Crypto Casino: How Operators Get Licensed and Keep Their Licence

A crypto casino accepts Bitcoin, Ethereum, stablecoins or other digital assets for deposits, wagers and withdrawals. The appeal is speed and privacy. The catch is that a licence, once earned, is a living obligation, and regulators in 2026 audit harder than ever before.

This guide walks through what it actually takes for an operator to hold a crypto gambling licence: the application hurdles, the AML programme, the KYC triggers, the game audits, the reporting clocks, and the specific reasons licences get suspended or pulled.

Names you will see throughout: Bet365, William Hill, Sky Bet, Ladbrokes, Paddy Power, Coral, Betfred, Gala Bingo, Sky Vegas, Betfair, BoyleSports, Virgin Games, Betway, JackpotJoy, Foxy Bingo, Admiral Casino, 32Red, 888 Casino, BetVictor, PartyCasino, Monopoly Casino, Grosvenor Casinos, Unibet, Sun Bingo, MrQ, Double Bubble Bingo, Heart Bingo, Rainbow Riches Casino, Midnite, Lottoland, BetMGM, PlayOJO, LottoGo, LiveScore Bet, talkSPORT BET, Mr Vegas, Pub Casino, Tote, Gala Casino, NetBet, Mystake, Goldenbet, Genting Casino, Kwiff, bwin, Lottomart, Fabulous Bingo, Slots Temple, 10bet, Casumo, 888Sport, Slingo, PartyPoker, QuinnBet, Videoslots, Donbet, Betano, 666 Casino, Fat Pirate, NineWin, NYSpins, All British Casino, Mega Casino, Lucky Pants, Parimatch, Mega Riches, Rainbet, Casino Kings, Duelz, Voodoo Dreams, Velobet, Smarkets, BetGoodwin, Ivy Casino, 777 Casino, SpinGenie, Dream Vegas, Amazon Slots, PricedUp, Rolletto, Sportingbet, Bet UK, JackpotCity, DragonBet, Betdaq, 7bet, LeoVegas, Kinghills, Magic Red, The Pools, Dream Jackpot, Roobet, Hollywoodbets, Mr.Play, Magical Vegas, BetWright, Prime Casino, Gamdom, Pink Casino.

What Defines a Crypto Casino in 2026

How is a crypto casino different from a fiat online casino?

A crypto casino settles player balances in digital assets rather than pounds, euros or dollars. The core difference is the payment rail: a Bitcoin withdrawal clears in roughly 10 minutes on-chain, while a bank transfer can take 3 business days. Everything else, games, odds, bonuses, is structurally the same.

The operational divergence sits in treasury management. A fiat operator holds client funds in a segregated UK bank account and reconciles daily. A crypto operator holds hot wallets, cold storage and exchange positions, and must report wallet balances to its regulator on the same cadence as a bank statement.

Providers behind the lobbies stay familiar: Pragmatic Play, NetEnt, Microgaming, Evolution, Hacksaw Gaming, Play'n GO, Red Tiger, Nolimit City. Sky Vegas, MrQ and PlayOJO run the same studios as Mystake, NineWin or Goldenbet. The reels do not care which chain the stake came from.

Which licences cover crypto gambling operators?

Three jurisdictions dominate. Curaçao's GCB reformed its framework in 2024 and now issues four licence types under a unified portal. The Isle of Man GSC covers crypto-native operators with an established compliance record. Kahnawake issues fewer than 60 licences total. Gibraltar and Malta rarely licence pure-crypto brands.

The UK Gambling Commission takes a harder line. Since the 2023 policy statement on crypto, a UK-licensed operator may accept digital assets only where it can demonstrate full traceability and FCA-registered exchange partners. In practice, most UK brands, including Bet365, William Hill, Sky Bet and Ladbrokes, stay fiat-only.

That split matters for players. A brand advertising "crypto accepted" under a Curaçao licence operates under a different supervisory regime than one holding a UK licence, and the difference shows up in dispute resolution, self-exclusion reach and payout enforcement.

How big is the crypto gambling market right now?

Crypto gambling volume has grown alongside broader digital asset adoption. Publicly disclosed figures from major operators and on-chain analytics firms put annual wagering across crypto casinos in the tens of billions of dollars, with Bitcoin still the dominant deposit currency and USDT/USDC holding second place.

Stablecoins matter more than headlines suggest. A player depositing USDC avoids the volatility that makes a 0.4 BTC balance worth 20% less overnight. Operators like Roobet, Mystake and Gamdom report stablecoin deposits now account for a majority of new-account funding.

Geographic concentration is uneven. Crypto casinos see heavy traffic from markets where card deposits fail or where local currency controls apply. The UK, Germany and France remain firmly fiat. That regulatory map shapes which brands chase which audience.

The Licence Application: What Regulators Actually Check

What does a crypto casino licence application require?

Expect a 400 to 600 page submission. Core documents include the corporate structure chart, ultimate beneficial ownership declarations, five-year financial projections, source-of-funds evidence for shareholders, AML policy, responsible gambling framework, technical architecture of the wallet system, and named compliance officers with CVs.

Regulators now ask specifically about wallet controls: who can authorise a hot-wallet transaction, what multi-signature threshold applies, how cold storage is geographically distributed, and which exchange or OTC desk handles fiat conversion. Vague answers delay approval by months.

Timelines vary. Curaçao's reformed process runs 3 to 6 months for a clean application. Isle of Man averages 6 to 9 months. The UK Gambling Commission's standard route takes 16 weeks for a operating licence, extended to 24 weeks where the applicant has crypto exposure or complex group structures.

Who can be named as a compliance officer?

Most jurisdictions require a designated AML officer and a designated responsible gambling officer, both resident in the licensing territory or with a documented right to work there. They must pass a fit-and-proper test covering criminal record, financial standing and prior regulatory breaches.

Regulators cross-check CVs. A candidate who claims five years of AML experience at a previous operator will be asked for references and, increasingly, for certificates from recognised training bodies such as ICA or ACAMS. Inconsistencies here have killed applications.

The officer is personally accountable. If suspicious activity reports go unfiled for a quarter, the named AML officer faces individual sanction, not just the corporate entity. That personal exposure is why experienced compliance hires command six-figure salaries in this sector.

How much capital must a crypto casino hold?

Minimum share capital thresholds are published per jurisdiction. Curaçao requires a base of approximately $120,000 for a licence holder, with additional working capital expectations tied to monthly payout volume. Isle of Man expects initial capital of £50,000 to £350,000 depending on licence class.

Beyond the stated minimum, regulators assess liquidity against actual liabilities. If an operator reports £4 million in outstanding player balances, it must demonstrate accessible reserves covering that figure plus a buffer. Wallet audits verify the reserves exist on-chain, not on a spreadsheet.

The UK regime sets higher expectations. A remote operating licence applicant must show it can fund operations for at least 12 months without player revenue, and must maintain payment account arrangements that keep customer funds separate from operating funds at all times.

What technical infrastructure gets audited?

Two layers. First, the wallet and custody system: key management, backup procedures, transaction monitoring, and integration with a blockchain analytics provider such as Chainalysis or Elliptic. Second, the game layer: random number generator certification, RTP verification, and game-server hosting location.

Regulators increasingly require that the RNG certificate be issued by an accredited lab, GLI, BMM, eCOGRA or iTech Labs, and renewed annually. A certificate older than 12 months at the time of audit is a common finding, and repeated findings escalate to licence review.

Hosting matters too. If game servers sit in a jurisdiction the regulator considers higher risk, the operator must document compensating controls. Cloud providers like AWS and Google Cloud are accepted; unmanaged VPS instances in undisclosed data centres are not.

AML Obligations: The Programme Behind the Licence

What does an AML programme for a crypto casino include?

Five pillars, no shortcuts. A documented risk assessment covering customers, products, geographies and payment channels. Written policies approved by the board. Ongoing staff training with attendance records. Independent testing at least annually. And a named officer with direct reporting access to senior management.

For crypto, add a sixth layer: blockchain analytics. Every deposit address is screened against known illicit clusters, mixer outputs, sanctioned wallets and darknet market addresses. A hit triggers an automatic hold, not a manual review queue that sits for three days.

Transaction monitoring thresholds are calibrated to the operator's risk profile. A casino serving high-rollers will set higher per-transaction triggers than one serving casual players, but the calibration must be documented and justified. "We set it at $10,000 because that felt right" will not survive an audit.

When must a crypto casino file a suspicious activity report?

The clock starts when suspicion crystallises, not when the investigation finishes. In the UK, a SAR must be filed with the NCA "as soon as practicable" and in any case within a timeframe the operator's own policy defines, typically 24 to 72 hours from the trigger event.

Common crypto triggers include structuring, repeated deposits just under a reporting threshold, rapid deposit-withdrawal cycles that net to a loss with no play, use of a fresh mixer output, and account takeover patterns such as a sudden device and IP change followed by a large withdrawal.

Failure to file carries personal liability. Under the Proceeds of Crime Act, an officer who knew or suspected criminal property and failed to report faces up to 5 years imprisonment. That statute applies regardless of which jurisdiction licensed the brand.

How does KYC differ for crypto players?

The identity check itself is standard: government ID, liveness or selfie match, address verification. What changes is the source-of-funds question. A player funding an account with 2 BTC needs to explain where the 2 BTC came from, and "trading profits" requires evidence.

Operators handle this with tiered verification. Small deposits under a set threshold may pass with ID only. Larger deposits trigger enhanced due diligence: wallet history review, exchange statements, or in some cases a declaration signed under penalty of false statement.

Crypto-native verification tools have matured. Providers now offer automated wallet-risk scoring at the point of deposit, returning a risk band within seconds. Operators like Duelz, Voodoo Dreams and Casumo use these to decide instantly whether to accept, hold or escalate a transaction.

What records must be kept and for how long?

Transaction records, KYC documents, SAR filings, training logs and board minutes all fall under retention rules. The UK standard is 5 years from the end of the customer relationship, extendable to 7 years where a live investigation exists. Curaçao now requires 5 years minimum post-licence.

Records must be retrievable within a reasonable window. A regulator asking for 12 months of deposit logs for a named player expects them within 24 to 48 hours. Operators who archive to cold storage without an index discover, painfully, that "retrievable" means immediately.

On-chain data complicates this. The blockchain record is permanent, but the operator's internal record of who controlled which address at which time is not. That mapping is the record regulators actually want, and losing it is treated as a control failure.

Which blockchain analytics tools do regulators expect?

Chainalysis, Elliptic, TRM Labs and Crystal are the four names that recur in audit reports. Regulators do not mandate a specific vendor, but they do expect documented integration, staff trained on its outputs, and evidence that alerts are actioned rather than dismissed wholesale.

Alert handling is where operators fail. A tool generating 400 alerts a month with a 98% false-positive rate and no documented tuning exercise tells an auditor the system is decorative. Calibration reviews every quarter, with written rationale for threshold changes, are now standard practice.

Cost is real. Enterprise blockchain analytics contracts typically run five figures annually, and the analyst time to run them adds more. For a mid-size crypto casino, AML compliance often consumes 4 to 7% of operating revenue. That is the price of the licence.

Game Fairness, Audits and Payout Integrity

How is game fairness verified at a crypto casino?

Provably fair systems let a player verify each round's outcome using a server seed hash, a client seed and a nonce. The operator commits to the server seed before the round, so it cannot retroactively alter the result. Bitcoin casinos pioneered this; Ethereum and Solana casinos adopted it widely.

Provably fair is not a substitute for third-party testing. Regulators still require the underlying RNG to hold a valid certificate from an accredited laboratory. The two mechanisms answer different questions: provably fair proves the operator did not tamper, certification proves the algorithm is statistically sound.

Published RTP figures must match audited values. A slot advertised at 96.5% RTP that audits at 94.1% is a misrepresentation finding, and in the UK that alone can trigger a licence review under the licence conditions on accuracy of information.

What does a typical compliance audit look like?

Announced or unannounced, depending on jurisdiction. The auditor samples customer files, walks through a live SAR decision, tests wallet controls, reviews board minutes for the past 12 months, and interviews staff at random. A 3-day on-site is common; a 10-day deep review is not unusual for a first audit.

Findings are graded. Minor findings, such as a training log missing a signature, get a remediation deadline of 30 to 90 days. Major findings, such as an unreported wallet exposure, require immediate notification and often a corrective action plan submitted within 10 business days.

Repeat findings are the danger. Two consecutive audits with the same major finding typically move the operator into enhanced supervision, which means quarterly reporting, pre-approval for new game suppliers, and in the worst case, a restriction on withdrawals above a set limit.

Which testing labs certify crypto casino games?

GLI, BMM Testlabs, eCOGRA, iTech Labs and NMi are the five most frequently cited in licence documentation. Each issues certificates covering RNG integrity, RTP verification and, where relevant, the mathematics of specific game titles.

Turnaround varies. A standard RNG certification takes 6 to 10 weeks. Adding a full game-mathematics review pushes it to 12 to 16 weeks. Operators launching a new studio's titles without scheduling certification early routinely miss launch windows by a month or more.

Certificates must be current. Auditors check expiry dates first. An operator running a game whose certificate lapsed 4 months ago is in breach of its licence conditions from day one of the lapse, regardless of whether the game itself is fair.

What happens when a payout dispute goes unresolved?

Most licensed operators publish a complaints procedure with defined stages: internal review, escalation to a named complaints manager, and referral to an alternative dispute resolution body. In the UK, that body is typically eCOGRA or IBAS. Curaçao now routes disputes through its own portal.

Timeframes are published. A first response within 48 hours, a final decision within 10 business days, and ADR referral available after that. An operator that misses its own published timeline hands the player a free argument in any subsequent regulatory complaint.

Crypto adds a wrinkle: once a transaction is confirmed on-chain, reversal is impossible. If an operator pays the wrong address, the money is gone. This is why withdrawal confirmation screens, address whitelisting and a cooling period on new addresses exist at all.

Keeping the Licence: Ongoing Obligations

What must a crypto casino report and how often?

Monthly, quarterly and annual cycles stack on top of each other. Monthly: transaction volumes, deposit and withdrawal totals, top-10 player activity summaries. Quarterly: SAR counts, responsible gambling metrics, complaint volumes, audit findings status. Annual: audited financial statements, AML programme review, board-approved risk assessment.

Regulators increasingly want machine-readable submissions. The UK Gambling Commission's reporting portal accepts structured data, not PDFs. Operators still filing spreadsheets by email discover this during a routine submission window, usually at the worst possible moment.

Late or inaccurate filings are treated as control failures, not administrative slips. Two consecutive late submissions typically trigger a formal information request, which carries its own deadline and its own penalty for non-compliance.

How does responsible gambling apply to crypto accounts?

Deposit limits, loss limits, session time limits, reality checks and self-exclusion all apply identically to crypto accounts. The fact that a player funds in BTC does not exempt the operator from offering GBP-equivalent limits and honouring them.

Crypto volatility creates an edge case. A player sets a £500 weekly deposit limit; the BTC they deposited is now worth £650. Operators must decide, and document, whether limits apply in fiat terms or asset terms. Regulators expect fiat terms, measured at time of deposit.

Cross-operator exclusion schemes matter. GamStop covers UK-licensed brands including bet365, William Hill, Sky Bet, Ladbrokes, Coral, Betfred and Virgin Games. Crypto casinos licensed offshore are not in GamStop, which is precisely why UK-licensed operators emphasise their membership.

Which self-exclusion registers exist for UK players?

GamStop is the national register. It covers all operators licensed by the Gambling Commission, and exclusion periods run 6 months, 1 year or 5 years. Once set, it cannot be lifted early. Registration is free and takes about 10 minutes online.

Individual operators run their own schemes alongside GamStop: bet365's self-exclusion, William Hill's, Sky Bet's, all honouring the same minimum periods. A player excluded on one brand is not automatically excluded on another unless they use the central register.

Offshore crypto casinos sit outside GamStop entirely. Players using those brands must self-exclude directly with each operator, and enforcement depends on that operator's own policy. This is a genuine gap, and the Gambling Commission has said so publicly in its 2024 and 2025 review papers.

What triggers a licence suspension or revocation?

The usual suspects: failure to file SARs, customer funds commingled with operating funds, games running without valid certification, misleading advertising, and repeated late submissions. Each of those has produced a public enforcement action in the past 3 years.

Suspension is temporary and typically paired with conditions: enhanced reporting, restricted withdrawals, or a mandatory independent review. Revocation is permanent for that entity. A revocation does not prevent the same shareholders from applying again, but it guarantees enhanced scrutiny.

Public enforcement registers are searchable. The UK Gambling Commission publishes every fine and licence review with the operator name, the breach and the penalty amount. Curaçao's GCB began publishing decisions in 2024. Reputation now carries a measurable cost.

Comparing the Main Licensing Routes

Which licence should a crypto casino operator choose?

It depends on target market, budget and tolerance for scrutiny. A UK-facing brand needs a UK licence, full stop. A brand serving international markets outside the UK can weigh Curaçao's speed against Isle of Man's credibility. Gibraltar and Malta suit larger groups with existing compliance infrastructure.

Cost differs sharply. A Curaçao application plus first-year fees lands in the low tens of thousands of dollars. Isle of Man, including legal and compliance setup, runs into six figures before a single game goes live. The UK route, with its 16 to 24 week timeline and legal costs, sits between.

Market access follows reputation. Some payment processors and game studios will not partner with a Curaçao-only operator. Others will, and charge a premium for the perceived risk. That negotiation shapes unit economics more than the licence fee itself.

How do UK-licensed brands handle crypto compared with offshore ones?

Most UK brands do not accept crypto at all. Bet365, William Hill, Sky Bet, Ladbrokes, Paddy Power, Coral, Betfred, Sky Vegas, Betfair and Virgin Games all process deposits in GBP through card, bank transfer or e-wallet. Their compliance teams treat crypto as out of scope for now.

A handful of UK-licensed operators have trialled crypto deposits through FCA-registered partners, with strict per-transaction caps and full traceability requirements. The operational overhead usually outweighs the commercial gain, which is why the trials rarely become permanent features.

Offshore crypto casinos take the opposite approach and build their entire proposition around digital assets. Mystake, Goldenbet, NineWin, Donbet, Fat Pirate, Rolletto, Velobet and similar brands market crypto-first banking as the headline feature, and their licence obligations reflect that choice.

What is the real cost of running a compliant crypto casino?

Break it into four buckets. Licence and legal: $40,000 to $250,000 depending on jurisdiction, plus $20,000 to $60,000 a year in renewals and ongoing legal advice. Compliance staffing: an AML officer, a responsible gambling officer and at least one analyst, typically $180,000 to $350,000 a year fully loaded.

Technology and audits: blockchain analytics contracts, KYC provider fees, RNG certification, annual independent audit, reporting portal tooling. Realistic annual spend for a mid-size operator: $80,000 to $200,000. Add responsible gambling tooling and it climbs further.

Total first-year outlay before revenue: a low six-figure sum is the floor, and a well-run operation in a strict jurisdiction should budget a mid six-figure sum. Operators that underbudget this discover the gap through enforcement action rather than planning.

How do players verify that a crypto casino is properly licensed?

Check the licence number against the regulator's public register, not the logo on the footer. The UK Gambling Commission publishes a searchable register with licence status, conditions and any enforcement history. Curaçao's GCB launched a comparable register in 2024.

Then check the game certificates. Reputable operators display the GLI, BMM, eCOGRA or iTech Labs seal with a certificate number that resolves to a real document. A seal that links nowhere is decoration.

Finally, read the complaints record. IBAS publishes case outcomes. eCOGRA publishes dispute statistics. A brand with a pattern of unresolved complaints is telling you something no licence badge can.

Practical Steps for Players and Operators

What should a player check before depositing crypto?

Four checks, in order. Licence status on the regulator's register. Published RTP and a current certification seal. Withdrawal terms, specifically minimum amounts, network fees and any pending period. And the complaints route, with a named ADR body and a stated response window.

Watch the withdrawal rules closely. Some crypto casinos impose a maximum monthly withdrawal in fiat terms, others cap by asset, and a few hold withdrawals pending manual review for 24 to 72 hours. Read the terms before depositing, not after a delayed payout.

Bonus terms deserve the same scrutiny. Wagering requirements of 30x to 50x are common; a 50x requirement on a 1 BTC bonus means 50 BTC of turnover before withdrawal. That number, not the headline bonus size, is what determines real value.

What should a new crypto casino operator do first?

Lock the licence route before writing a line of code. The choice of jurisdiction determines your AML tooling, your reporting cadence, your payment partners and your game supplier contracts. Choosing afterwards means rebuilding all four.

Hire the compliance officer before the marketing team. A named, experienced AML officer shortens the application, satisfies the fit-and-proper test faster, and sets the programme design correctly from day one. Retrofitting compliance onto a live operation costs multiples of doing it upfront.

Budget for year one losses. Most crypto casinos do not break even inside 12 months once licence fees, compliance staffing, audit costs and responsible gambling tooling are counted. Operators who plan for this survive; those who do not, do not.

How often do compliance rules change?

More often than most operators budget for. The UK Gambling Commission issued multiple policy statements and licence condition updates between 2023 and 2025. Curaçao's framework changed fundamentally in 2024. MGA rules on player complaints and AML were revised in 2024 and again in 2025.

A practical cadence: review your policy suite every 6 months, run a full gap analysis annually, and subscribe to your regulator's notification list. Operators treating compliance as a one-time setup exercise fall behind within a single financial year.

Change also comes from outside the regulator. Payment network rules, exchange delisting policies and travel-rule requirements for virtual asset transfers all shift the compliance baseline independently of any gambling licence condition.

Which brands are known for transparent compliance?

Among UK-licensed operators, bet365, William Hill, Sky Bet, Ladbrokes, Coral, Betfred, Grosvenor Casinos, Genting Casino, Unibet, BetVictor and 888 Casino all publish their licence numbers, ADR membership and responsible gambling tools on-site. Their enforcement history is publicly searchable at the Gambling Commission.

Offshore, transparency varies more. Established Curaçao licensees such as Mystake, Goldenbet, NineWin, Rolletto and Velobet publish licence numbers and, where audited, certification seals. Smaller or newer brands often publish a logo without a verifiable number, which is the red flag to watch for.

Brands like MrQ, PlayOJO, Double Bubble Bingo, Heart Bingo and Rainbow Riches Casino lean hard on their UK licence and GamStop membership as differentiators. That is a deliberate positioning choice, and for UK players it is the right one to look for.

What happens if a crypto casino loses its licence mid-operation?

Player funds must be protected first. Licence conditions in every serious jurisdiction require customer funds to be held separately, so a revocation triggers a return process rather than a scramble. Withdrawal timelines are set by the regulator, not the operator.

Game suppliers typically suspend access immediately. Pragmatic Play, NetEnt, Evolution and Hacksaw all include licence-status clauses in their contracts, and a revoked licence ends the distribution agreement automatically. The lobby empties within days.

For players, the lesson is structural: funds sitting in an account are only as safe as the licence behind them. Withdraw regularly, keep balances low, and treat any operator whose licence status cannot be verified on the regulator's register as a brand to avoid.

Frequently Asked Questions

Is a crypto casino legal in the UK?

A crypto casino is legal in the UK only if it holds a Gambling Commission licence and meets the Commission's conditions on payment methods and traceability. Most UK-licensed brands, including Bet365, William Hill, Sky Bet and Ladbrokes, do not accept crypto. Playing offshore is not illegal for the player, but it removes GamStop protection and UK dispute routes.

Do I pay tax on crypto casino winnings in the UK?

No, individual recreational gambling winnings are not taxable in the UK, whether paid in sterling or in Bitcoin. The position changes if gambling is your profession or if you trade crypto as a business, because then profits may fall under income tax or capital gains tax rules. Seek advice on your specific circumstances.

How fast are crypto casino withdrawals?

On-chain settlement itself is fast: roughly 10 minutes for Bitcoin, 1 to 2 minutes for Ethereum and seconds on Solana or Lightning. The variable is the operator's internal pending period, which runs from instant to 72 hours depending on the brand and whether enhanced due diligence applies to the account.

Can I use GamStop with an offshore crypto casino?

No. GamStop only covers operators licensed by the UK Gambling Commission. Offshore crypto casinos licensed in Curaçao, Isle of Man or similar jurisdictions are outside the scheme. Players using those brands must self-exclude directly with each operator, and enforcement depends on that operator's own policy and willingness to honour it.

What is the minimum age to play at a crypto casino?

18 across the United Kingdom, and 18 or 21 depending on the licensing jurisdiction for offshore brands. UK-licensed operators, including Gala Bingo, Coral, Betfred, Paddy Power and Virgin Games, run mandatory age verification at registration and again before any withdrawal is processed.

Which is safer, a UK-licensed casino or a crypto casino offshore?

Safety here means enforceability. A UK-licensed operator gives you GamStop, an ADR body, published enforcement records and a regulator that can compel payouts. An offshore crypto casino gives you speed and privacy but relies on its own internal complaints process. Neither is inherently unsafe; the difference is who you can escalate to when something goes wrong.

The compliance burden on a crypto casino is not paperwork for its own sake. Licence, AML programme, KYC triggers, game audits and reporting clocks form one interlocking system, and an operator that treats any single element as optional has already started losing the licence it worked months to obtain.