How to Verify a Casino Licence — Step-by-Step Checklist 2026 | SINBANCA

Last year, a reader sent me a screenshot of a casino’s footer showing a Malta Gaming Authority logo, a Curaçao eGaming seal, and a UK Gambling Commission badge — all three displayed side by side. The casino held none of these licences. The logos were copied images, the licence numbers were fabricated, and the links behind them led either to the casino’s own «about» page or to dead URLs. It took me less than four minutes to confirm the entire thing was fake. Most players would never think to check.

That gap between displayed credentials and actual licensing status is the single biggest vulnerability in online gambling. The DGOJ blocked 229 portals offering illegal gambling services in 2025, taking down 2,961 individual web pages in the process. Many of those sites displayed licence logos prominently. The problem is not that verification is difficult — it is that most players assume the logos are real without ever clicking through to a regulator’s database. And operators who are willing to run unlicensed know this perfectly well.

What follows is the process I use when evaluating any casino’s licensing claims. It is not theoretical — these are the exact steps, in the exact order, that I walk through every time. Some take thirty seconds. Some require digging into corporate registries and cross-referencing jurisdiction data. The entire process, once you know where to look, takes about fifteen minutes and can save you from depositing money at an operation that has no legal obligation to give it back.

Step 1: Check the DGOJ Licensed Operator Registry

If you are based in Spain or playing at a site that claims Spanish licensing, this is where you start — and for many players, it is where you should stop. The DGOJ maintains a public registry of every operator authorised to offer online gambling in Spain, and checking it is the single most definitive verification step available for the Spanish market.

The registry lists the operator’s legal name, the specific gambling activities they are licensed for (sports betting, casino games, poker, bingo — these are separate authorisations), and the licence number. Spain operates one of the strictest licensing regimes in Europe, requiring operators to hold separate titles for each gambling category. An operator licensed for sports betting is not automatically licensed for casino games. This granularity matters because some operators display a valid DGOJ licence for one activity while offering others without authorisation.

The market served by this registry is substantial. Over 2.1 million active players used regulated platforms in 2025, an 8.33% increase from the previous year. Jorge Hinojosa, Director General of Jdigital, the Spanish online gambling industry association, has emphasised that illegal gambling is not a marginal phenomenon but a real risk for thousands of users who fall outside any guarantee — protecting the player requires reinforcing information and channelling activity toward licensed operators. The registry is the primary tool for that channelling.

What you are looking for is a precise match. The operator name on the casino’s terms and conditions page should match the entity name in the DGOJ registry exactly. The licence number displayed in the footer should correspond to the number listed in the registry for that specific entity and activity. Any discrepancy — a different corporate entity name, a licence number that does not appear, a claimed activity not covered by the licence — is a red flag. Do not accept «close enough.» Legitimate operators display accurate information because they are required to, and because inaccurate display is itself a regulatory violation.

One subtlety worth noting: the DGOJ registry lists the licence holder, which is not always the brand name you see on the website. The brand name you see on the homepage is almost never the legal entity name in the registry. The operating company — typically something like a generic corporate name ending in S.A. or Ltd — is what appears in the regulator’s records. Check the casino’s terms and conditions or «About Us» page for the operating company name, then search for that in the registry. If the casino does not disclose its operating company anywhere on the site, that itself is a significant concern.

Step 2: Validate a Curaçao CGA Licence Number

Curaçao licences have historically been the hardest to verify and the easiest to fake. Before December 2024, the sub-licence system meant that verification required contacting the master licence holder — a private company, not a government body — and hoping they responded. I once waited three weeks for a confirmation email that never came. The LOK reform changed this fundamentally, and the new verification process is both more accessible and more reliable.

Under the LOK framework, which took effect in December 2024 with all old sub-licences expiring in January 2025, every operator must hold a direct licence from the Curaçao Gaming Authority. The CGA now operates as an independent regulatory body with a public-facing verification system. The process is straightforward: locate the licence number on the casino’s website (typically in the footer), navigate to the CGA’s official portal, and search for that number. A valid licence will return the operator’s legal name, licence status, and authorised activities.

The critical distinction post-reform is between operators who successfully transitioned to direct CGA licences and those who did not. The transition deadline was January 2025, and a significant number of operators that previously operated under sub-licences either failed to meet the new requirements or chose not to apply. Some of these operators continue to display old sub-licence numbers or logos referencing the defunct system. If a casino displays a Curaçao licence but references a «sub-licence» or lists a master licence holder rather than the CGA directly, the licence is expired and invalid.

Watch for format inconsistencies. The CGA issues licence numbers in a specific format — if the number displayed on a casino’s site does not match this format, do not assume it is a transcription error. Fabricated licence numbers are common at unlicensed operations, and they are designed to look plausible at a glance. The only way to confirm is to check the CGA database directly. No amount of visual inspection of the number itself can substitute for an actual registry lookup.

Step 3: Confirm Malta MGA and Gibraltar Licences

Malta and Gibraltar operate what I consider the gold standard in licence verification transparency — and they have to, given the scale of their industries. EGBA members collectively hold 321 licences across 21 European countries, with combined gross gaming revenue reaching 13.5 billion euros in 2024. A significant share of those licences are Maltese or Gibraltar-issued, and both jurisdictions make verification accessible.

The Malta Gaming Authority publishes a searchable register of all licence holders on its website. You can search by operator name, brand name, or licence number. The register displays the licence type (B2C for player-facing operations, B2B for platform providers), the status (active, suspended, cancelled), and the authorised activities. MGA licences follow a standardised numbering format: MGA/B2C/XXX/YYYY, where XXX is the licence number and YYYY is the issue year. Any casino claiming an MGA licence should display a number matching this format, and that number should return a result in the MGA’s public register.

Gibraltar’s process is similar but slightly less user-friendly. The Gibraltar Gambling Commissioner publishes a list of licensed operators, though the search functionality is more basic — often a downloadable PDF or a paginated list rather than a dynamic database. The verification principle is the same: locate the operator’s claimed licence details, cross-reference against the regulator’s published records. Gibraltar issues far fewer licences than Malta, maintaining a deliberately high barrier to entry, so the list is shorter and easier to scan manually.

A common deception technique with MGA and Gibraltar licences is status manipulation. An operator might display a licence number that was genuine but has since been suspended or revoked. The number will appear in the regulator’s database, which gives a surface-level appearance of legitimacy, but the status field will show it is no longer active. Always check the status, not just the existence, of the licence. Revoked licences often remain in public databases specifically so that players and other operators can identify formerly-licensed entities.

Step 4: Read Community Signals on Reddit, Trustpilot, and AskGamblers

Registry checks confirm whether a licence exists. Community signals tell you whether the operator behind that licence behaves as if it does. I have seen fully licensed casinos with abysmal player treatment, and I have seen unlicensed operations that — until they disappeared overnight — provided better service than some regulated competitors. Licensing is necessary but not sufficient, and this is where the collective intelligence of player communities becomes genuinely useful.

Reddit’s gambling-related subreddits are noisy, biased, and inconsistent — and despite all that, they remain one of the most valuable early-warning systems available. The key is knowing how to filter. Isolated complaints about a single bad experience carry little weight; players lose money at casinos and some of them blame the casino regardless of fault. What matters is pattern recognition. If multiple unrelated accounts report the same issue — delayed withdrawals, suddenly imposed verification requirements at cashout, changed bonus terms after wagering — over a period of weeks or months, that pattern is a signal. Pay attention to withdrawal complaints specifically. Deposit processes at dodgy casinos work flawlessly because the operator wants your money. The cracks only show when the flow reverses.

Trustpilot reviews for gambling operators require heavy calibration. The platform is susceptible to both fake positive reviews (purchased by operators) and fake negative reviews (placed by competitors). Look at the review velocity: a sudden spike of five-star reviews over a few days, often with similar phrasing, is almost certainly manufactured. Genuine review profiles show a natural distribution over time with varied detail and mixed ratings. A casino with 4.8 stars from 2,000 reviews should raise the same suspicion as one with 1.2 stars — neither pattern occurs naturally.

AskGamblers occupies a different position in the ecosystem. It functions as both a review platform and a dispute resolution intermediary, with a complaint process that requires casinos to respond to player grievances. The resolution rate and response quality visible in AskGamblers’ complaint archives provide a more structured signal than raw reviews. An operator that consistently resolves complaints through AskGamblers’ process is demonstrating accountability. An operator that ignores the process entirely — or that is not listed on AskGamblers at all despite having a visible market presence — is telling you something about how it handles disputes.

Red Flags That Indicate a Fake or Expired Licence

After nine years of reviewing casino sites, I can usually identify a fraudulent operation within the first sixty seconds of landing on the page. Not because I have some special insight, but because fake casinos repeat the same mistakes. They repeat them because the template systems they are built on share the same defaults, and the operators do not care enough — or do not know enough — to customise them beyond the surface level.

The most reliable red flag is the licence display itself. Legitimate casinos link their footer licence logos to the regulator’s verification page — not to their own site, not to a generic informational page, and not to a dead URL. Click the logo. If it leads anywhere other than the regulator’s official domain with your operator’s licence information displayed, the logo is decorative. Some fraudulent sites take this further, creating fake regulator pages hosted on subdomains of their own site — a page styled to look like the MGA’s registry but hosted at mga-verification.casinoname.com instead of mga.org.mt. Check the domain in your browser’s address bar.

Template indicators are another giveaway. Script casinos — sites built on white-label platforms with minimal customisation — share visual elements, terms and conditions text, and even game catalogues. If the terms and conditions page contains placeholder text, references to a different casino name, or clauses that contradict each other, the operator did not write them. They installed a template and did not bother reading what it included. I have found terms pages referencing operators in completely different jurisdictions, deposit limits in currencies the casino does not accept, and withdrawal policies that describe processes the site does not support.

Missing or inconsistent contact information is nearly universal among fraudulent operations. A legitimate licensed casino provides a registered business address, a functional email address linked to the company domain (not a gmail or yahoo account), and usually a phone number or live chat. Check the physical address — does it correspond to a real commercial location? A registered address at a virtual office service is not inherently suspicious, as many legitimate iGaming companies use them, but a residential address in a jurisdiction unrelated to the claimed licence is. No address at all is disqualifying.

Finally, watch for impossible promotional claims. Licensed operators in regulated markets are subject to advertising standards that limit what they can promise. Unlicensed operators face no such constraints, and their promotional language reflects it. Guaranteed winnings, unrealistic return percentages, or bonus terms that sound too generous typically are. The more aggressive the marketing, the less likely the operator is legitimate — because legitimate operators spend their marketing budget of 664.40 million euros (the 2025 figure for the entire Spanish regulated market) within strict advertising guidelines that prohibit exactly this type of language. For a deeper look at how to spot template-based operations specifically, see my guide to detecting script casinos and their characteristic red flags.

Checking Corporate Data: Ownership, Jurisdiction, and Contact Details

Licence verification tells you whether the operator is authorised. Corporate transparency tells you whether the operator is real. These are different questions, and the second one is often more revealing than the first.

Every licensed casino operates through a legal entity — a company registered in a specific jurisdiction with identifiable directors, a corporate structure, and a financial history. This information is available, to varying degrees, through public corporate registries in most jurisdictions. The process starts with the operating company name, which should appear in the casino’s terms and conditions. Search for that entity in the corporate registry of the jurisdiction where it claims to be incorporated. Malta’s Malta Business Registry, Gibraltar’s Companies House equivalent, and Curaçao’s Chamber of Commerce all provide online lookup services.

What you are looking for is consistency. Does the incorporated entity match the name in the licence registry? Is the company’s registration date consistent with the casino’s claimed operating history — a site claiming five years of operation run by a company incorporated six months ago is a concern. Are the directors identifiable individuals with professional histories in iGaming or related industries? Shell company structures are common in online gambling for legitimate tax and liability reasons, but a company with no identifiable directors, no history, and an address that traces to a mailbox service in a third jurisdiction warrants caution.

Ownership chains deserve attention. Many online casinos are operated by subsidiaries of larger groups, and this is normal. What matters is whether the ownership chain is traceable. If the operating company is owned by a holding company in one jurisdiction, which is owned by another holding company in a second jurisdiction, which is owned by a trust in a third — and none of these entities appear in any public registry — the opacity is deliberate. Legitimate operators may have complex structures, but those structures are documented and verifiable through corporate filings. Illegitimate operators use complexity to prevent exactly the kind of tracing you are attempting.

The payment processor is a final corporate indicator worth checking. Licensed operators typically use established, regulated payment providers — companies like Worldpay, Nuvei, or Trustly that have their own compliance obligations. If the casino’s payment page routes through an unknown processor, or if the entity name on your bank statement does not match the casino or any recognisable payment company, the transaction chain includes entities that prefer not to be identified. That preference should concern you as much as a missing licence.

Contenido creado por el equipo de SINBANCA