Crypto Casino: Licensing, Penalties and the Real Cost of Compliance

A crypto casino accepts deposits and pays withdrawals in Bitcoin, Ethereum, USDT or other digital tokens instead of pounds and euros. In the UK, operating one without a Gambling Commission licence is a criminal offence, and the financial penalties attached to that decision now run into eight figures.

What a Crypto Casino Actually Is

How does a crypto casino differ from a normal online casino?

A crypto casino runs the same slots, live tables and crash games you find anywhere else, but the wallet layer changes. Balances are held in tokens, settlement happens on-chain, and the operator's bank statements never show a payment to NetEnt or Evolution. Functionally identical, financially different.

The game catalogue rarely differs. Pragmatic Play, Hacksaw, Microgaming and NetEnt supply the same titles to both formats, and the RTP figures printed on the reels are identical whether you stake in ETH or in GBP. What changes is the ledger underneath, and that is where regulators concentrate their attention.

Two sub-types exist in practice. A pure crypto-only site takes no fiat at all. A hybrid site accepts cards and bank transfers alongside tokens, which usually means it holds a licence somewhere, even if that somewhere is not the United Kingdom.

Which tokens do these sites typically accept?

BTC and ETH dominate, but USDT and USDC carry most of the actual volume because traders move stablecoins, not volatile coins. Litecoin, Solana and Dogecoin appear on roughly a third of the sites we reviewed. Some operators now list 40 or more supported assets on their cashier page.

Stablecoins matter more than the headline coins for compliance reasons. A deposit of 5,000 USDT is a fixed 5,000 dollars at the moment it lands, which makes reporting and source-of-funds checks far simpler than the same amount arriving in Bitcoin on a day the price moved 6%.

Who runs these sites and where are they licensed?

Most crypto casinos operating towards UK players hold a Curaçao eGaming licence under the new LOK framework, or an Anjouan licence from the Comoros. A handful carry a Kahnawà:ke commission certificate. Almost none hold a UK Gambling Commission licence, and that gap is the whole story.

Curaçao reformed its regime in 2024 and 2025, replacing the old sub-licence system with direct licences and a minimum share capital requirement of 250,000 dollars for a B2C operator. Anjouan is cheaper and faster to obtain, with application windows opening several times a year, but carries less weight with payment processors.

Malta, Gibraltar and the Isle of Man remain the premium tier for fiat-facing operators. None of those jurisdictions have issued a crypto-first casino licence at scale, which is why the brands most UK players encounter when searching for a crypto casino are almost always offshore.

UK Licensing Requirements in Plain Terms

What licence do I need to run a crypto casino for UK players?

You need a Gambling Commission operating licence under the Gambling Act 2005, specifically a Remote Casino Licence. There is no separate "crypto" category. If British customers can register, deposit or play, the licence requirement applies regardless of whether the money moves in pounds or in tokens.

Application fees start at £37,704 for a remote casino licence with initial turnover up to £5 million, rising in bands to £144,665 for turnover above £500 million. Annual fees are charged separately and are due each 1 October, calculated on the previous year's gross gambling yield.

The Commission also requires an operating licence for any ancillary activity: a betting intermediary licence for a poker room, a gaming machine licence for any FOBT-style product, and a software licence if you build your own platform rather than buying one from a white-label supplier.

How long does the application process take?

Officially, the Commission aims to determine straightforward remote applications within 12 weeks of receiving a complete submission. In practice, crypto-related applications take longer because the source-of-funds questions multiply. Budget 4 to 6 months from first draft to licence in hand if your corporate structure involves offshore holding companies.

Pre-application meetings are available and worth taking. Operators who skip them tend to underestimate the personal management key-person requirements, then discover mid-process that a proposed director has an unspent conviction or an unresolved regulatory history in another sector.

Timeline milestones to plan around: corporate structure sign-off at week 2, key-person declarations at week 4, technical platform audit at week 6 to 10, and final determination after week 12. Add two weeks for any follow-up information request, which almost every applicant receives.

Who can be approved as a licence holder?

The licence holder must be a body corporate with a UK-established connection, or a partnership with at least one UK-resident partner. Sole traders are not eligible for remote casino licences. The Commission also requires that every director and person with significant control passes a fit-and-proper assessment.

Key persons include the nominated officer for money laundering, the compliance officer, and the technical services manager. Each must be named in the application, and each must be genuinely employed or contracted by the licensee, not borrowed from a group company for paperwork purposes.

Convictions, bankruptcy orders and prior regulatory sanctions must be disclosed. Failure to disclose is treated as a separate breach, and it is the single most common reason an otherwise sound application is refused at the final stage.

What does the licence application actually cost?

Application fee, legal advice, platform audit, AML policy drafting and key-person time typically total between £60,000 and £150,000 before the first customer arrives. That figure excludes the initial turnover fee itself, which is paid on determination, and excludes any technology spend.

Compare that with Curaçao, where a complete B2C licence package through a local agent usually lands between €20,000 and €45,000, with an annual renewal around €12,000. The gap explains the market. Cheap licences attract cheap operators, and cheap operators are the ones the Commission spends its enforcement budget chasing.

For a hybrid operator running both a UK licence and an offshore crypto site, budget the UK cost twice: once for the licence, once for the compliance staff required to keep it. Two full-time compliance officers in London cost roughly £140,000 a year in salary alone.

Penalties, Fines and Enforcement

How much can the Gambling Commission fine an unlicensed operator?

Under section 33 of the Gambling Act 2005, an unlimited fine can be imposed for operating without a licence. The Commission's published enforcement cases show the scale: Entain was fined £17 million in August 2023 for social responsibility and AML failures across its UK-facing brands, one of the largest penalties in the sector's history.

Smaller operators are not exempt. In 2024 and 2025 the Commission issued penalties in the £100,000 to £2 million range against licensees with inadequate source-of-funds checks, inadequate customer interaction procedures, and failures to report suspicious activity to the National Crime Agency within the required timeframe.

For an unlicensed operator targeting UK customers, the Commission can also seek a High Court injunction to block payments and a section 100 order requiring internet service providers to block the domain. Both routes have been used repeatedly since 2019.

What happens to directors personally?

Section 34 of the Gambling Act allows the Commission to pursue individuals connected to an offence, including directors who knew or ought to have known about the breach. Personal fines, personal licence revocations and, in serious cases, disqualification from acting as a company director for up to 15 years follow.

Criminal prosecution remains on the table. Operating a gambling business without a licence is an offence under section 33, carrying a maximum of two years' imprisonment and/or an unlimited fine on indictment. Convictions have been recorded against individuals running unlicensed UK-facing sites from abroad.

Money laundering exposure is separate. If tokens are moved through the business without adequate customer due diligence, the Proceeds of Crime Act 2002 applies, and the penalties there are steeper: up to 14 years' imprisonment for the principal offence.

Which recent cases should operators study?

The Commission's 2025 enforcement programme has focused on three areas: inadequate affordability checks, failure to apply self-exclusion data from Gamstop, and unlicensed white-label arrangements where the licence holder had no real control over the brand. Each of those has produced published settlement letters.

White-label structures drew particular scrutiny after several crypto-adjacent brands used a licensed UK shell to access payment rails while an offshore party controlled the marketing, the game selection and the wallet. The Commission's position is now explicit: the licence holder must control the operation, not merely lend its name to it.

Operators should also track the National Crime Agency's parallel activity. AML failures that trigger a Commission fine frequently trigger a Suspicious Activity Report review at the same time, and the two processes run on different clocks.

How does the Commission handle repeat breaches?

Escalation is standard. A first breach produces a warning or a small financial penalty. A second breach within 12 months produces a review of the licence conditions. A third produces licence revocation proceedings, which can be commenced with as little as 28 days' notice under section 102 of the Act.

Licensees can mitigate by self-reporting. Voluntary disclosure of a control failure, followed by evidence of remediation, has produced penalties reduced by 30% to 50% in published cases. Late disclosure, or discovery during a Commission review, removes that discount entirely.

The Commission also publishes the outcome. Reputational damage in a market where trust is the product is often more expensive than the fine itself, particularly for operators relying on affiliate acquisition where review sites publish enforcement history within hours.

Compliance Costs Year by Year

What does it cost to stay licensed after year one?

Annual fees are tiered by gross gambling yield. For a remote casino turning over under £5 million, the annual fee is £5,008. Between £5 million and £50 million it rises to £26,250. Above £500 million the figure reaches £1,062,768, payable each October.

Those figures cover the licence only. The real running cost sits in people and systems: a nominated money laundering officer, a compliance manager, an independent AML audit every 12 to 24 months, transaction monitoring software, and periodic independent testing of the random number generator and wallet infrastructure.

A realistic mid-size budget for a UK-licensed operator with a crypto cashier looks like this, assuming gross gambling yield of £20 million a year.

Add those together and the floor is roughly £290,000 a year before a single marketing pound is spent. Offshore operators without a UK licence avoid most of that, which is precisely why the price gap between a licensed UK brand and a crypto casino is visible in the odds, the bonus terms and the withdrawal speed.

How do offshore costs compare?

A Curaçao B2C licence costs around €20,000 to set up and €12,000 a year to renew, with a local compliance officer requirement that can be met by a service provider for €6,000 to €10,000 annually. Chain analytics and wallet infrastructure still apply, so the technology line does not disappear.

Anjouan licensing runs cheaper still, with total first-year packages reported in the €10,000 to €25,000 range depending on the agent. The trade-off is payment processing: fewer mainstream processors accept an Anjouan licence, so operators pay higher acquiring fees or rely on crypto rails exclusively.

Kahnawà:ke sits in the middle, with a setup cost around US$40,000 and annual renewals near US$15,000. Its reputation is stronger than Curaçao's among payment partners, but it does not authorise UK-facing activity, so any site claiming otherwise is misrepresenting its permissions.

What does a failed UK application cost?

The application fee is not refunded if the Commission determines against you. Add the sunk legal and consultancy time, typically £30,000 to £70,000, and a refusal lands somewhere between £70,000 and £150,000 with nothing to show for it.

Common refusal grounds: undisclosed ownership chains, key persons who cannot demonstrate relevant experience, business plans that show revenue targets without corresponding responsible gambling budget, and technical documentation that does not match the platform actually in use.

Reapplication is permitted after six months, provided the reasons for refusal have been addressed. Operators who reapply without changing the underlying structure tend to fail again, and the second refusal is published alongside the first.

AML Duties and On-Chain Monitoring

What AML rules apply to crypto casino transactions?

The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 apply in full. Customer due diligence must be completed before a relationship begins, which for a casino means before the first deposit, not before the first withdrawal as some offshore sites still practise.

Enhanced due diligence kicks in for Politically Exposed Persons, for customers in higher-risk jurisdictions, and for transactions above defined thresholds. A single deposit of the equivalent of €15,000 or more triggers a documented source-of-funds review that must be retained for five years.

Blockchain analysis is now expected rather than optional. Chainalysis and Elliptic screening of deposit addresses, plus a documented policy for handling mixer-detected funds, is the baseline a Commission reviewer will look for during a compliance assessment.

How are suspicious activity reports handled?

The nominated officer reviews internal reports, decides whether to escalate, and submits a SAR to the National Crime Agency through the SAR Online portal. The statutory deadline for internal escalation is prompt, and the Commission expects evidence of a functioning internal process, not just an outsourced filing service.

Proceeds of Crime Act protections apply only if the appropriate consent is obtained before acting on the knowledge. Cash out a suspicious crypto deposit without consent and the operator itself commits an offence, regardless of whether the customer did.

Record keeping runs five years from the end of the business relationship or the date of the transaction, whichever is later. Offshore operators with shorter retention windows cannot satisfy a Commission review, which is one reason transferring a crypto brand onto a UK licence is harder than starting fresh.

What technology do regulators expect in 2026?

Real-time wallet screening at deposit, automated velocity checks across linked accounts, and a documented process for freezing funds pending investigation. Static address lists updated monthly are no longer considered adequate by most reviewers.

Player-level risk scoring that incorporates deposit behaviour, session length and self-exclusion signals is expected under the Commission's customer interaction guidance. The guidance does not mandate a specific vendor, but it does require that the model be tested and its thresholds documented.

Expect the next tranche of guidance to address token-specific risks directly: privacy coins, cross-chain bridges and the use of decentralised exchanges to obscure provenance. Operators who build those controls now will spend less on remediation later.

Responsible Gambling Obligations

What responsible gambling tools must a UK crypto casino offer?

Deposit limits, loss limits, session time reminders, reality checks, cool-off periods and full self-exclusion must all be available and must be easy to find. Affordability checks are triggered by defined spend thresholds, and the operator must act on the result rather than simply record it.

Gamstop integration is mandatory for any UK-licensed brand. A customer who self-excludes through Gamstop must be prevented from opening a new account across every participating operator, including any crypto cashier running under the same licence.

Marketing rules under the Licence Conditions and Codes of Practice restrict bonus advertising to customers who have passed identity and age verification. Offering free spins or deposit matches to unverified accounts is a breach, and it is one the Commission checks proactively.

How is age verification enforced?

Strictly. A remote casino licence requires age verification before any gambling takes place, with a permitted window of 72 hours for initial play only if the operator can demonstrate that the customer cannot deposit above a defined limit during that window. In practice, most operators verify before the first deposit.

Cross-referencing against credit reference agencies and the electoral roll is standard. Document upload with a selfie check is common for higher-risk profiles. Failure to verify has produced penalties against licensees even where no under-18 gambling was proven, because the control failure is itself the breach.

Crypto deposits complicate this. A wallet funded elsewhere carries no identity, so the operator must rely entirely on its own checks rather than inheriting verification from a card issuer or bank.

What happens when a customer shows signs of harm?

The Commission's customer interaction guidance sets out four categories of behaviour requiring intervention: chasing losses, extended or accelerating sessions, depositing increasing amounts, and gambling while distressed. Each triggers a documented interaction within a defined timeframe.

Interactions escalate. First contact is usually an automated message with limit suggestions. Continued risky behaviour leads to a mandatory affordability conversation, then to account restriction or closure if the customer cannot demonstrate sustainable spend.

Operators who treat these steps as a checkbox exercise get caught. The Commission reviews interaction records during compliance assessments and compares them against the customer's actual deposit history, looking for gaps where the system flagged a pattern but no human acted on it.

Which Operators Serve UK Players Today

Which established UK brands hold full licences?

The household names all operate under Gambling Commission remote casino licences: bet365 casino, William Hill casino, Ladbrokes casino, Coral casino, Sky Bet casino, Paddy Power casino, Betfair casino and Betfred casino. Each runs a full responsible gambling suite and each publishes its licence number in the footer.

Beyond those, the licensed field includes Sky Vegas casino, Gala Bingo, Virgin Games casino, Betway casino, JackpotJoy casino, 888 Casino, BetVictor casino, PartyCasino, Grosvenor Casinos, Unibet casino and MrQ casino. That is roughly 40 well-known UK-facing brands, all of which meet the compliance costs set out above.

Several of these have added crypto-adjacent features in 2025, typically accepting tokens through a third-party processor that converts to fiat before the balance reaches the operator. The licence position stays clean because the operator never holds crypto itself.

Which brands sit outside the UK regime?

Sites marketed heavily towards UK players but holding Curaçao or Anjouan licences include a long tail of crypto-focused brands: Mystake, Goldenbet, Donbet, Fat Pirate, NineWin, Velobet, Rolletto and Mr Vegas in some markets. These are offshore operators, licensed elsewhere, and they are not authorised to provide services to consumers in Great Britain.

That is a statement of legal status, not a safety verdict. Several offshore operators maintain reasonable game libraries from Pragmatic, Hacksaw and Evolution, publish RTP figures, and process withdrawals quickly. The difference is the redress available to a UK customer if something goes wrong.

Under a UK licence, a customer can escalate a complaint to the Commission's ADR-approved alternative dispute resolution provider and, ultimately, to the Commission itself. With an offshore licence, the route runs through the foreign regulator, in a language and legal system the customer may not know.

How do the two tiers compare on withdrawal speed?

Licensed UK brands using open banking or debit cards typically settle within 24 hours once verification is complete. Crypto-only offshore sites often settle faster, in 10 to 30 minutes on-chain, because there is no bank clearing cycle to wait for.

Speed is not the only variable. A UK-licensed operator must hold customer funds in a segregated account under licence condition 4.2, and those funds are protected if the business fails. Crypto held in an operator's hot wallet has no equivalent protection.

The trade-off is real and worth stating plainly: faster money out, weaker safety net. Which side of that line a player prefers depends on how much they trust the operator's balance sheet, and that trust is exactly what a licence is designed to substitute for.

Building a Compliant Crypto Casino From Scratch

What is the realistic build order?

Start with the corporate structure and the licence, not the website. Applying for a Gambling Commission licence with an unfinished platform delays determination because the technical review cannot begin. Licensed platform providers such as those supplying white-label solutions to bet365 casino and 888 Casino can be engaged at the same time as the application.

Sequence: corporate formation weeks 1 to 2, licence application weeks 3 to 6, platform integration weeks 4 to 12, AML policy and training weeks 6 to 10, game supplier contracts weeks 8 to 14, soft launch with a capped player base around week 16, full launch after 4 weeks of clean operation.

Soft launch matters. Running a limited cohort for a month lets you test affordability triggers, self-exclusion propagation and wallet screening against real traffic before the Commission's post-launch review, which occurs within the first few months of trading.

Which suppliers do you need under contract?

Game content from at least three studios: Pragmatic Play or NetEnt for volume, Evolution for live tables, Hacksaw or a comparable studio for the newer crash and instant-win formats. Each contract carries its own jurisdictional schedule, and a studio approved for Curaçao use is not automatically approved for UK use.

Wallet infrastructure requires a custody partner and a chain analytics provider. Custody options range from self-managed hot wallets with multi-signature controls to fully custodial services; the Commission will ask who holds the keys and what happens if that party becomes insolvent.

Payments: a UK-licensed operator needs a domestic acquiring arrangement for cards and open banking. Crypto processors that settle to fiat are available, but they charge between 1% and 2.5% of turnover, which sits on top of the card interchange you would pay anyway.

How long before the business breaks even?

Given the cost stack above, a UK-licensed crypto casino needs gross gambling yield of roughly £400,000 to £600,000 a year before it covers compliance, licensing and platform fees. At a typical 5% net gaming margin, that means around £8 million to £12 million in annual wagering.

Affiliate acquisition costs in the UK gambling vertical commonly run between £150 and £400 per depositing customer. If average first-year deposit yield per customer is £600, payback takes two to four depositing customers, which is why affiliate dependency is so high in this market.

Offshore operators reach break-even faster because their fixed costs are lower, but they also face higher payment processing charges and a shorter average customer lifespan, since UK players who lose confidence in an unlicensed site simply stop playing rather than complain.

What happens if you already operate offshore?

Migrating an existing crypto brand onto a UK licence is possible but rarely smooth. The Commission will review the historical operation, including how deposits were sourced, how self-exclusion was handled and whether UK customers were targeted despite the absence of a licence.

Historic targeting of UK players without a licence is a live issue. The Commission has taken enforcement action against offshore operators for exactly this, and disclosure of past activity during an application is expected. Non-disclosure is treated as a material misrepresentation.

Practical route: launch the UK-facing operation as a separate brand with a clean licence, keep the offshore brand for other markets, and do not cross the customer bases. Attempting to run one wallet across both creates a control problem that no compliance officer will sign off.

Frequently Asked Questions

Is a crypto casino legal in the UK?

Playing at a crypto casino is not illegal for the customer, but an operator must hold a Gambling Commission licence to offer services in Great Britain. Sites holding only Curaçao or Anjouan permission are not authorised here, and using them means no UK regulatory protection if a dispute arises.

Can the Gambling Commission block a crypto casino site?

Yes. Under sections 100 and 101 of the Gambling Act 2005 the Commission can seek court orders requiring payment providers to block transactions and internet service providers to block domain access. Several unlicensed UK-facing sites have been blocked using this route since 2019.

Do I pay tax on crypto casino winnings in the UK?

For a recreational player, gambling winnings are not taxable, whether they arrive in pounds or in Bitcoin. The tax exposure sits with the operator, which pays a 21% remote gaming duty on gross gaming yield from UK customers, and with anyone treating gambling as a trade.

How long does a Gambling Commission licence application take?

The Commission targets 12 weeks for straightforward remote applications, but crypto-related submissions with offshore ownership chains commonly take 4 to 6 months. Incomplete documentation is the main cause of delay, followed by key-person queries and platform audit findings.

What is the biggest fine issued to a UK gambling operator?

Entain was fined £17 million in August 2023 for social responsibility and anti-money-laundering failures. The Commission has issued penalties above £10 million on several occasions, and unlimited fines are available under section 33 of the Gambling Act 2005 for operating without a licence.

Do offshore crypto casinos pay UK tax?

No. An operator licensed in Curaçao or Anjouan with no UK establishment pays no UK remote gaming duty, which is one reason their bonus offers and odds can be more generous. The trade-off for the customer is the absence of UK regulatory recourse.

What is the minimum age for a crypto casino in the UK?

18, without exception. Remote casino operators must verify age before gambling takes place, and failure to do so is a licence breach even where no under-18 play is proven. Crypto deposits do not exempt an operator from this requirement.

How much does a Gambling Commission licence cost in 2026?

Application fees start at £37,704 for turnover up to £5 million and rise in bands to £144,665 above £500 million. Annual fees are separate and tiered by gross gambling yield, with the £5 million to £50 million band paying £26,250 a year.

Responsible Gambling

Gambling is for adults aged 18 and over in Great Britain. If gambling is causing you or someone you know harm, contact GamCare on 0808 8020 133, free and available 24 hours a day, or use the live chat at gamcare.org.uk. National self-exclusion across all licensed UK operators is available through Gamstop at gamstop.co.uk, which blocks access for 6 months, 1 year or 5 years.