns (financial, player-protection, AML statistics);
• notification of key events — changes of control, new key staff, security breaches, material litigation;
• annual or periodic external audits;
• annual fees and gambling taxes;
• renewal applications at the end of the licence term (often five years in Europe).

Regulators can and do impose fines, licence conditions and revocations for failures. A properly resourced compliance function is the only sustainable way to keep a licence.

Common reasons applications fail or stall

• Unclear or undocumented source of funds.
• Undisclosed owners or related parties.
• Generic policies not tailored to the market.
• Key function holders lacking relevant experience.
• Technical certifications started too late.
• Evidence of prior activity in the market without a licence — many regulators treat past unlicensed supply as a serious suitability concern.

A note on newly opening markets

When a market opens for the first time — as Finland, New Zealand and Alberta are doing or have done in 2026–2027 — regulators often run fixed application windows, require applicants to exit any unlicensed activity by a set date, and process large volumes at once. Early preparation of ownership and source-of-funds documents is the single most effective way to avoid missing a launch window.