How to Get an Online Betting Licence: Application and Compliance Guide

Choose the licence around the operating plan

The first questions are often “How much does the licence cost?” and “How quickly can it be issued?” Both matter, but neither determines whether the licence supports the business. A low-cost route can become expensive if the intended payment provider, bank, advertising platform or game studio will not accept it. Start with the countries in which players will be accepted, the products offered, the B2C or B2B role, the location of the company and management, banking needs and the full first-year compliance cost.

Curaçao, Anjouan and Malta are not three versions of the same product. They have different legal frameworks, review expectations and commercial acceptance. An offshore or international licence does not automatically authorise activity in every country. Before committing, obtain written confirmation from key payment and content partners and a target-market legal assessment. Flexrix uses this commercial acceptance test before coordinating the technical and documentary work.

• Target and restricted countries
• B2C, B2B and product scope
• Bank, PSP and supplier acceptance
• First-year licensing and compliance cost

Curaçao now operates under the LOK framework

Curaçao’s National Ordinance on Games of Chance, known as the LOK, entered into force on 24 December 2024. The Curaçao Gaming Authority is the regulator for online gaming and applications are submitted through its official portal. The CGA states that an eligible applicant must be a legal entity established under Curaçao law with its statutory seat in Curaçao, alongside applicable local management requirements. The old shorthand of buying a master-licence “sublicence” should not be used to describe the current route.

The file includes corporate and business information, personal history disclosures for relevant individuals, funding and financial evidence, a business plan and operational policies. The regulator examines ownership and key persons as well as the proposed operation. Information about domains, suppliers, AML controls and responsible gaming must agree across the application. A portal registration or a copied seal is not proof of an issued licence; operators should use the regulator’s current verification mechanisms and requirements.

• Curaçao entity and management structure
• Official CGA portal submission
• Corporate and personal disclosures
• Business plan, funding and AML readiness

Assess Anjouan beyond speed and entry cost

Anjouan is frequently considered by early-stage international gaming projects because the route may be more accessible and operationally faster than some alternatives. That does not remove due diligence. The applicant should expect to prepare company and ownership records, business and technical descriptions, provider lists, AML and KYC procedures, responsible-gaming controls and domain information. Document certification, validity periods and corporate substance requirements should be confirmed with the authorised route handling the application.

The decisive work happens before and after the certificate. Confirm whether the licence is accepted by each intended PSP, bank, game supplier and marketing partner, and whether local laws permit the target activity. Restricted markets require effective geo-blocking and operational controls. Do not treat the phrase “international licence” as worldwide permission. Flexrix evaluates this route as part of the entire launch chain; obtaining a document without workable payments or content is not a successful licensing outcome.

• Ownership and management due diligence
• Technical and supplier documentation
• Written PSP and content acceptance
• Restricted-market and geo-blocking plan

Malta requires deeper organisational preparation

The Malta Gaming Authority describes the Gaming Service Licence as the B2C authorisation for offering a gaming service. For remote gaming, eligible Maltese or EU/EEA entities apply electronically through the Licensee Portal and submit the required system documentation and enclosures. The current official page publishes a non-refundable application fee and annual licence fee, but these figures are not the entire budget. Compliance contribution, professional advice, technical review, audit work, staffing and ongoing reporting also need to be modelled.

An MGA application examines more than incorporation documents. Ownership and fitness, financial planning, the operating model, game types, system controls and key functions must form a coherent file. The stronger governance burden can support credibility with regulated-market partners, but it requires appropriate capital and an experienced team. Malta is not automatically right for every new brand; equally, excluding it purely on initial cost can be shortsighted when the long-term plan depends on regulated-market relationships.

• Eligible entity and B2C activity
• Financial projections and resources
• System documentation and technical review
• Key functions and continuing compliance

A licence creates an ongoing compliance programme

Approval is not the end of the project. Changes to ownership, management, domains, critical suppliers, payment arrangements or important systems may require notification or prior approval. Periodic gaming and financial reports, suspicious-transaction procedures, complaints, player-protection records and technical incidents need owners and deadlines. Build a compliance calendar and evidence library before launch; paying an annual fee does not by itself keep an operation compliant.

Marketing and affiliates also sit inside the control environment. Bonus conditions, age targeting, responsible-gaming messages and partner claims must follow the rules of the relevant market. KYC, finance, support and AML teams need a shared escalation path so that unusual payments are not treated as ordinary service tickets. Flexrix can connect licence preparation to platform and operational implementation, but current regulator publications and qualified local legal advice must remain the final authority.

• Regulatory reporting calendar
• Change and incident notifications
• Affiliate and advertising controls
• Periodic policy and risk-assessment review

A workable 90-day roadmap

Use the first 30 days for market validation, legal review, scope, financial modelling and supplier shortlisting. Use days 31–60 for integrations, design, payments and compliance operations. Reserve days 61–90 for end-to-end acceptance tests, training and a controlled soft launch. Licensing and payment dependencies must remain explicit gates.

After launch, review technical failures, deposit acceptance, withdrawal time, KYC completion, support demand, bonus cost and net revenue every day. Growth begins only when the operation can reliably explain these numbers.