Annex B · §5
Jurisdiction profiles
A profile turns the neutral record model into one authority’s rule set. It contains parameters only — permitted rails, holder and closed-loop rules, thresholds and aggregation windows, payout deadlines, player-funds protection, submission mode and retention — and never adds fields.
- 67JurisdictionsOn five continents
- 4RegionsEurope 35 · Eurasia, Middle East and Asia 9 · Africa 12 · Americas and the Caribbean 11
- 450+Published sourcesLaws, regulations, licence conditions and guidance
- 100%Open for reviewEach authority can correct its own profile
Each profile is researched from the authority’s own published rules — laws, regulations, licence conditions and guidance — as at 2 October 2026. Profiles are a reference, not legal advice. “Not found” means that no published rule was located, not that none exists; “to be confirmed” marks a reading the sources did not settle.
Profiles by region
67 jurisdictions · researched from published sources · open for authority review
| Jurisdiction | Authority | Rails and virtual assets | Ownership, closed loop, payouts | Thresholds and reports | Player funds | Reporting and retention | Status |
|---|---|---|---|---|---|---|---|
| Europe | |||||||
| United KingdomCorrect this profile: United Kingdom | Gambling Commission | Credit cards banned since April 2020, including credit-funded e-wallets. Virtual assets not prohibited by statute; no licensee approved in practice; the Commission began exploring a possible route in 2026, linked to the FCA crypto regime. | No explicit closed-loop rule; payment methods not in the customer’s name and open-loop systems rated high risk (2026 risk assessment). Financial limit prompted before first deposit. | Due diligence at €2,000 for remote casino. Financial vulnerability checks on net deposits over 30 days; staged financial risk assessments announced July 2026. Suspicious activity reports to the NCA. | Segregation and disclosure of a protection rating (not protected, medium, high), shown at first deposit. | Quarterly regulatory returns. Retention 5 years. | Researched |
| IrelandCorrect this profile: Ireland | Gambling Regulatory Authority | Credit cards and credit-funded digital payments prohibited (s.165, Gambling Regulation Act 2024); buy-now-pay-later excluded by guidance. Virtual assets not addressed in the Act; national AML action plan targets a standard on crypto as a source of funds by Q2 2027. | Closed-loop payouts planned in the national AML action plan (target Q2 2027; not yet law). Monetary limit tool; excess refunded within 7 days (s.164). | Due diligence at €2,000. Suspicious transaction reports to FIU Ireland (goAML) and to Revenue. | Authority may make rules on segregated customer accounts (s.136); none made yet. | Record-keeping rules consulted July–August 2026. Retention 5 years, extendable. | Researched |
| GibraltarCorrect this profile: Gibraltar | Gambling Commissioner | No credit for gaming. No published policy on virtual assets; the Gambling Act 2025 includes crypto currencies in “money’s worth”; DLT businesses are licensed separately by the GFSC. | Payments to and from a bank account in the customer’s name; enhanced due diligence for every new depositing customer. Withdrawals within 5 working days of verification. | Suspicious activity reports to the GFIU through Themis; Commissioner notified within 24 hours of suspected money laundering. | Liabilities separately identifiable and covered by cash or equivalents. | Quarterly statistical and financial returns; annual AML survey. Retention 5 years. | Researched |
| Isle of ManCorrect this profile: Isle of Man | Gambling Supervision Commission | No credit-card ban found. Virtual assets only under five GSC-approved models (licensing requirements, October 2025); crypto in, fiat out not permitted. | Same coin in, same coin out (BTC in, BTC out). Winnings to the customer, or to a third party on the customer’s written instruction. | Identification at account opening; verification once deposits or withdrawals reach €3,000 within 30 days (AML/CFT Code 2019). Suspicious reports to the Isle of Man FIU through Themis. | Segregated from operating funds and held on trust at an Isle of Man bank. | Registration and gaming servers on the Island. Retention 5 years. | Researched |
| AlderneyCorrect this profile: Alderney | Alderney Gambling Control Commission | Card rules not found. Cash may never be accepted from a customer (eGambling Regulations 2009, regs 4 and 6). Virtual assets reportedly not permitted (to be confirmed). | Additions to customer funds governed by the eGambling Regulations 2009 (reg. 232); same-method rule not found. | Due diligence when a customer’s total deposits first reach €3,000 (Schedule 4, as amended from 1 January 2026). Suspicious reports to the Guernsey FIU through Themis. | Category 1 licensees keep customer balances in a separate bank account held solely for that purpose; cash above player balances. | Retention 5 years. | Researched |
| MaltaCorrect this profile: Malta | Malta Gaming Authority; FIAU | Only payment providers notified to the MGA. Virtual assets permitted under the MGA DLT Policy through VFA-authorised providers; privacy coins excluded; withdrawals in the currency deposited. | Withdrawals to the source account “where possible”, within 5 working days. | Due diligence at €2,000 over a rolling 180 days. Suspicious transaction reports through goAML. | Legally separate from the operator’s assets; balance at least equal to liabilities, at least 90% in the account and the rest in transit. | Monthly player-funds report with evidence; real-time mirror of essential regulatory data. Retention 5 years. | Researched |
| ItalyCorrect this profile: Italy | Agenzia delle Dogane e dei Monopoli | Only traceable instruments in the account holder’s name; cash only at retail points, up to €100 per week per account. Virtual assets not permitted in practice. | One account per player per concessionaire; withdrawals to a traceable instrument in the holder’s name. | Suspicious transaction reports to UIF through Infostat-UIF. | Account balances usable only for gaming transactions; guarantee lodged in ADM’s favour. | Real-time exchange with the central system; each transaction receives a unique code before the account moves; infrastructure in the EEA. AML records 10 years. | Researched |
| GreeceCorrect this profile: Greece | Hellenic Gaming Commission | Bank and credit transfers, debit, credit and prepaid cards, and e-wallets, all through payment service providers. Virtual assets not permitted. | Instruments owned by the player; ownership confirmed for deposits from €5,000 and withdrawals from €800; winnings to the player’s own EU/EEA account. | Due diligence at €2,000; deposits capped at €800 until verification. Suspicious transaction reports to the Anti-Money Laundering Authority. | Separate player account; any shortfall cured within 3 business days. | Real-time link through an intermediate control system; certified data “Safe” every 6 months. Gaming data 10 years; AML 5 years. | Researched |
| CyprusCorrect this profile: Cyprus | National Betting Authority | Online betting only; online casino prohibited. Funding by card, electronic transfer or e-money; no cash, no credit. Virtual assets only with the Authority’s approval. | Winnings within 5 working days, only to the account the stakes came from; instruments in another person’s name treated as high risk. | Due diligence at €2,000 of deposits. Suspicious reports to MOKAS through goAML; quarterly AML report to the Authority. | Client account at a credit institution; shortfall fixed within 3 days of month-end. | Backup server in Cyprus with real-time access for the Authority; national self-exclusion platform. Retention 5 years. | Researched |
| PortugalCorrect this profile: Portugal | SRIJ | Only electronic payment instruments in legal tender, via authorised payment service providers (Regulamento 903-B/2015), which excludes virtual assets; instruments disclosed to the regulator; flows through an EU credit-institution account. | Balances paid only to a payment account the player named and holds, or to a bank account if the instrument cannot take refunds; identity verified before withdrawal. | Due diligence at registration and from €2,000. Suspicious reports to the UIF of the Polícia Judiciária. | €500,000 guarantee per licence (bank guarantee, insurance or deposit) securing legal obligations, including to players, reviewable against balances; separate €100,000 tax guarantee. Segregation to be confirmed. | Certified system linked in real time; XML financial reports with hourly summaries; central self-exclusion register. Retention at least 7 years. | Researched |
| SpainCorrect this profile: Spain | Dirección General de Ordenación del Juego | Regulator-coded list of payment types; no credit, and no payment forms concealing loans (RD 1614/2011 art. 37); no negative balances. Virtual assets reported as not permitted (to be confirmed). | Withdrawal ordered within 24 hours (RD 1614/2011 art. 35). Each deposit and withdrawal reported with method, provider, last four digits and a holder-verified flag; identity verified within one month before prizes are paid. | Due diligence at €2,000, single or linked. Suspicious reports to SEPBLAC without delay on form F19-1; the electronic channel is reserved for credit institutions. | Player deposits in exclusive, separate current accounts in Spain notified to the regulator, used only for gaming, with limited signing powers (RD 1614/2011 art. 39). Licence guarantees (€2 million initially). | Internal control system: XML to the regulator’s schema in an EU data warehouse, real-time, daily and monthly; central self-exclusion register (RGIAJ). AML 10 years. | Researched |
| FranceCorrect this profile: France | Autorité nationale des jeux | Online betting, horse racing and poker only; no online casino. Payments through EU/EEA payment service providers (Law 2010-476 arts. 17–18). Virtual assets not addressed. | Holder of the payment account verified; balances repaid only to a single payment account the player holds with an EU/EEA provider (art. 17), immediately — delay allowed only to file a suspicious report. | Every online player identified at account opening. Suspicious reports to Tracfin through ERMES, in principle before execution. | Surety, trust, insurance, escrow account or similar mechanism guaranteeing repayment of all player balances in all circumstances (Law 2010-476 art. 15). | Real-time archiving of all data on a frontal in metropolitan France with a certified data safe (art. 31); national gambling ban register. Data retained 5 years after account closure. | Researched |
| NetherlandsCorrect this profile: Netherlands | Kansspelautoriteit | Instruments from EU-licensed banks, payment or e-money institutions, traceable to the player; anonymous instruments prohibited. Credit-card and virtual-asset rules not found. | Deposits only from the player’s own account; payout without undue delay, no minimum withdrawal and no wagering requirement on deposited funds. | Full due diligence before play. Reports to FIU-Nederland through goAML (objective indicator €15,000). Affordability checks from €700 monthly net deposits (€300 for ages 18–23). | Third-party funds foundation or approved equivalent. | Operator-hosted Controle Databank in the Netherlands, fed near real time as XML to the regulator’s schema; CRUKS check. AML 5 years. | Researched |
| BelgiumCorrect this profile: Belgium | Gaming Commission | Credit cards prohibited online. No virtual-asset framework. | Account in the player’s name and non-transferable; separate account per licence and no transfers between player accounts (law of 18 February 2024). | €200 weekly deposit cap per operator; an increase needs approval after a National Bank credit-register check. Identification for stakes or winnings of €2,000; suspicious reports to CTIF-CFI through goAML (sole channel since October 2024). | Not found. | Permanent data link to the Commission; EPIS exclusion check before play. AML records 10 years. | Researched |
| GermanyCorrect this profile: Germany | Gemeinsame Glücksspielbehörde der Länder | Direct debit, bank transfer or a card in the player’s name; anonymous instruments banned; virtual assets not permitted. | Player and payment-account names must match; payouts by the same method to the player’s account. | Full due diligence at onboarding; suspicious reports to the FIU through goAML. €1,000 monthly cross-operator deposit limit enforced in real time through LUGAS. | Segregated, insolvency-protected account equal to all player balances. | LUGAS limit and activity file; OASIS exclusion; Safe-Server holding immutable JSON data. AML 5 years. | Researched |
| AustriaCorrect this profile: Austria | Federal Ministry of Finance | Online monopoly (one concession). Bill 594 d.B., in Finance Committee (EU standstill to 5 November 2026), would licence online operators from October 2027 and allow payment blocking of unlicensed operators (3 banking days in draft). | Not found. | Due diligence under the AML act; suspicious reports to A-FIU through goAML. Bill: cross-operator deposit limits (draft: €250 weekly under 26, €1,680 monthly from 26). | Not found. | Bill: Safe-Server, limit and exclusion registers from 2027. Retention 5 years. | Researched |
| SwitzerlandCorrect this profile: Switzerland | ESBK and Gespa | Online casino only as an extension of a land-based concession; lotteries and betting a monopoly. Virtual assets not accepted; ESBK found in September 2023 that the framework lacks safeguards for crypto. | Swiss-resident players only; winnings only to accounts in the player’s name; online lottery and betting winnings over CHF 1,000 paid directly to that account (GwV-EJPD art. 21). | Identity checked at account opening; AML identification at CHF 4,000 within 24 hours (casinos) or CHF 15,000 deposits / CHF 10,000–25,000 winnings within 30 days (lotteries, betting). Reports to MROS through goAML. | Not found. | Shared exclusion register, also valid in Liechtenstein since January 2025; DNS blocking. Retention 10 years. | Researched |
| DenmarkCorrect this profile: Denmark | Spillemyndigheden | Deposits only through regulated payment providers; no cash; no credit. Unregulated virtual assets not accepted. | Identification by national ID and eID; no transfers between accounts; balance paid within 5 working days of closure. | Full identification at registration; suspicious reports through goAML. | Entrusted funds in a separate, insolvency-protected bank account. | Operator-hosted SAFE data vault (XML), sealed daily with a regulator-issued tamper token; ROFUS checks. SAFE 12 months online plus 48 archived; KYC 5 years. | Researched |
| SwedenCorrect this profile: Sweden | Spelinspektionen | Only regulated payment providers; no cash online. Since May 2026 no credit-funded play of any kind: credit cards, invoice, buy-now-pay-later. | No transfers between accounts; balance paid promptly on closure. | Mandatory deposit limit; suspicious reports to the Financial Intelligence Unit. | Kept separate from the licensee’s own funds. | Spelpaus checked before any play; gaming system in Sweden unless approved abroad. Retention 5 years. | Researched |
| NorwayCorrect this profile: Norway | Lotteri- og stiftelsestilsynet | State monopoly (Norsk Tipping, Norsk Rikstoto); no gambling on credit. | One account per operator, with eID. | Suspicious reports to Økokrim. | Not found. | Banks block payments to unlicensed operators by merchant category and named payment facilitators; DNS blocking. Retention 5 years. | Researched |
| FinlandCorrect this profile: Finland | Lupa- ja valvontavirasto | Licensed online betting and casino from July 2027 (monopoly until then); no credit-funded play; daily and monthly transfer caps. | Account holder and bank-account holder expected to match (to be confirmed); balance paid without delay on closure. | Suspicious reports to the FIU of the National Bureau of Investigation. | Segregated, with disclosure to players. | Game and account data to the regulator; national self-exclusion register; payment blocking since 2023. Retention 5 years. | Researched |
| EstoniaCorrect this profile: Estonia | Tax and Customs Board | Virtual assets not prohibited; several licensees accept them through crypto-provider partners, but must show how a crypto or intermediary payment is proved to come from the player’s account. | Stakes accepted only from the player’s own account; winnings paid only to the account the player paid in from (licence application requirements). | Suspicious, unusual and over-limit cash transaction reports to the FIU through its online reporting system. | Not found. | Regulator pulls data from operator systems through the national X-tee exchange layer; self-exclusion list. Retention 5 years. | Researched |
| LatviaCorrect this profile: Latvia | State Revenue Service | Settlement through a credit-institution account. Supervision transferred to the tax authority in 2026. | No prize paid to an account not used for deposits (to be confirmed). | Suspicious reports and threshold declarations to the Financial Intelligence Service through goAML. | Not found. | Self-exclusion register; quarterly statements; domain blocking within 5 working days. Retention 5 years. | Researched |
| LithuaniaCorrect this profile: Lithuania | Gaming Control Authority | Stakes only from the player’s payment account to the operator’s. | Winnings to the gaming account or a payment account the player names; cash payout at a land-based venue on request. | Suspicious reports to the FNTT. | Winnings reserve of at least €72,400 in securities, bank funds or cash, restored within 2 calendar days. | Remote access to operator systems; self-exclusion register; illegal-operator list binding payment providers. System data 5 years. | Researched |
| RomaniaCorrect this profile: Romania | ONJN | Banking-system instruments; payment processors licensed as gambling suppliers and bound by the operator blacklist. | Deposits capped at €200 until verification within 30 days; winnings paid within 3 business days. | Suspicious reports to ONPCSB before execution; cash from €10,000 within 3 working days. | Separate account at a Romanian bank; guarantee of €2 million (€5 million for casino). | Safe server and mirror server in Romania; real-time self-exclusion register. Retention 5 years. | Researched |
| BulgariaCorrect this profile: Bulgaria | National Revenue Agency | Stakes and payouts through a bank account licensed in Bulgaria or the EU; winnings above BGN 5,000 (about €2,500) only by bank transfer. | Not found. | Due diligence at €2,000; suspicious reports to FID-SANS, before the operation where possible. | Collateral in cash or a bank guarantee. | Every wager and payout to an Agency server in real time; gambling data stored in Bulgaria; exclusion register; payment institutions barred from serving unlicensed operators. Retention: AML 5 years, otherwise the tax limitation period. | Researched |
| HungaryCorrect this profile: Hungary | SZTFH | Transfer, linked card, e-money and carrier billing; online casino reserved to land-based concessionaires. | Payment-account name must match the player’s; winnings to the player’s own account within 30 days of the claim. | Due diligence at winnings of HUF 600,000; suspicious reports to NAV PEI through its online form. | Not found. | Remote back-office access; player-protection register including court-ordered restrictions; card payments to unlicensed operators blocked. Gambling data 6 years. | Researched |
| PolandCorrect this profile: Poland | Ministry of Finance | Online casino a state monopoly; betting licensed. Payments only through authorised payment institutions. | Play only through a registered player account; no own-account, third-party or payout-deadline rule found. | Due diligence at €2,000; suspicious reports to GIIF through its IT system. Cash and transfers over €15,000 reported within 7 days (to be confirmed for operators). | Security of PLN 480,000 for online betting, as a bank or insurance guarantee or a cash deposit. | Register of blocked domains: internet providers block within 48 hours, payment providers stop serving within 30 days. Real-time archiving of game data, kept 5 years from year end. AML retention 5 years. | Researched |
| Czech RepublicCorrect this profile: Czech Republic | Ministry of Finance | Cashless, through a registered payment account or instrument in the player’s own name at an EU-authorised provider; cash deposits capped at CZK 10,000 per 24 hours. Virtual assets may not be prizes. | No deposits from, or withdrawals to, any other account. Winnings credited without undue delay, within 30 days of settlement; withdrawals paid promptly and free of charge. | Suspicious reports to the FAÚ through its e-form. | Security deposit of CZK 30–50 million per online game type. | Daily automated reports; excluded-persons register (self-exclusion, benefit recipients, insolvency) queried by API; blocklist of websites, apps and bank accounts. Account records kept 3 years after closure. | Researched |
| SlovakiaCorrect this profile: Slovakia | Gambling Regulatory Authority | Stakes in cash or cashless; player-account records hold the payment account or card number. From January 2026 payment providers act directly on the regulator’s blacklist, without a court order. Virtual assets: not found. | Winnings paid within 5 business days of the claim (Gambling Act s.14). No own-account or third-party payment rule found. | Identification at €1,000; due diligence at €2,000; reports to the FIU of the National Crime Agency. | Financial guarantee deposited with the regulator, up to €1.5 million depending on the licence. | Server in Slovakia with free online access for the regulator; excluded-persons register. Server data kept at least to the end of the following calendar year, plus two years of backups (Decree 142/2019). | Researched |
| SerbiaCorrect this profile: Serbia | Games of Chance Administration | Cashless, plus cash at approved desks; cash pay-ins and cash payouts each capped at RSD 1,175,000 per player in 30 days. | Deposits only from, and withdrawals only to, the player’s own current account; no transfers between players’ accounts. | Due diligence at €2,000; identity checked before any deposit. Reports to the APML. | Guarantee (amount to be confirmed). | Every transaction by API in real time; database or mirror in Serbia; monthly payment-channel reports by the 5th through the Administration’s web service. Retention 10 years. | Researched |
| CroatiaCorrect this profile: Croatia | Ministry of Finance | Cards, transfers, e-payments, cash at betting shops; activation vouchers for online casino. | One registered account for withdrawals, checked against the tax-number register; online casino accounts withdraw winnings only; dormant balances returned after 12 months. | Reports to the Anti-Money Laundering Office. | Bank guarantees (from about €398,000 for online casino). | Real-time link to the Ministry; central exclusion register (2026). Retention 5–10 years. | Researched |
| Bosnia and HerzegovinaCorrect this profile: Bosnia and Herzegovina | entity regulators (Federation; Republika Srpska) | Federation: payouts at shops, to the player’s virtual account or registered bank account. | Federation: payout to the registered account within 3 days of the request. | State-level AML law; FIU within SIPA. | Federation: bank guarantees (KM 1 million casino, KM 600,000 betting). | Federation: direct online link to the Tax Administration. Each entity runs its own regime. | Researched |
| MontenegroCorrect this profile: Montenegro | Games of Chance Administration | Euro only; online limited to land-based licensees; banks can be asked to block payments to unlicensed sites. | No third-party payment at the cash desk; separate record and promotional accounts. | Identification at €20 stakes or winnings and at €2,000 transactions. | Bank guarantees covering winnings. | Real-time online supervision of all payments in and out. Retention 5 years. | Researched |
| KosovoCorrect this profile: Kosovo | Tax Administration | Gambling prohibited since 2019; no licensed flows. | Not applicable. | FIU-K. | Not applicable. | A profile would cover payment-side blocking only. | Researched |
| Eurasia, Middle East and Asia | |||||||
| UkraineCorrect this profile: Ukraine | PlayCity | Non-cash only, through current accounts at Ukrainian banks, with a fiscal receipt per transaction; gambling with credit funds banned; no route for virtual assets. | One player, one gaming account, one personal bank account; no third-party bets or account use. Spending and time limits set before play; self-restricted players paid out within 5 days. | Threshold transactions from UAH 55,000 for gambling (UAH 400,000 generally), reported within 5 business days or monthly, by type; suspicious reports immediately; to the State Financial Monitoring Service. | Bank guarantee or deposit of 7,200 minimum monthly wages securing payment of winnings. | State Online Monitoring System in pilot (12 operators connected by April 2026; second phase due end 2026): each bet, payout and refund in near real time with a unique identifier. AML records 5 years. | Researched |
| GeorgiaCorrect this profile: Georgia | Ministry of Finance; Revenue Service | GEL only (foreign payments converted to GEL on receipt), by card, licensed payment providers and bank transfer; virtual assets not a lawful means of payment. | Biometric and age checks against state databases; players aged 25 and over; 5% income tax withheld on withdrawals. | Due diligence when accepting funds or paying winnings above GEL 5,000; threshold and suspicious reports to the Financial Monitoring Service. | Security required for totalisators. | Connection to the national control system. Player data 5 years; AML records 5 years. | Researched |
| ArmeniaCorrect this profile: Armenia | Ministry of Finance; State Revenue Committee | Cash, e-money and terminal top-ups banned; Armenian bank cards only; banks decline gambling-category payments to unlicensed operators (May 2026). | Dedicated gaming account funded only from a bank account or card verified as the player’s own; winnings only to a card. Gambling capped at 20% of declared annual income from January 2027. | Bets, winnings and lottery purchases from AMD 1 million reportable, with suspicious transactions, to the Financial Monitoring Center of the Central Bank. | Not found. | Central real-time platform for wagers, deposits and losses (rollout January 2027); five-year self-exclusion across all sites and blocking of unlicensed sites from January 2027. | Researched |
| AzerbaijanCorrect this profile: Azerbaijan | state operator (Azerlotereya) | State monopoly: one lottery and one licensed sports-betting operator; casinos allowed only on artificial islands (July 2025), none operating. Payment rules not found; no virtual-asset providers registered. | Not found. | Cash transaction reports from AZN 15,000 for lottery and betting organisers; suspicious reports to the Financial Monitoring Service. | Not found. | Central system not found. AML records at least 5 years. | Researched |
| KazakhstanCorrect this profile: Kazakhstan | Ministry of Tourism and Sports | Online limited to bookmakers and totalisators; bets and winnings only by electronic payment through the Unified Accounting System (NomadPay); banks reject payments to blacklisted operators. Virtual assets not accepted (to be confirmed). | Two-step biometric identification; debtors, specified public officials and self-excluded players blocked automatically at the central hub. | Reports to the Agency for Financial Monitoring; gambling-specific thresholds not found. | Not found. | Unified Accounting System (live 5 March 2026) records every bet, payment and winning, stores player data and enforces per-player monthly limits. | Researched |
| UzbekistanCorrect this profile: Uzbekistan | National Agency for Prospective Projects | Payments only through the state register, using cards issued or processed in Uzbekistan; crypto-assets barred as a means of payment (to be confirmed). First two licences issued July 2026. | Remote biometric identification before play; monthly spending cap reported at 10% of verified income (to be confirmed); self-exclusion through the register. | Reports to the FIU (Department for Combating Economic Crimes). | Reserve in a separate bank account (75,000 base units for betting and online games). | Unified State Register of Bets and Players: registrations, bets, deposits and winnings in real time; monthly limits. | Researched |
| United Arab EmiratesCorrect this profile: United Arab Emirates | GCGRA | No published list of methods; a new method needs a risk assessment; credit cards only in the player’s own name. Virtual assets not addressed. | Withdrawals by the deposit method; third-party payments limited or prohibited; national ID at sign-up. | Due diligence at AED 11,000, single or linked (Cabinet Resolution 134/2025, art. 3); such amounts must pass through a player account. Suspicious reports immediately to the UAE FIU through goAML. | Not found. | Unified Player Database across licensees (in development). Retention 5 years from the transaction or end of the relationship (art. 25). | Researched |
| IndiaCorrect this profile: India | MeitY; Online Gaming Authority of India | Online money games prohibited (2025 Act, in force May 2026); banks and payment firms barred from processing them, including virtual tokens. | Not applicable online. | Land casinos report to FIU-IND: cash over ₹10 lakh a month; suspicious reports within 7 days. | Not applicable. | Payment-blocking orders to banks; registration check before processing permitted games. Retention 5 years. | Researched |
| PhilippinesCorrect this profile: Philippines | PAGCOR; AMLC; BSP | Only BSP-licensed payment gateways and channels (PAGCOR, May 2026); e-wallets removed gambling links (August 2025). 2025 BSP draft for a separate capped gambling account not issued (to be confirmed). No virtual-asset rules. | Government ID and live selfie before deposits (PAGCOR, 2025). Closed-loop rule not found. BSP draft (September 2026): gambling merchants onboarded only by direct acquirers, not aggregators. | Casino cash transactions over PHP 5 million within 5 working days; suspicious reports by the next working day (AMLC). | Not found. | Connection to PAGCOR’s central monitoring with real-time access. Retention 5 years. | Researched |
| Africa | |||||||
| South AfricaCorrect this profile: South Africa | National Gambling Board and provincial authorities; FIC | Online limited to bookmakers licensed by the provinces; vouchers and pay-by-bank common. Betting websites and apps need prior board approval (Western Cape, Eastern Cape). Virtual assets not addressed in gambling law. | Accounts opened in the customer’s name (provincial rules); Western Cape and Eastern Cape require an ID copy and proof of address. Eastern Cape pays winnings subject to FIC Act checks. No national closed-loop rule found. | Cash threshold reports from R49,999.99 within 3 days; suspicious transaction reports within 15 days, through goAML. Risk-based due diligence. National 20% tax on online gambling revenue proposed (Treasury, November 2025). | Set by provincial conditions; not uniform. No segregation rule found in the Western Cape or Eastern Cape betting rules. | Reporting to the provinces (Eastern Cape: monthly data backups by the 10th); the national monitoring system covers limited payout machines only. Retention 5 years (FIC Act and provincial betting rules). | Researched |
| MalawiCorrect this profile: Malawi | Malawi Gaming and Lotteries Authority; FIA | Mobile money dominant in practice; no published rules on payment methods. Virtual assets unregulated. | Not found. | Due diligence for casino and remote gaming at MK2 million within 24 hours; cash reports from MK5 million; suspicious transaction reports within 3 days. 15% withholding on winnings at payout. | Not found. | Central monitoring system contracted in 2023. Retention 7 years. | Researched |
| KenyaCorrect this profile: Kenya | Gambling Regulatory Authority; FRC; KRA | Mobile money pay-bills declared to the regulator; payout route by amount — registered mobile wallet up to KES 500,000, wallet or bank up to KES 5 million, bank above. Virtual assets prohibited unless approved. (2026 regulations partly suspended by the High Court pending a hearing.) | Payouts to the player’s registered wallet or bank account; player-set deposit limits by period. | Suspicious transaction reports to the FRC within 2 days and to the regulator within 24 hours. Excise duty of 5% on deposits; withholding tax on winnings. | Separate from operating funds; security bonds. | Real-time API access for the regulator’s central monitoring; tax-authority integration. Retention 7 years. | Researched |
| Nigeria (Lagos)Correct this profile: Nigeria (Lagos) | Lagos State Lotteries and Gaming Authority; NFIU | Banks, cards, USSD, wallets and agents; payment gateways to be certified by the regulator (2026); payment data to be held in Nigeria from 2027. Virtual assets not addressed by the gaming regulator. | No published rule found; national identity number collected. | 5% withholding on net winnings. Suspicious transaction reports to the NFIU within 24 hours, through goAML; cash thresholds of N5 million (individuals) and N10 million (companies). | Bank guarantee securing winnings under the inter-state framework. | Regulation by the states since the 2024 Supreme Court ruling; certification of systems. Retention 5 years. | Researched |
| GhanaCorrect this profile: Ghana | Gaming Commission of Ghana | Mobile money dominant; online betting licensed by the Gaming Commission. Virtual-asset providers licensed under the 2025 VASP Act (Bank of Ghana); no gaming rule on virtual assets. | Ghana Card the only ID accepted online; biometric check against the national ID database on each bet and on each claim for winnings (since 2025). | Suspicious reports to the FIC within 24 hours, through goAML; cash-report threshold set by the FIC per sector (gaming amount not found). 10% withholding on winnings repealed April 2025; 20% tax on gaming revenue. | Not found. | Monthly gaming-revenue returns to the tax authority by the 15th; gaming administration and monitoring system in procurement since 2023 (status to be confirmed). Retention 5 years. | Researched |
| BotswanaCorrect this profile: Botswana | Gambling Authority | Online sports betting under local bookmaker licences since 2025; offshore sites blocked. Mobile money and cards. Virtual-asset providers licensed by NBFIRA (2022 Act); no gambling rule on virtual assets found. | Identity verification and access controls required of bookmakers; no closed-loop rule found. | Cash transactions of P10,000 or more reported to the FIA; suspicious reports through goAML (Financial Intelligence Act 2022). A 2026 amendment bill aligning gambling with FATF standards passed in August 2026 (assent to be confirmed). | Not found. | Amendment bill links most licensees’ machines to the Authority’s monitoring system; casinos and bingo run their own. Online feed not found. Retention 20 years (Financial Intelligence Act 2022). | Researched |
| ZimbabweCorrect this profile: Zimbabwe | Lotteries and Gaming Board | Mobile money and cards; USD and ZiG in use. Virtual-asset providers register with the FIU (S.I. 99 of 2026); no gaming rule on virtual assets. Online betting rules await the Lotteries and Gaming Amendment Bill. | Not found. | Due diligence when a gaming customer opens an account or transacts US$3,000 or more; suspicious reports to the FIU through goAML. 25% withholding on gross winnings from January 2026, remitted to ZIMRA by the 10th. | Casino bank guarantee of US$50,000 covering prizes and jackpots. | Real-time gaming management system announced, not yet live. Monthly tax returns by the 5th. Retention 5 years (Money Laundering and Proceeds of Crime Act). | Researched |
| EswatiniCorrect this profile: Eswatini | Gaming Board | Online sports betting under bookmaker licences; online casino games prohibited. Regulations under the Gaming Control Act 2022 still pending. Mobile money dominant. | Clients registered with national ID (2025); minors’ secondary mobile-money wallets to be blocked with the telecoms operators (announced December 2025). | Purpose checked on cash transactions over E10,000 (others over E20,000); suspicious reports to the FIU within 2 working days (2011 AML Act). Cash-report threshold left to ministerial notice; amount not found. | Not found. | Monitoring system proposed, not live. Retention 5 years (2011 AML Act). | Researched |
| LesothoCorrect this profile: Lesotho | Lesotho Casino Board | No online licence type (Casino Order 1989; Lotteries and Betting Act 1984); offshore activity only. | Not found. | Casino due diligence at M25,000; suspicious reports to the FIU within 7 days (2017 AML Regulations under the 2008 AML Act). | Not found. | Retention 5 years (2017 AML Regulations). | Researched |
| AngolaCorrect this profile: Angola | Instituto de Supervisão de Jogos | Online gaming licensed under the 2024 Gaming Activity Law (Lei 17/24); payment systems in force in Angola only. Kwanza only; foreign currency and virtual assets prohibited; locally incorporated companies only. | Players identified before buying chips or being paid; prize cheques crossed, in the winner’s name and non-endorsable (ISJ instruction 2/21). | Identification of online players spending US$2,500 and of winners of US$2,500 or more; suspicious reports to the UIF immediately, through its portal. Prize tax of 10–15% by game type. | Bank guarantee of US$50,000–400,000 by type of gaming reported (2026 licensing; purpose to be confirmed). | All gaming traffic and operations to be routed through a central gaming unit to the ISJ’s control infrastructure (2024 law; implementation to be confirmed). Retention 10 years. | Researched |
| TanzaniaCorrect this profile: Tanzania | Gaming Board of Tanzania | Cards, transfers, mobile money and vouchers; mobile money dominant. | One account per player, linked to one nominated bank or mobile-money account; identity verified before any wager. | Cash of US$10,000 or more and transfers of US$1,000 or more reported within 5 working days; suspicious reports to the FIU (goAML) within 24 hours. Withholding on winnings: 12% sports, 13% land casino, 15% other. | Security bond available to pay prizes. | Primary server and financial control system in Tanzania; winnings tax filed and paid electronically by the 7th of the following month. Retention 10 years. | Researched |
| UgandaCorrect this profile: Uganda | National Lotteries and Gaming Regulatory Board | Mobile money dominant. Tax Procedures Code (Amendment) Bill 2025 would route all stakes and payouts through one gateway licensed by the Bank of Uganda and linked to the tax authority (enactment to be confirmed). | Players aged 25 and over, checked against ID. | 15% withholding on net winnings (from July 2026). Cash transactions over UGX 20 million reported to the FIA; suspicious reports through goAML. | Not found. | Central electronic monitoring system live since 2024, with data shared with the tax authority. | Researched |
| The Americas and the Caribbean | |||||||
| CuraçaoCorrect this profile: Curaçao | Curaçao Gaming Authority | Fiat, and virtual assets traded on licensed exchanges; no currency exchange; winnings paid in the currency used. Crypto policy (2026): analytics screening, segregated wallets, same-wallet and same-asset withdrawals by default; transition in four steps, with policy upload by September 2026 and the last steps due December 2026 and June 2027. | Players must play on their own behalf; play for third parties to be detected. | Due diligence at NAf 4,000 per gaming day across deposits and withdrawals; unusual transactions from NAf 5,000, including series, to the FIU through goAML. The Caribbean guilder (XCG) replaced the NAf at 1:1. | Separate account for player deposits and winnings; ring-fencing. | Incidents through the CGA portal without delay; critical data accessible from a Tier-IV data centre in Curaçao. Retention 5 years. | Researched |
| BrazilCorrect this profile: Brazil | Secretaria de Prêmios e Apostas; COAF | Pix, TED, debit and prepaid cards and book transfers only, through institutions authorised by the Central Bank; cash, boletos, cheques, credit cards and virtual assets prohibited. | Deposits only from a pre-registered account in the bettor’s name (CPF); withdrawals to such an account within 120 minutes. Welfare-recipient screening against SIGAP. | Suspicion-based reports to COAF by the next business day after analysis; annual nil declaration. | Separate estate covering balances and open bets; R$5 million financial reserve. | SIGAP: signed XML files daily (D+2) and monthly, cross-validated. Retention 5 years. | Researched |
| ArgentinaCorrect this profile: Argentina | provincial regulators (e.g. IPLyC Buenos Aires, LOTBA, Mendoza); UIF | Peso accounts; deposits only from the player’s own verified accounts, no cash and no third parties (Buenos Aires Province). Virtual assets not permitted in practice. | Withdrawals to the account used to deposit; payout instruction within 48 hours (Buenos Aires Province). | Monthly systematic report on prize payments from 15 minimum wages; suspicious reports within 15 days of concluding suspicion and no later than 150 days after the operation. | Not uniform across provinces. | Regulator access to operator systems (e.g. Buenos Aires Province); more than 15 jurisdictions and no common data standard. Retention 10 years. | Researched |
| ColombiaCorrect this profile: Colombia | Coljuegos | Pesos only; bank accounts, cards, gateways and prepaid cards from supervised entities; foreign and virtual currencies banned. 19% VAT on deposits ended 2025; 2026 VAT annulled; 16% GGR tax for 2026, under court review. | Only the identified player can withdraw; payout ordered within 72 hours; at most 3 withdrawals a day; at least 50% of deposits wagered before a withdrawal. | Identification from COP 5 million a day; monthly SIREL reports to the UIAF within 10 days: transactions from COP 5 million and monthly totals from COP 15 million; suspicious reports immediately. | Colombian bank account covering withdrawable balances; guarantee for prizes. | Onshore inspection system recording every transaction, as XML to the regulator’s schema. AML 5 years. | Researched |
| PeruCorrect this profile: Peru | MINCETUR | Cash, cards and other means; virtual assets expressly excluded. | Payout by the player’s chosen method or to an account in their name at a supervised entity; bank transfers within 3 business days. | Operations register from US$2,500; suspicious reports to UIF-Perú within 24 hours. | Guarantee of 600 UIT or 3% of net income, whichever is higher. | Laboratory-certified platforms; data to the MINCETUR data centre. 5 years, or the tax limitation period if longer. | Researched |
| MexicoCorrect this profile: Mexico | SEGOB | Internet bets need bank confirmation; cash for tickets and prizes banned from 3,210 UMA; virtual assets not addressed. SEGOB’s draft to replace the 1947 law awaits Security Cabinet review (September 2026). | Remote bets record the bettor’s account number and identity. | Identification from 325 UMA; notices to the UIF from 645 UMA by the 17th of the following month, via the SAT portal; 24-hour notices for suspicious cases (new rules from 30 November 2026). UMA 2026: MXN 117.31. | Bond covering about 60 days of prizes. | Real-time access for the tax authority (SAT) through an authorised provider; daily XML with the payment method. Retention 10 years. | Researched |
| ChileCorrect this profile: Chile | Superintendencia de Casinos de Juego | Online law pending: bill 14.838-03 passed the Senate in general (August 2025) and remains in committee (October 2026). It limits payment means to those authorised by the financial regulator; banks must block unlicensed sites. | No betting without funds in the account; payment instruments in a minor’s name barred (bill). | Casinos (UAF Circular 63, from 1 October 2026): due diligence from US$3,000; half-yearly reports of cash operations above US$10,000; suspicious reports to the UAF as soon as possible. Bill extends UAF duties online. | Liquidity reserve before operating (bill). | Remote access to platform systems for the regulator and tax authority (SII); technical standards (bill). Casino AML records 5 years. | Researched |
| ParaguayCorrect this profile: Paraguay | CONAJZAR | Law 7438/2025 and Decree 3846/2025 allow online casino and sports betting by tendered concession; CONAJZAR, now within the tax authority (DNIT), may supervise payment processing and order blocking. Online payment rules not found. | Identity document required to take part and transact, online modalities included (SEPRELAD Resolution 258/2020). | FIU: SEPRELAD. Suspicious reports within 24 hours of being classed as suspicious; nil reports after three months without one; due diligence from 8 minimum wages (to be confirmed). | Not found. | Gaming systems connected online or in real time to CONAJZAR, certified by independent accredited bodies (Decree 3846/2025). AML records 5 years. | Researched |
| PanamaCorrect this profile: Panama | Junta de Control de Juegos | US dollar settlement; online payment rules not found. Law 527 of 2026 lets the JCJ order internet providers to block unlicensed sites, apps and IP addresses. | Biometric identity and age verification on online platforms; voluntary spending and time limits (Law 527 of 2026, regulations due within six months). | Cash and quasi-cash transactions from US$10,000 declared to the UAF; suspicious reports to the UAF immediately on detection (Law 23 of 2015, art. 54, as amended in 2019). | Bond or deposit guaranteeing payment of prizes (to be confirmed). | Electronic audit system announced; annual JCJ audits of operators (Law 527 of 2026). AML records 5 years from the end of the relationship. | Researched |
| CanadaCorrect this profile: Canada | provincial (AGCO and iGaming Ontario; IGCO British Columbia; AGLC Alberta); FINTRAC | Virtual assets not accepted (Ontario, Alberta); deposits authorised by a financial services provider; no credit. Alberta opened 13 July 2026 under AGLC’s Standards and Requirements for Internet Gaming; British Columbia: online gambling through BCLC’s PlayNow. | Withdrawals only to an account the player legally holds; no transfers between players (Ontario). Alberta: geolocation blocking VPNs and proxies; source-of-funds corroboration where risk requires. | FINTRAC reports from C$10,000 (large cash, large virtual currency, casino disbursement) within 24 hours; suspicious reports as soon as practicable; JSON API. Reporting entity: iGaming Ontario; BCLC; Alberta, AiGC oversees AML (to be confirmed). | Under iGaming Ontario’s oversight (Ontario); annual agreed-upon procedures. Alberta and British Columbia not found. | Weekly revenue data to iGaming Ontario; FINTRAC copies to the AGCO. Alberta: financial reporting to AiGC; data outside Canada needs AGLC approval. IGCO (2026, replacing GPEB) regulates BCLC. Retention 5 years. | Researched |
| United States (New Jersey)Correct this profile: United States (New Jersey) | Division of Gaming Enforcement; FinCEN | Bank account, credit and debit card, cash at the cage, prepaid card, ACH and other means the Division approves; virtual currency and stablecoins not listed, and no approval found. | One non-transferable account per patron; no transfers between patrons; withdrawals to the patron’s verified bank account or prepaid card, or at the cage; refunds to the funding card. | Currency transaction reports above $10,000 per gaming day; suspicious activity reports from $5,000 within 30 days, through BSA E-Filing. | Separate New Jersey bank account at least equal to balances, funds on game and pending withdrawals; monthly attestation. | Regulator queries and exports system data; servers in Atlantic City. Account data 10 years; BSA records 5 years. No tribal gaming in the state, so no NIGC role. | Researched |
For authorities
Correcting a profile
Use “Correct this profile” on the relevant row, or write to [email protected]. Please state the jurisdiction, the parameter concerned, the correct reading, and the published source. Corrections an authority makes to its own profile are adopted as submitted. Comments from operators, suppliers, auditors and associations go through the editor, and substantive changes are published for comment before adoption (§13).
Principal sources for each jurisdiction are listed in Annex B of the Standard.