Online Betting Licence: A Practical Guide to Applying and Staying Compliant

Start from the operating plan, not the licence

Founders usually ask two things first: what the licence costs and how fast it can be granted. Both are fair questions, yet neither tells you whether the licence will actually support the business. A cheap route quickly becomes an expensive one if your chosen payment provider, bank, ad platform or game studio refuses to work with it. Begin instead with the countries you will accept players from, the products you will offer, whether you act as B2C or B2B, where the company and its managers are based, what banking you need and what the whole first year of compliance will cost.

Curaçao, Anjouan and Malta should not be compared as if they were the same product at different prices. Each has its own legal framework, its own level of scrutiny and its own standing with commercial partners. An offshore or international licence never grants automatic permission to operate everywhere. Before you commit, get written confirmation from your key payment and content partners and a legal view on each target market. Spinolf runs this commercial acceptance check before it starts coordinating the technical and documentation work.

• Countries you will target and those you must block
• Your role (B2C or B2B) and product scope
• Acceptance by banks, PSPs and suppliers
• Full first-year licensing and compliance budget

Curaçao: licensing under the LOK framework

The National Ordinance on Games of Chance, or LOK, has applied in Curaçao since 24 December 2024. Online gaming is supervised by the Curaçao Gaming Authority, and applications go through the CGA’s official portal. According to the CGA, the applicant has to be a legal entity incorporated under Curaçao law with its registered seat on the island, and it must meet the applicable local management requirements. Describing this route as buying a “sublicence” under a master licence is outdated and no longer accurate.

An application brings together company and business details, personal history disclosures for the relevant individuals, evidence of funding and finances, a business plan and operating policies. The regulator assesses the owners and key people as well as the planned operation itself. Details on domains, suppliers, AML controls and responsible gaming have to match throughout the file. Registering on the portal or displaying a copied seal does not prove that a licence has been issued; rely on the regulator’s current verification tools and published requirements.

• A Curaçao company with a compliant management structure
• Submission through the official CGA portal
• Corporate and personal disclosures
• Business plan, proof of funding and AML readiness

Anjouan: look past speed and low entry cost

Early-stage international projects often consider Anjouan because the process can be more accessible and quicker to complete than some alternatives. Due diligence still applies. Expect to provide company and ownership records, a description of the business and its technology, a list of providers, AML and KYC procedures, responsible-gaming controls and domain details. Check document certification, how long documents remain valid and any corporate substance requirements with the authorised channel that handles the application.

What happens before and after the certificate matters most. Check that every planned PSP, bank, game supplier and marketing partner accepts the licence, and that local law allows the activity in each target country. Restricted markets need working geo-blocking and operational controls. An “international licence” is not permission to operate worldwide. Spinolf assesses this route as one link in the full launch chain: a certificate without usable payments or content does not count as a successful licensing result.

• Due diligence on owners and management
• Technical and supplier documentation
• Written acceptance from PSPs and content providers
• Plan for restricted markets and geo-blocking

Malta: a heavier organisational commitment

The Malta Gaming Authority defines the Gaming Service Licence as the B2C authorisation needed to offer a gaming service. For remote gaming, eligible entities established in Malta or the EU/EEA apply online through the Licensee Portal and upload the required system documentation and supporting files. The MGA’s official page lists a non-refundable application fee and an annual licence fee, but those amounts are only part of the budget. You also need to model the compliance contribution, professional fees, technical review, audits, staffing and ongoing reporting.

The MGA looks well beyond incorporation papers. Ownership and fitness and propriety, financial planning, the operating model, game types, system controls and key functions all have to fit together as one consistent file. The heavier governance load can strengthen credibility with partners in regulated markets, but it calls for adequate capital and an experienced team. Malta is not the default choice for every new brand; at the same time, ruling it out on upfront cost alone can be a mistake when the long-term plan relies on regulated-market partnerships.

• An eligible entity carrying out B2C activity
• Financial forecasts and available resources
• System documentation and technical review
• Key function holders and ongoing compliance

Holding a licence means running a compliance programme

Approval marks the start of supervision, not the end of the project. Changes in ownership, management, domains, critical suppliers, payment set-up or key systems can require notifying the regulator or obtaining approval in advance. Regular gaming and financial reports, suspicious-transaction handling, complaints, player-protection records and technical incidents all need a named owner and a deadline. Set up a compliance calendar and an evidence library before going live; paying the annual fee alone does not keep the operation compliant.

Marketing and affiliates fall within the same control framework. Bonus terms, age targeting, responsible-gaming messaging and partner claims have to follow the rules of each market. KYC, finance, support and AML teams need one shared escalation route so that unusual payments are not handled like routine support tickets. Spinolf can link licence preparation with platform and operational delivery, but current regulator publications and qualified local legal advice always have the final word.

• A calendar of regulatory reporting
• Notifications for changes and incidents
• Controls over affiliates and advertising
• Regular review of policies and risk assessments

A realistic 90-day plan

Spend days 1–30 on market validation, legal review, scoping, financial modelling and a supplier shortlist. Use days 31–60 for integrations, design, payments and setting up compliance operations. Keep days 61–90 for end-to-end acceptance testing, team training and a controlled soft launch, with licensing and payment dependencies treated as explicit go/no-go gates.

Once live, check technical errors, deposit approval rates, withdrawal times, KYC completion, support volume, bonus cost and net revenue every day. Scale only when the team can explain these figures with confidence.