Casino licences explained: Curaçao, Malta, UKGC, Brazil

Why does nearly every crypto casino hold a Curaçao licence?

Two reasons: cost and crypto. A Curaçao authorisation has long been the cheapest and quickest gambling licence available anywhere, and until recently it was not issued by the regulator directly at all. A small number of master licence holders, whose numbers ended in /JAZ, sub-licensed to hundreds of operators, which meant the site you were dealing with was often a customer of a licence holder rather than a licensee of the state. That structure is being dismantled. The National Ordinance on Games of Chance, known as the LOK, came into force in December 2023 and created the Curaçao Gaming Authority as a direct regulator; new licences are issued by the authority itself, carry OGL-prefixed numbers, and the sub-licence tier is being wound down. The second reason is that the alternatives do not accommodate crypto. Great Britain's licensed market has no meaningful crypto-funded operator, Brazil's rules exclude it outright, and Malta's routes for virtual tokens are narrow and little used. An operator wanting to hold customer balances in Bitcoin has very few places to go. The prevalence of Curaçao reflects what is available to that business model, not its quality.

What does a Curaçao licence actually require of an operator?

More than its reputation suggests, and less than most players assume. Under the LOK a licensee must be established in Curaçao with a genuine local presence, must apply anti-money-laundering and counter-terrorist-financing controls — which is where real identity-verification obligations come from — must offer games meeting fairness and random-number-generation standards, and must publish a complaints procedure. The authority can impose conditions, suspend and revoke, and it accepts player complaints directly. What the regime does not do is set commercial terms. There is no requirement to appoint an independent dispute-resolution body, no obligation to disclose whether customer balances are held separately from operating money, no product rules on stake size, spin speed or autoplay, and no national self-exclusion scheme. One practical consequence is worth naming plainly: an operator advertising no-KYC play while displaying a Curaçao licence is advertising non-compliance with the framework it claims to sit under. Read that as information about the operator rather than as a feature being offered to you.

What does Malta's MGA licence add on top?

Malta's regime, run by the Malta Gaming Authority under the Gaming Act 2018, is materially heavier. Business-to-consumer authorisations run for ten years and are granted by game type: Type 1 covers random-number casino games, Type 2 fixed-odds betting, Type 3 peer-to-peer products such as poker, Type 4 controlled skill games. A licence covering sports betting therefore does not automatically cover slots, which is why checking the licence type and not merely its existence matters. Licensees must keep player funds segregated from operating funds, have key function holders individually approved by the authority, submit audited accounts, and appoint an approved alternative dispute-resolution entity a customer can escalate to. The MGA also operates its own player-support function and will consider a complaint once the operator's internal process is exhausted. One caveat matters if you live elsewhere: an amendment to the Gaming Act introduced in 2023, widely referred to as Bill 55, allows Malta to decline to enforce foreign judgments against MGA licensees where they conflict with Maltese gaming law. Winning in your own country's courts does not guarantee Malta will help you collect.

What does a UK Gambling Commission licence protect that others don't?

Great Britain's Gambling Commission is the only regulator of the four that writes rules about the product itself rather than only about the company behind it. Licensees operate under the Licence Conditions and Codes of Practice, which require, among much else, that the operator tell you how your money is held: customer funds are rated as having no protection, medium protection or high protection in an insolvency, and that rating must be disclosed. Note what that is — a disclosure duty, not a guarantee. Credit-card deposits have been banned since April 2020. Autoplay on slots was banned in 2021, alongside a minimum 2.5-second spin cycle and a prohibition on celebratory sounds or graphics for a return no greater than the stake. Participation in GAMSTOP, the national self-exclusion scheme, is mandatory. Stake limits on online slots of five pounds per spin, and two pounds for players aged 18 to 24, came in during 2025. Every licensee must also use a Commission-approved dispute-resolution provider, available to a customer whose complaint is unresolved after eight weeks. Almost none of this reaches a crypto player, because crypto deposits are effectively absent from the British licensed market.

What does Brazil's SPA regime require, and why is it structurally different?

Brazil's is the newest regime and, on identity and payments, the strictest. Law 14.790 of December 2023 created a fixed-odds and online-gaming framework supervised by the Secretaria de Prêmios e Apostas within the Ministry of Finance, with authorised operators trading from January 2025. An authorisation costs thirty million reais, runs five years and covers up to three brands. The licensee must be a company incorporated in Brazil with a Brazilian shareholder holding at least twenty per cent of its capital, and it must operate on a .bet.br domain — which makes verification unusually simple, because a site on any other domain is not authorised in Brazil whatever its footer claims. Funding rules are tight: deposits must come from an account held in the bettor's own name and matched to their CPF, credit cards are not permitted, and cryptocurrency is not an accepted payment method. Operators pay twelve per cent of gross gaming revenue and players pay fifteen per cent income tax on net winnings above the annual exemption band. The structural point is that the licensee is an onshore company, which changes recourse entirely.

What recourse does each licence actually give you when a casino won't pay?

This is where the regimes genuinely diverge, and it is the question worth asking before depositing rather than after. In Curaçao you complain to the operator, then to the Curaçao Gaming Authority, which can investigate and sanction a licensee but has no established mechanism for ordering that you personally be paid; your practical leverage is reputational, which is why public complaint records deserve weight. Under Malta and Great Britain the ladder is longer and more useful: the operator's internal process first, then an independent dispute-resolution body the operator was obliged to appoint, whose decision binds the operator but not you, leaving the courts open afterwards. The two differ on insolvency: Malta requires player funds segregated from operating funds, while Great Britain requires only that the operator disclose which protection level applies, and its lowest tier means none at all. Note the limit that applies everywhere: a regulator's sanction runs against the licence, not as a money judgment in your favour. In Brazil the licensee is a Brazilian company, so a Brazilian player additionally has consumer law, the Procon system and the small-claims courts against an entity holding assets in the country. That is the strongest practical recourse of the four, and it comes from company law rather than gambling rules.

Why does the word 'licensed' on its own tell you so little?

Three reasons. First, the entity. The company named in a licence register is frequently not the company named in the terms you accepted, and white-label arrangements mean the brand you deposited with may be a reseller trading on someone else's authorisation. If the two names do not reconcile, you do not know who owes you. Second, scope. A licence may cover betting and not casino games, or cover a corporate group and not the particular domain you are using; the British and Maltese registers list permitted URLs, so that much can be checked. Third, and most consequential, no regulator on this list prices a bonus. Wagering terms are contract, not regulation, so a fully compliant licensee can attach any multiplier it likes. Of the three crypto casinos whose own archived terms state both a wagering multiplier and the base it applies to, all three sit above break-even at a 4% house edge: BitStarz and mBit at 40× on the bonus alone, and Vavada at 35× on the bonus alone. 7Bit and Mirax publish 35× and KatsuBet 45× without a base, so we leave them unpriced. The arithmetic is set out at break-even table, and bonus calculator runs it on any offer you are looking at.

How much does a fully compliant bonus actually cost you?

Write D for your deposit, m for the match as a fraction, W for the wagering multiplier and h for the house edge as a fraction. The bonus is B = mD. Required turnover is W × B if the wagering applies to the bonus alone, or W × (D + B) if it applies to deposit plus bonus. House edge is the long-run share of everything staked that the game keeps, so the expected cost of clearing is turnover × h, and realistic value is B minus that cost. Setting the two equal gives break-even at W = 1 ÷ h on a bonus-only base, or W = m ÷ (h(1 + m)) on a deposit-plus-bonus base. At a 4% house edge — a 96% RTP slot, which bonus terms usually steer you onto — that is 25× bonus-only and 12.5× on deposit plus bonus at a 100% match. The market standard is 35× to 45×. A £100 deposit with a 100% match at 35× on deposit plus bonus means 35 × £200 = £7,000 of turnover; at 4% that is an expected £280 to clear a £100 bonus, so realistic value is −£180. Every licence discussed here permits that.

How do you check a licence claim against the register rather than the footer?

Never click the badge. A seal in a footer is an image the operator controls, and it commonly links nowhere or to a page on the operator's own domain. Do this instead. Open the terms and conditions and find the licensed company name and licence number — the terms name the contracting entity, and the footer frequently names something else. Then type the regulator's own address into your browser yourself: gamblingcommission.gov.uk for Great Britain, authorisation.mga.org.mt for Malta, gamingauthority.cw for Curaçao, and the Ministry of Finance pages on gov.br for Brazil. Search by company name, not by brand. Check four things on the record you find: that the status is active rather than surrendered, expired or suspended; that the licence type covers casino games and not only betting; that the company name matches the terms you accepted; and, where the register lists permitted URLs as the British and Maltese ones do, that the exact domain you are using appears. If any of the four fails, you have found something the footer was hiding. Finally, save what you found — a dated screenshot, or an Internet Archive capture, which is how we source operator terms ourselves.

What can no licence do for you, on any of these regimes?

A licence is a floor, not insurance, and it is worth being blunt about what stays true under all four. The house edge is lawful and unregulated in size, so a compliant, well-supervised casino remains a business whose expected outcome for you is a loss; a lower edge is a slower loss, not a gain. No regulator guarantees a withdrawal speed. No regulator will refund a bonus forfeited by breaching a maximum-bet clause, because that clause is usually valid and enforceable. And a register entry that was accurate in March can be surrendered by September, so verification is worth repeating rather than remembering. The practical hedge is unglamorous: complete identity verification while your balance is small, withdraw smaller amounts more often instead of parking a large balance, and keep your own dated record of deposits, bonuses accepted and terms in force at the time. Our own ranking at global ranking carries the same limit. The ProvenPayouts Score is a published editorial weighting of public signals — payout reputation 40%, trust and licence 25%, games 20%, support 15% — and the matcher at casino matcher sorts on editorial feature tags. Both are judgements about operators, not measurements, and neither is a warranty.

FAQ