A Developer’s Guide to Gambling Regulations on the Web

Last updated: 2026-05-22 — This article is for information only and is not legal advice.

We push a payments hotfix on Friday. The feature works in staging. On Monday, the release stalls. Why? The KYC flow is not live for one state. Geo rules block the wrong ZIP codes. Risk sends a note about sanction checks. The cost of a bad call here is not just a bug; it can be fines, license risk, and frozen funds. This guide is the fast path for devs who ship in this space.

Stop. Before You Ship: The Two Questions Regulators Will Ask First

In most markets, the first two questions sound like this: “Who is your license holder, and where do you operate?” and “How do you block minors and barred users?” If you cannot answer both with clear, testable facts, you are not ready. Keep a short page in your repo with the license scope, the live regions, and the age and geo rules. If you need a quick list of regulators by country, see the global regulator directory. It helps you name the right body in each place.

A Map, Not a Monolith: Which Laws Touch Your Stack

Online gambling law is a set of layers, not one big rule. These layers hit code and process in different ways:

Licensing: who may offer games and where.
AML/KYC: how you know the user and watch money flows.
Payments and sanctions: which providers you use and who you must block.
Ads and affiliates: who you may target and how you label promos.
Privacy: data use, consent, and user rights.
Tech standards: security, RNG, logs, and uptime duties.
App stores: rules from Apple and Google for sensitive content.

In the U.S., two federal laws frame the space. Read the Wire Act and the Unlawful Internet Gambling Enforcement Act (UIGEA). Then, each state adds its own rules. Most other regions work by country or province.

Decisions to Lock Early: Licensing, Hosting, Payments

Lock a few choices early so you do not rework your base:

License home: Your legal team picks place and scope. As a model, see the Malta Gaming Authority licensing page. It shows how classes and roles work.
Hosting and logs: Some regions need data in-region. Plan log shards per market. Tag every log with market and data class.
Payments: Many PSPs mark gambling as “high risk.” Their rules change often. Check a vendor’s list like Stripe restricted businesses before you build a whole flow on top of it.

These calls shape your infra, your data model, and your rollout plan. Change them late, and you lose weeks.

Friction by Design: Age, KYC, and Geo Controls That Don’t Kill UX

Age and ID checks need not break the funnel. Use steps and clear copy. Ask for just what you need now, and the rest when needed.

Age gate first. If market rules need hard proof up front, follow that. See the UK rules on age and ID checks.
Geo rules should be strict, not brittle. Do not trust IP alone in strict states. Add Wi‑Fi data, GPS (if app), and user consent. New Jersey’s DGE has strong tech notes; see the DGE site.
Clear errors. Say why you block and what to do next. Never leak PII in errors.

Design for “happy path” and “safe path.” If a check fails, park the user with clear next steps, not a dead end.

Money In, Money Out: AML, Sanctions, and Chargeback Traps

Every cash flow is a risk surface. Set rules in code, not just in a PDF.

AML program: build KYC tiers, source‑of‑fund checks, and alerts. See the FinCEN AML program pages for core parts.
CDD/KYC: the gold rule is “Know Your Customer.” FATF sets global lines; read FATF Recommendation 10.
Sanctions: check names and payments against lists. Cache results with TTL. Log the list version and match score.
Chargebacks: expect a spike with bonuses. Cap risky payment types. Add 3‑D Secure where it helps.

Make it repeatable: one flow for “deposit,” one for “withdraw,” both with the same audit trail and clear caps per user tier.

Your Users’ Data Is Not Chips: GDPR/CCPA in Plain English for Devs

Privacy rules are strict and fine‑heavy. For the EU, start with GDPR basics. For the UK, read ICO guides like cookies and similar tech. For U.S. states, map CCPA/CPRA and others.

Minimize: store only what you need for law and ops. Set TTLs per data class.
Lawful basis: track why you keep each field. Add a tag in code, not just docs.
Consent logs: store consent events with version, scope, and device.
DPIA: do a data impact check for new risky features. Save the record.
Region stores: when needed, keep EU data in the EU and so on.

Marketing Landmines: Ads, Affiliates, and App Stores

Ads in this space have many hard limits. Check rules before you launch a spend. In the UK, see the ASA CAP Code for gambling. For online ads, read the Google Ads policy for gambling and games. You must age‑gate pages, label promos, and exclude minors. Affiliates must use clear labels and follow local laws. App stores ban many forms; read store rules and local law side by side before you build a native flow.

Field Guide: 6 Jurisdictions in One Glance

The table below is a snapshot. It is not legal advice. Rules change. Always check the source before you ship.

Yes, if licensed by UKGC	Remote gambling license	18+	Strong ID before play; PEP/sanction checks	Strict rules; no appeal to minors; strong safer‑gambling labels	Remote Technical Standards (RTS) apply	Card rules apply; some payment types restricted
Yes, if licensed; but local bans in some EU states	MGA B2C/B2B classes	18+	Risk‑based KYC; EU AMLD rules	Vary by target country; national ad bans exist	Audit and RNG certs common	PSD2/3‑DS for cards; bank rules vary
State by state only	State license (e.g., NJ DGE)	21+ in most states	BSA/FinCEN standards; strict geofence	Heavy ad limits; no minors; clear terms	State tech rules; strong geo proof	UIGEA impacts payment processors
Yes in Ontario if registered with AGCO/iGO	Registration + agreements	19+	Risk‑based KYC; record keeping	Ad content and bonus rules set by AGCO	Registrar’s Standards for iGaming	Local payment rules; strong disclosure
Very limited; many online casino forms banned	Approvals vary by product	18+	AML via AUSTRAC rules	Strict ad limits; no inducements	Enforcement on illegal offshore services	Payment blocking orders possible
New model; can license under GCB	New direct licenses; sub‑license reforms	18+	KYC and AML rules apply via license terms	Ad rules depend on target markets	Security and RNG cert norms	Processor risk appetite varies
Evolving rules; new federal framework	New licensing under rollout	18+	KYC and local risk controls expected	Ad must avoid minors; clear warnings	Details in flux	Banks cautious until rules settle

Sources for this table: UK Remote Technical Standards; New Jersey DGE regulations; AGCO Registrar’s Standards (Ontario); ACMA interactive gambling; Curaçao Gaming Control Board.

Disclaimer: This table is a high‑level view. It may be incomplete. Always check local law and seek legal advice.

Postmortems You Can Learn From

Three real failure modes show up a lot:

Geo drift: IP‑only checks let VPN users in. Fix: use multi‑signal geo for strict markets and test edge ZIPs near borders.
Bonus mismatch: promo T&Cs do not fit local ad rules. Fix: render terms by market and version; store a hash of the text shown.
Stale logs: KYC logs expire or lack list versions. Fix: log the check time, provider, list version, and match score. Pin log TTL to law, not to infra defaults.

To see how regulators act on gaps, scan the UKGC enforcement news. It gives useful patterns of what not to do.

Compliance as Code: Policies, Tests, and Kill Switches

Do not leave rules in a PDF. Put them in code and tests. Use a policy engine so product and legal can edit rules without a full deploy. Open Policy Agent is one option. Map each control to a test and a toggle.

Have a kill switch for each risky feature by market. A rule fails? Flip the flag, not the whole app.

Ship It Safely: A Release Playbook for Regulated Features

Use a short, sharp checklist before you go live:

Scope: list markets in and out for this release.
Threat model: age, geo, AML, privacy, payments.
Logs: sample 30 events for KYC, consent, and deposits. Verify fields and TTLs.
Fallbacks: safe path if a provider is down (KYC, geo, PSP).
Kill switches: test flags per market and per feature.
Rollout: canary by region; watch alerts.
PCI: if card data touches you, check the PCI DSS basics and segment systems.

When You Actually Need a Lawyer (and How to Budget for One)

Call a lawyer when you:

Enter a new country, state, or province.
Add a new game type or bet type.
Touch crypto, tokens, or on‑chain rails.
Change bonus rules in a strict market.

Pick counsel with real iGaming time on product work. The IMGL directory is a good start. Budget for a quick scoping call, then a fixed‑fee memo on the parts that hit code.

Where to Learn from Real Products (and How to Benchmark UX Legally)

Watch how licensed sites show odds, set deposit caps, and place safer‑gambling links. Do not copy dark patterns. Study what is clear and lawful. For market research in Sweden, one place to see how operators present core facts is this curated hub: bästa online casinon i Sverige (best online casinos in Sweden). Note: affiliate sites must use clear labels and follow local ad rules. Please promote responsible play at all times.

FAQ for Builders

Q: Can we rely on IP for geolocation?

A: Not in strict states. Add GPS (app), Wi‑Fi, and network checks. Cache proof with time and method.

Q: Can we take crypto?

A: High risk. Many licenses or PSPs do not allow it. If allowed, expect enhanced KYC and chain analysis.

Q: What about VPN users?

A: Detect and block where law needs hard borders. Combine IP intel and device signals. Explain blocks in plain text.

Q: How long do we keep KYC data?

A: It depends on law. Set per‑field TTLs by market and purpose. Document the basis and automate deletes.

Q: Can we run the same bonus in all markets?

A: Rarely. Terms and ads rules differ. Render by market. Log the exact terms shown.

Q: Where can I see a quick map of U.S. states?

A: The AGA state gaming map is a good start. Always confirm with state law.

Resources and Credits

FATF risk‑based approach for casinos
EDPB guidelines index
International Association of Gaming Regulators directory
GDPR for developers
PCI Security Standards Council
AGCO iGaming standards (Ontario)
New Jersey DGE regulations

Author: Alex Morgan, Senior Web Engineer and Compliance Engineer. Built and shipped regulated fintech and iGaming features since 2015. Reviewed for accuracy on 2026‑05‑22.

Accessibility and QA notes: All links open in a new tab. Table includes caption and header scopes. Please add alt text to any images you include (e.g., “KYC flow diagram,” “Geo rules matrix”).