iGaming Regulations 2026: A Global Guide to Licensing, Tax, and Compliance

In 2026, iGaming rules are written market by market, and no two regulators agree on what a compliant platform looks like. European taxes on gross gambling revenue (GGR) now reach 37.8% in the Netherlands and 40% in Britain, while Germany taxes stakes instead. Brazil and Peru opened licensed markets as Mexico raised its levy to 50%. Most of Asia stays closed, Africa is licensing through new national and state regimes, and the United States still leaves authorization to individual states.

Tighter oversight is the common thread across the iGaming industry. Regulators now expect a platform to prove that stake caps, deposit limits, and exclusion checks fired before a bet was accepted, not after. NuxGame supports market entrants through iGaming legal services covering license preparation, jurisdiction mapping, and platform configuration against local certification and reporting rules.

Key Takeaways

1. 01

   There is no global licence: Italy, Brazil, Alberta, and every US state each require their own approval, so iGaming operators still enter market by market.

2. 02

   Tax is the biggest variable: 22% of GGR in Sweden, 37.8% in the Netherlands, 40% in Britain, 50% in Mexico, and 5.3% of stakes in Germany.

3. 03

   Central state systems are spreading, from Brazil's SIGAP to national exclusion registers in Spain, Sweden, and Australia.

4. 04

   Brazil, Alberta, and Kenya opened new regimes in 2025–2026, while India banned online money games.

5. 05

   PCI DSS v4.0.1 has been fully mandatory since March 31, 2025, in every jurisdiction.

Where Online Gambling Is Legal: The 2026 Global Regulatory Map

Legal online gambling now exists across most of Europe, much of the Americas, parts of Africa, and only a handful of Asia-Pacific jurisdictions. Regulations vary most in three places: how tax is calculated, which products are licensable, and how much of the player journey the state monitors directly. The table compares thirteen representative markets.

Market	Regulator	Tax basis and rate	Structural constraint
United Kingdom	Gambling Commission	40% Remote Gaming Duty on profits since April 2026	£5 slot stake cap, £2 for ages 18–24; GAMSTOP
Germany	GGL	5.3% of stakes on slots, poker, and sports	€1,000 cross-operator deposit cap; state monitoring systems
Netherlands	KSA	37.8% of gross gaming result since January 2026	CRUKS register; untargeted ads banned
Italy	ADM	24.5–25.5% of GGR plus a 3% annual fee	€7m nine-year concession; one domain per licence
Sweden	Spelinspektionen	22% of GGR	Spelpaus register; one welcome bonus per player
Malta	MGA	5% on Maltese-player GGR; 15% or 10% from October 1, 2026	Hub licence; no access to ring-fenced markets
Canada (Ontario, Alberta)	AGCO with iGO; AGLC with AiGC	20% revenue share	Commercial agreement with a provincial Crown agency
United States	NJ Division of Gaming Enforcement, Michigan Gaming Control Board, other states	15% (West Virginia) to 62.45% on slots (Rhode Island)	Slots and tables online in seven states; land-based or tribal tether
Brazil	SPA, Ministry of Finance	13% of GGR in 2026, rising to 15% by 2028	Local entity; R$30m licence; SIGAP reporting
Mexico	SEGOB	50% IEPS on GGR since January 2026	Permits held by local entities; offshore sites taxed and blockable
Philippines	PAGCOR	GGR share by product, e.g. 15% on live sports markets	Offshore licences banned; e-wallet links removed
Australia	ACMA and state regulators	State point-of-consumption taxes	Slots and table games banned online; sports and racing bets only; BetStop
Kenya	Gambling Regulatory Authority	5% excise on deposits	30% Kenyan shareholding; local bank account

Europe: National Licences, Central Registers, and Rising Taxes

Europe has no single gambling regulation. The EU leaves the sector to member states, so an operator licensed in one country gains no right to serve players in another that runs its own regime. Every major market now ring-fences its players behind a national licence, a national exclusion register, and, increasingly, a higher tax.

Britain remains the reference model. The UK Gambling Commission issues one set of technical requirements for the whole UK gambling market under the Gambling Act 2005, and every online licensee must connect to GAMSTOP. Slot stakes are capped per game cycle at £5 for players aged 25 and over and £2 for those aged 18 to 24. Remote Gaming Duty rose from 21% to 40% on April 1, 2026, and a new 25% rate for most online sportsbook profits follows from April 2027.

Germany is the most technically restrictive large market: a €1,000 monthly deposit limit across all licensees, a €1 default slot stake, a 5.3% tax on stakes rather than revenue, and mandatory integration with state monitoring systems. Since July 1, 2026, eligible players can stake up to €3 or €5 per spin until the end of 2027, while online table games and land-based casino gaming stay with the individual states. Our German market guide covers that regime in detail. The Netherlands raised its rate to 37.8% of GGR in January 2026, and the trade body VNLOK reports that online tax receipts fell in 2025 despite the earlier increase.

Southern Europe tightened entry instead. Italy reset its market in November 2025 with 52 nine-year concessions held by 46 operators, each costing €7 million and limited to one domain, with player registration through the SPID digital identity or the electronic ID card. Spain licenses through the DGOJ at 20% of GGR under some of Europe’s strictest advertising rules, and France still bans online slots and table games, allowing only sports betting, horse racing, and poker. In the Nordics, Sweden taxes 22% of GGR and allows only one welcome bonus per player, Denmark sits at 28%, and both run mandatory national exclusion registers.

The Americas: US States, Canadian Provinces, and Latin America’s New Markets

United States: Federal Statutes, State Authority, and Tribal Gaming

There is no federal licence, and iGaming is regulated state by state. Seven states run live online casino gaming: Connecticut, Delaware, Michigan, New Jersey, Pennsylvania, Rhode Island, and West Virginia. Nevada permits internet gaming for poker only, and Maine authorized a tribal-exclusive market in January 2026, but rulemaking is unfinished and a commercial casino lawsuit is pending. Online sports betting reaches roughly 30 states and Washington, DC, yet no additional state moved to legalize online gambling in the 2026 sessions. The Pennsylvania Gaming Control Board reported $7.01 billion in fiscal 2025/26 gaming revenue, fantasy sports contests included.

Four federal statutes constrain conduct while leaving authorization to the states. The Wire Act restricts interstate transmission of bets, the Unlawful Internet Gambling Enforcement Act pushes duties onto banks, and the Indian Gaming Regulatory Act governs tribal compacts and gaming activities on trust land. The Professional and Amateur Sports Protection Act fell in 2018, after which sports wagering spread far faster than casino play. In New Jersey, the Casino Control Act ties every internet permit to an Atlantic City property.

Federal tax rules moved faster than online gambling laws this year. Since January 1, 2026, deductible gambling losses are capped at 90% of winnings, and the W-2G slot threshold rose from $1,200 to $2,000, its first update since 1977. Roughly eleven states moved against sweepstakes brands across 2025 and 2026, treating dual-currency play as gambling activities rather than promotion, and California’s AB 831 extends liability from sweepstakes casino software vendors to processors and affiliates. Several of these laws and regulations reach the whole supply chain. Prediction markets are reshaping the online gambling industry faster than any statute, and the American Gaming Association’s State of the States 2026 review of commercial gaming estimates over $500 million in diverted tax revenue. Build plans start from current US online casino regulations, because every build must satisfy state regulations that differ on tax, tethering, and vendor licensing:

• Traffic and settlement must terminate inside the licensed state.
• Tribal compacts dictate server siting and revenue-share reporting formats.
• Mobile sports products inherit the same interstate routing limits as gaming ones.

Canada: The Ontario Model Spreads to Alberta

Canada regulates through the provinces. Ontario pairs a regulator, the Alcohol and Gaming Commission of Ontario, with a Crown agency, iGaming Ontario, that signs a commercial agreement with each operator for a 20% revenue share. Alberta copied that structure and became the second province with a legal online market for private operators on July 13, 2026: AGLC regulates, the Alberta iGaming Corporation contracts, the province keeps 20% of net revenue, and a centralized self-exclusion system was live from day one.

Latin America: Brazil, Mexico, and a Growing List of Licensed Markets

Brazil opened its federal market on January 1, 2025, under Law 14.790/2023. A licence costs R$30 million for five years and up to three brands, operators need a Brazilian entity and a .bet.br domain, credit cards and crypto are banned for deposits, and the GGR tax rises from 13% in 2026 to 15% by 2028. Mexico still runs on a 1947 law with permits issued by SEGOB, but raised its federal IEPS levy from 30% to 50% of GGR on January 1, 2026, and extended it to offshore operators serving Mexican players.

Elsewhere, Peru has licensed both verticals online through MINCETUR since February 2024 under Law 31557, at 12% of net revenue. Colombia pioneered regional licensing through Coljuegos, Argentina regulates province by province, and Chile’s Supreme Court ordered unlicensed sites blocked in 2025 while a licensing bill works through the Senate.

Asia-Pacific, the Middle East, and Africa: Closed Markets and New Regimes

Asia-Pacific and the Middle East

Most of Asia-Pacific remains closed to real-money online play. India’s Promotion and Regulation of Online Gaming Act 2025 bans online money games outright, including fantasy and skill formats that operated for years, and bars banks and payment apps from processing them. Australia’s federal law prohibits online slots and table games while licensing sports and racing betting, runs the BetStop national self-exclusion register, and banned credit cards for online betting in 2024. The Philippines is the regional exception: the Philippine Amusement and Gaming Corporation (PAGCOR) licenses domestic operators, but offshore licences are now banned by statute, and the central bank ordered e-wallets to delink from gambling apps in August 2025.

New Zealand is moving the other way. Its 2026 legislation caps casino-style play online at 15 licences, auctioned during 2026 for a launch in early 2027, while TAB NZ keeps the online sports and racing monopoly it gained in 2025. In the Middle East, the UAE’s federal gaming regulator, the GCGRA, has licensed a national lottery and a resort casino project, but no open online market.

Africa

Africa’s iGaming laws are being rewritten faster than any other region’s, mostly around mobile-first sports betting. Kenya’s 2025 gambling law replaced the Betting Control and Licensing Board with a new Gambling Regulatory Authority, opened its first licensing cycle in July 2026, and requires 30% Kenyan shareholding and a local bank account. Nigeria’s Supreme Court ruled in November 2024 that the federal lottery regulator’s reach ends at the Federal Capital Territory, leaving states such as Lagos to license and tax operators. South Africa licenses online sportsbooks through its provinces but has not yet licensed slots or table games online.

Licensing Hubs and Why Approvals Do Not Transfer Between Markets

A licence from the Malta Gaming Authority remains the closest thing to a multi-market passport, and Malta’s own tax on Maltese-resident players moves from a flat 5% to 15% for Type 1 and 10% for other game types on October 1, 2026. Curaçao replaced its master-licence model with direct licences under the National Ordinance on Games of Chance, in force since December 24, 2024, while the Isle of Man, Anjouan, and Kahnawake serve operators targeting markets without local regimes. None of these licences opens a ring-fenced market: Italy, Brazil, Alberta, and every US state require their own approval, and most certify each game, the platform, and the vendors behind it against local gaming regulations.

Timelines follow the slowest vendor in the chain, not the operator. Laboratories run several hundred test cases across game logic, RNG statistics, reporting, and security before a market addendum opens, and some regulators, such as Germany’s GGL and Sweden’s Spelinspektionen, also approve individual titles or suppliers. Incomplete disclosure and weak integration with state systems stall more files than anything else, so operators planning three launches should stagger them rather than run them in parallel.

Centralized Monitoring and Local Enforcement

The biggest technical shift of the decade is that regulators no longer wait for reports. A growing list of markets runs state systems that sit inside the player journey: exclusion registers queried at registration and login, cross-operator limit files, and real-time data feeds the regulator reads directly. For iGaming platforms, a missing integration means no launch, not a fine.

Market	State system	What it enforces	When the platform calls it
Brazil	SIGAP	Register of prohibited persons, centralized self-exclusion, bet reporting	Registration, first daily login, every 15 days
Germany	OASIS, LUGAS, Safe-Server	Exclusion, cross-operator deposit limit, parallel-play ban, regulator data vault	Registration, login, every deposit
United Kingdom	GAMSTOP	National online self-exclusion	Registration and repeat checks
Netherlands	CRUKS	Central exclusion register	Registration and login
Spain	RGIAJ	National exclusion register	Registration and ongoing checks
Sweden	Spelpaus	National self-exclusion	Registration and login
Italy	ADM central system	Account registration and real-time data transmission	Every account and game event
Australia	BetStop	National self-exclusion for online wagering	Registration and account activity

Designing for this means building the pre-bet path around external calls, each with a latency budget and a defined failure mode.

What a multi-market platform has to do before the first wager:

• Query each market’s exclusion register at the points it specifies, and block play on any hit across all iGaming sites the operator runs.
• Check cross-operator limit files before a deposit, never after settlement.
• Stream transactions to regulator systems such as SIGAP or a German Safe-Server in the format each one specifies.
• Apply stake caps, such as €1–€5 in Germany and £2–£5 in Britain, at the game server, not in the client.
• Refuse play when a state system does not answer, rather than failing open.

NuxGame scopes these integrations during jurisdiction configuration: register lookups and limit files are mapped into the wallet and session services, stake caps into game-server rules, and regulator feeds into the same event store the platform uses for its own audit trail. At the casino API layer, catalogue filtering removes products a market does not license, such as jackpots in Germany or slots in France, before a session opens.

Tax Models and Margin: GGR, Turnover, and Deposit Taxes

Tax design now decides market viability more than licence cost. Most regulators tax GGR, at rates from 12% in Peru and 13% in Brazil to 37.8% in the Netherlands, 40% in Britain, and 50% in Mexico. Germany taxes turnover instead: 5.3% of every stake on slots, poker, and sports betting, which takes about half of GGR at 90% RTP and more than all of it at 95%. Kenya taxes deposits at 5%, and US states range from 15% in West Virginia to more than 50% on slots in Pennsylvania, Delaware, and Rhode Island.

Margin optimization therefore starts in product configuration, not the finance department. The practical levers:

• Certify market-specific RTP variants where tax falls on stakes, and route sessions only to those builds.
• Accrue tax per transaction in the ledger, so margin by market, game, and provider is visible daily rather than at the monthly return.
• Rebuild bonus economics per market, because playthrough terms that work under a GGR tax multiply the taxable base under a turnover tax.
• Make it configurable who carries a stake or deposit tax, since some operators price it into odds while others deduct it from winnings.

None of this reduces the tax owed; it keeps a correctly taxed operation profitable. Tax, RTP, and product logic belong in one configuration layer, because a change to one silently changes the economics of the others.

Geolocation, RNG Validation, and Game Event Logging

GLI-19 covers interactive gaming systems; GLI-33 covers event wagering systems. The two use different test protocols, so a casino certificate does not clear a sportsbook platform. Markets layer their own requirements on top, so betting and iGaming platforms carrying both verticals absorb that cost twice. Sequencing both tracks is a product decision with schedule consequences.

Geolocation granularity differs too. European regulators geofence at national level, Canada and Argentina at provincial level, and US states such as New Jersey require location detection at login and at the interval named in the approved submission, with out-of-boundary stakes refused rather than queued. Because those checks sit ahead of the game call, a slow provider response degrades conversion at peak concurrency. Latency budgets belong in the compliance design of gaming operations, not only in load testing.

RNG Certification and Audit Trail Retention

Certified outcomes are the evidentiary basis for fair gaming practices. Every significant event is written to an immutable log that regulators can reconstruct, and markets with central systems expect the same events in their own feeds. Any change to casino games, paytables, or the wallet interface triggers change-control classification and, often, resubmission before deployment, because auditors review gaming practices against the certified build.

Enforcement Pressure in 2026: Black Markets and Blocking Orders

Regulators everywhere are fighting the same leak. The European Casino Association estimates that black-market play aimed at EU consumers reached €91.6 billion in 2025. The responses differ by tool: internet blocking in Chile and Germany, payment blocking in India and the Philippines, and tax-driven site blocking in Mexico for offshore operators that do not pay. Other markets are testing how far tax and regulation can tighten before players who gamble offshore stop coming back.

Nobody agrees on the size of the problem. Germany’s regulator puts the share of legal gambling at 77% while operator groups argue it is closer to 50%, Alberta estimated that unregulated sites held about 70% of its market before launch, and PAGCOR has said that only about 40% of the online providers reaching Filipino players are licensed. Regulators still insist that consumer protection cannot be traded away because illegal gambling sites ignore the rules.

Supply-chain consequences for B2B vendors:

• Geoblocking has to hold at the granularity each market demands: national, provincial, or state-level.
• Market exits and bans have taken effect within days, so account-closure runbooks matter.
• Affiliate lists and paid media for gambling sites need the same refresh cycle.
• Contracts should name who absorbs the cost of a forced market exit.

Payment Routing, AML, and PCI DSS v4.0.1 Obligations

Every 2026 assessment of online gambling platforms runs against PCI DSS v4.0.1, and the previously future-dated controls became mandatory on March 31, 2025. The standard expects a justified inventory of payment-page scripts, tamper detection, phishing-resistant authentication into the cardholder data environment, and authenticated scanning. Payment rules add a local layer: Britain and Australia ban credit cards for gambling, Brazil bans credit cards and crypto, and Kenya requires a local bank account for player funds.

Anti-money-laundering duties vary by market but converge on one data model. The EU’s single AML rulebook, applicable from July 2027, lists gambling operators among covered firms; Brazilian licensees report to the COAF financial intelligence unit; and US firms offering gambling services file currency transaction and suspicious activity reports under the Bank Secrecy Act, with card payments carrying MCC 7995 coding. Deposit, withdrawal, and gameplay data therefore belong in one queryable store, because structuring spread across several rails is invisible when each rail is monitored alone. The AML and KYC tooling from NuxGame binds verification, exclusion status, and account state into a single player record, and rule tuning against false positives is a standing cost of regulatory compliance.

Responsible Gaming Practices Built Into the Wallet Layer

Deposit, loss, and time limits are enforced server-side at the wallet, never in the interface. A limit a player can bypass by switching devices is an audit finding, not a feature. Regulators are also moving limits across operators: Germany caps deposits at €1,000 a month across all licensees, Spain is drafting a similar cross-operator system, and since February 2026 Brazil has required operators to offer responsible gambling limits at registration. Responsible gaming controls, cooling-off periods, and closure requests need identical authority across casino, poker, and sportsbook balances inside one account.

Controls that regulators test in practice:

• Reductions to a limit apply at once; increases wait out a delay.
• Exclusion states survive logout, reinstall, and device change.
• Reality-check intervals and stake caps are configurable per jurisdiction and per player tier, not per brand.
• Bonus terms and ad creative are screened against local laws before release.

Gaming operators serving several markets reconcile competing rulebooks, so international laws offer reference points rather than shortcuts. Problem gambling funding is now a standard line item across the gaming industry, and gambling addiction screening is moving into law through algorithm-based early detection, which Germany already mandates and Spain’s DGOJ is developing.

Technical Snapshot: Compliance Checkpoints Before Launch

Read this as a working guide to iGaming launch sequencing across jurisdictions. Teams that comply with these regulations early avoid the resubmission loop that dominates first entries into a new regulatory environment.

Checkpoint	What the regulator verifies	Where it lives	Typical failure
Market access	Local entity, land-based tether, or commercial agreement	Commercial, pre-technical	Product outside licensable scope, such as slots in France
Vendor registration	Every supplier touching funds or play	Third-party integrations	Unregistered game provider or geolocation vendor
Certification	GLI-19 or GLI-33 plus market addenda and title approvals	Game server, wallet, reporting	Sportsbook assumed covered
State-system integration	Exclusion registers, limit files, and regulator data feeds	Session, cashier, event store	Fail-open handling when a state API times out
Stake and deposit limits	Per-market caps and cross-operator ceilings	Game server and wallet	Limits enforced in the client only
Tax configuration	GGR, stake, or deposit base per market	Ledger and reporting	One tax model applied everywhere
RNG and logging	Certified outcomes, reconstructable events	Game engine, event store	Uncontrolled change in production
Payments	PCI DSS v4.0.1 scope, AML reporting, local method bans	Cashier, ledger, monitoring	Siloed monitoring per rail

Closing the Gap Between Legal Approval and Technical Readiness

Legal compliance and technical readiness are separate milestones, and 2026 widened the distance between them. A jurisdiction can authorize online gaming and still sit a year away from its first accepted stake, as Maine shows, and a licence in Brazil or Italy earns nothing until the state-system integrations pass testing. Operators who treat the rulebook as an engineering backlog get online gambling operations to revenue sooner.

Sequence the compliance path before the commercial one. Map which markets you can enter, model each tax base against your product mix, then confirm vendor registrations and state-system integrations. That sequence removes most surprises in an iGaming market where stringent regulations, not demand, set the launch date.

If you are scoping a multi-market entry or restructuring an existing iGaming business, the NuxGame team can help with license routes, certification sequencing, and gaming services configuration per market. Start with the turnkey casino solution overview, or book a consultation with your target markets in hand.