Online gaming licences: Malta, Isle of Man, Gibraltar, Curacao, Kahnawake and the UK

Online gaming is licensed nationally, and there is no passport. A licence from Malta, the Isle of Man or Gibraltar authorises the operator under that jurisdiction’s law. Whether the operator may then accept players from another country depends on the law of that country.

This guide compares the main regulators outside the United States that license operators serving international markets, and the national licence for Great Britain. It then covers the issue that most often decides whether a gaming business works in practice: access to banks and payment services.

Two questions every operator must answer

The first question is where the business is licensed. This determines the regulator, the capital, the technical standards and the AML regime the operator lives under.

The second question is where its players are. A growing number of countries require a local licence for any operator offering gambling to their residents, wherever the operator is based. Great Britain is a clear example, explained below, and many EU Member States run their own national licensing systems.

The result is that a “hub” licence is a base for corporate substance, technology and supervision. It is not a permission to serve every market. Payment providers and banks look at both answers when deciding whether to work with an operator.

Malta: Malta Gaming Authority

Malta is the largest EU base for online gaming groups. Licensing is under the Gaming Act (Chapter 583 of the Laws of Malta) and its regulations, administered by the Malta Gaming Authority (MGA).

Licence types

The MGA issues two kinds of licence:

• Gaming Service licence: a business-to-consumer (B2C) licence to offer a gaming service to players.
• Critical Gaming Supply licence: a business-to-business (B2B) licence for suppliers of the material elements of a game, or of the software that manages regulatory records and controls.

The Gaming Authorisations Regulations (S.L. 583.05) divide gaming services into four types:

Game type	Definition (summarised)
Type 1	Games of chance against the house, with outcomes from a random generator: casino games, lotteries, virtual sports
Type 2	Games against the house where the outcome depends on an external event and the operator manages its own risk through odds: fixed odds betting
Type 3	Games not played against the house, where the operator takes a commission: poker, bingo, betting exchanges
Type 4	Controlled skill games

Under regulation 6 of the same regulations, a licence term is ten years unless the regulations provide otherwise.

Capital

The MGA Capital Requirements Policy sets minimum share capital, made up of issued and paid-up share capital and share premium:

Licence	Minimum share capital
Critical Gaming Supply (B2B)	EUR 40,000
Gaming Service, Type 1	EUR 100,000
Gaming Service, Type 2	EUR 100,000
Gaming Service, Type 3	EUR 40,000
Gaming Service, Type 4	EUR 40,000
Multiple types	Cumulative, capped at EUR 240,000

The policy also requires licensees to keep a positive equity position and to restore it within set timelines if losses push equity below zero. For an operator with heavy marketing spend in its first years, this obligation is often more demanding than the entry capital.

Isle of Man: Gambling Supervision Commission

The Isle of Man licenses online operators under the Online Gambling Regulation Act 2001. Supervision is by the Gambling Supervision Commission (GSC), which also administers the island’s separate gambling AML and CFT legislation.

The Isle of Man is a Crown Dependency, outside both the UK and the EU. An Isle of Man licence therefore does not by itself give access to Great Britain or to EU Member States. Its strength is a long-established regulator with a strong focus on technical standards and anti-money laundering.

The framework is under review. In 2025 the GSC consulted on reforms across seven gambling statutes, including the Online Gambling Regulation Act 2001 and the Gambling (Anti-Money Laundering and Countering the Financing of Terrorism) Act 2018. The stated aims include stronger entry controls, wider inspection and investigation powers, more consistent enforcement and preparation for a Moneyval inspection in 2026. The response was published in October 2025, so applicants should check which changes have since been enacted.

Gibraltar: Gambling Act 2025

Gibraltar has hosted large online operators for many years. Its licensing law has recently been replaced.

The Gambling Act 2025 (Act No. 2026-04) received assent on 23 March 2026. Under the notice of commencement it came into operation on 1 April 2026, except sections 55 to 77. The Act separates two roles: the Licensing Authority, which is the Minister, and the Gambling Commissioner, who is the regulator.

Section 17 of the Act defines the regulated activities and groups them into three licences:

• B2C Gambling Operator’s licence: remote gambling with members of the public, non-remote gambling, and betting exchanges, intermediaries and agents.
• B2B Gambling Operator’s licence: providing remote gambling facilities to licence holders or to operators elsewhere, and supplying or servicing gambling machines.
• Gambling Operator Support Services licence: a new category covering activities such as gambling marketing services, holding companies of licensed businesses above a 25% ownership threshold, and holding or managing customer funds in connection with remote gambling, other than by a licensed credit institution.

A licence may cover remote or non-remote gambling, but not both. The Gambling Division states that new categories of licence holder have six months from commencement to obtain a licence.

Curacao: the National Ordinance on Games of Chance

Curacao has long been one of the most widely used jurisdictions for international online gaming, and also one of the most criticised. Its regime has been rebuilt.

According to the Curacao Gaming Authority, the Landsverordening op de kansspelen (LOK), the National Ordinance on Games of Chance, came into effect on 24 December 2024. The CGA began a phased reform in November 2023 to prepare for it. Under the LOK, the regulator is known as the Curacao Gaming Authority and is described as more independent in relation to online gaming.

Before the LOK, online gaming licences were issued under the National Ordinance on Offshore Games of Hazard (LBH). The CGA notes that the LBH remains relevant under the transitional provisions in Article 15.1 of the LOK.

For operators and their counterparties, the practical points are:

• Licence status matters. Banks and payment providers may distinguish between licences issued directly under the LOK and arrangements inherited from the old regime.
• Supervision is developing. The CGA states that it does not resolve individual player disputes, but that complaints may indicate breaches of the LOK and lead to action.
• Reputation lags reform. Many financial institutions still apply enhanced due diligence to Curacao licensed operators, and an operator should expect to show its own controls rather than rely on the licence alone.

Kahnawake Gaming Commission

The Kahnawake Gaming Commission regulates gaming within and from the Mohawk Territory of Kahnawake. It enacted its Regulations concerning Interactive Gaming on 8 July 1999.

A distinctive feature is the hosting requirement. Operators licensed by the Commission must be hosted at Mohawk Internet Technologies, a data centre located within the Territory.

The main operator authorisation is the Client Provider Authorization (CPA), and individuals in key roles need Key Person Permits. The Commission announced on 13 August 2026 the following fee changes from 1 January 2027:

Fee (USD)	Until 31 December 2026	From 1 January 2027
CPA application, including first annual fee	35,000	40,000
CPA annual fee	20,000	20,000
CPA five-year renewal	5,000, excluding due diligence and annual fee	40,000, including annual fee
Key Person Permit application	5,000	6,000
Key Person Permit annual fee	1,000	1,000

Great Britain: UK Gambling Commission

Great Britain is a national market rather than a hub, but it shapes how international operators structure themselves.

Since the Gambling (Licensing and Advertising) Act 2014, the Gambling Act 2005 has applied to remote gambling facilities used in Great Britain, even where the equipment is located elsewhere. An operator outside Great Britain commits an offence if it provides facilities without a Gambling Commission licence and knows, or should know, that they are being used or are likely to be used in Great Britain. A Malta, Gibraltar, Isle of Man or Curacao licence does not replace a British licence.

British rules also directly shape payments. The Gambling Commission banned gambling on credit cards from 14 April 2020, covering all online and offline gambling products except non-remote lotteries.

Comparing the regimes

Jurisdiction	Regulator	Main law	Points to note
Malta	Malta Gaming Authority	Gaming Act, Cap. 583	EU base; B2C and B2B; ten-year term; capital by game type
Isle of Man	Gambling Supervision Commission	Online Gambling Regulation Act 2001	Outside UK and EU; reforms consulted on in 2025
Gibraltar	Licensing Authority and Gambling Commissioner	Gambling Act 2025	New Act from 1 April 2026; new support services licence
Curacao	Curacao Gaming Authority	LOK, from 24 December 2024	Rebuilt regime; old LBH in transition
Kahnawake	Kahnawake Gaming Commission	Regulations concerning Interactive Gaming (1999)	Local hosting required; CPA model
Great Britain	Gambling Commission	Gambling Act 2005	Licence needed to serve players in Great Britain

Payments and banking: the practical bottleneck

Many gaming businesses obtain a licence and then struggle to open bank accounts, acquire card payments or hold player funds. The reasons are structural.

Why banks are cautious

• AML exposure. Gambling is treated as higher risk for money laundering because of cash-like value transfer, high volumes and the possibility of moving funds through player accounts.
• Market legality. A bank processing payments for an operator may be facilitating unlicensed gambling in a country where the player is located. Banks check which markets the operator serves, not just where it is licensed.
• Chargebacks and disputes. Card disputes, fraud and affordability complaints create losses and reputational risk for acquirers.
• Correspondent pressure. Smaller banks rely on correspondent banks for USD and EUR clearing. Correspondents often restrict gaming flows, which limits what the smaller bank can accept.

The regulatory direction

AML obligations on gaming operators are rising. In the EU, Regulation (EU) 2024/1624 lists providers of gambling services as obliged entities. It requires customer due diligence for gambling transactions of at least EUR 2,000, whether in one transaction or several that add up to that amount. Member States may exempt some low-risk gambling, but not casinos, online gambling or sports betting unless these are state-administered. The Regulation applies from 10 July 2027.

Payment rules are also tightening at national level. The British credit card ban is one example, and several national regulators impose their own restrictions on payment methods and deposit limits.

What helps

1. Match licences to markets. An operator that holds licences for the markets it actually serves, and geo-blocks the rest, is a much easier client.
2. Show your own AML framework. Customer risk scoring, source of funds checks, transaction monitoring and a qualified money laundering reporting officer should be documented before approaching a bank.
3. Segregate player funds. Keeping player balances separate from operating funds, with regular reconciliation, reduces risk for both players and the operator’s banks.
4. Use licensed payment institutions. Working with authorised payment and e-money institutions that understand gaming is usually more realistic than relying on a single bank relationship.
5. Plan for redundancy. Payment relationships in gaming can be withdrawn at short notice. Two or more acquiring and banking partners reduce operational risk.

Summary

Online gaming licensing is national, with no passport. Malta, the Isle of Man, Gibraltar, Curacao and Kahnawake each offer a base for international operators, with very different levels of substance, capital and supervision. Gibraltar and Curacao have both introduced new laws recently, and the Isle of Man is reforming its statutes. Great Britain and many other countries require their own licence to serve their players. In practice, payment and banking access depends less on the name of the licence and more on whether the operator’s markets, controls and player fund arrangements stand up to scrutiny.