Gibraltar gambling licence explained

What a licence permits

A Gibraltar licence is permission to provide gambling in or from Gibraltar. The Gambling Division regulates both remote (online) and land-based commercial gambling there. Offering betting, gaming, slots or lotteries in Gibraltar without the appropriate licence is illegal.

Remote gambling means taking part by internet, telephone, television, radio or other electronic communication rather than face to face.

What changed under the Gambling Act 2025

The new Act replaced the Gambling Act 2005. Licence holders licensed under the 2005 Act are treated as licensed under the 2025 Act, and existing licensees are "grandfathered". A Notice of Commencement is dated 1 April 2026, the same date as the Gambling (Amendment) Act 2026.

The 2025 Act widens the scope of regulation to cover:

• B2C gambling businesses managed or controlled in or from Gibraltar
• B2B businesses in or from Gibraltar, or making supplies to a Gibraltar entity
• regulated individuals, meaning people who hold key management functions
• gambling marketing activity carried out in or from Gibraltar
• companies holding more than 25% of a company that provides gambling outside Gibraltar but would need a licence if it were in Gibraltar

A transition period of six months runs from 1 April 2026. In it, any business within the scope of licensing must notify the Gambling Division and apply for a licence. New potential licensees are treated as conducting lawful activity during that time, though early engagement is encouraged.

Two separate bodies oversee the licensing and regulation of gambling in Gibraltar. The Gambling Division, part of the Ministry of Justice Trade and Industry, performs delegated functions for both.

Licensing Authority

The Licensing Authority is the designated Minister, the Minister responsible for gambling. The Minister carries the statutory responsibility for granting, varying and renewing licences. That work is administered through the Gambling Division's Licensing Section.

Gambling Commissioner

The Gambling Commissioner is the industry regulator, appointed by the Minister. The Commissioner must make sure licence holders act within their licence agreements and the Act, and in a way that maintains the good reputation of Gibraltar. The Commissioner advises the Minister on gambling through an annual report and whenever the Minister asks. The Commissioner is also the supervisor of the gambling sector for anti-money laundering, countering terrorist financing and proliferation financing.

Regulatory objectives

The objectives are:

• preserving confidence in gambling markets
• protecting consumers, especially children, young persons and problem gamblers
• promoting fair and responsible gambling
• preventing gambling from being a source of crime, being associated with crime or being used to support financial crime
• the public interest of Gibraltar, including its reputation and macro-economic interests

Supervision and enforcement

Supervision combines risk-based, scheduled visits with checks of equipment, review of licence holders' reports and examination of complaints from the public, including any systemic issues they reveal. Structured site visits test compliance with the Proceeds of Crime Act and with the Gambling Act duties on customer fairness and social responsibility. Staff routinely access licence holders' websites, games and offers.

Licence holders also file ad hoc reports, such as suspicious activity reports and underage gambling reports, and must bring any significant breach or threat to the Commissioner's attention.

For breaches of the Act or its codes, the Commissioner can start steps for the Licensing Authority to revoke a licence or amend a licence agreement, or bring court proceedings. Referring a holder to the Licensing Authority over complaints alone is seen as unlikely except for the most persistent and serious failures.

Cautions and settlements

A caution against Platinum Gaming Ltd is dated 13 November 2025. A regulatory settlement with Onisac Ltd over anti-money laundering deficiencies is dated 18 February 2022. Several other settlements are with Gibraltar remote gambling licence holders that are not named. A settlement dated 29 April 2026 with a licence holder, also not named, concerns sanctions screening deficiencies. A thematic review on sanctions screening, with guidance and learning points, is dated 9 June 2026. A Notice of Appointment of Members of the Gambling Appeal Tribunal is dated 27 August 2026.

Kinds of licence

The licensing categories are B2C, B2B, support services, holding companies, software supplier approvals and change of control.

Who gets licensed

Gibraltar has traditionally licensed only blue chip companies with a proven track record in gambling in other jurisdictions. It will also consider appropriately funded start-ups and expanding operations that propose to relocate wholly or partly from other jurisdictions. The number of holders is deliberately low, and every holder has a substantive presence in Gibraltar, close to the regulator.

The public list of licence holders

The Register of Licence Holders is published under section 14 of the Gambling Act 2025. It is split into B2C remote gambling operators, one B2C non-remote (land-based) operator, B2B remote gambling operators and gambling operators' support services. Each entry names the company and its group, with an Approved Brands item and the licensed activities. The B2C remote list ends at entry 29. A few entries show the pattern:

Five firms sit under support services for marketing and affiliate services: Tipico Services Limited, SBI Digital Marketing Limited, COE Services Limited, Tonybet Sourcing Limited and Etteluor Marketing Limited. They are listed apart from the B2C operator entries.

How binding the codes are

The Generic Code is a code of practice: interpretive guidance on the Act that outlines the framework licensees operate within. The Remote Technical and Operating Standards (RTOS) elaborate on the requirements for licence holders, and describe their own contents as largely advisory rather than obligatory. Codes of Practice issued under the previous Gambling Act remain in force until the Commissioner issues new codes, which will be consulted on first, as will any other new requirement beyond the Act and existing regulations.

Checks on owners and the supply chain

Licensing and wider approvals involve due diligence on the identified owners and controllers of gambling businesses, the ultimate beneficial owners. The checks extend to the supply chain, so that only fit and proper persons are involved in the sector.

Money held for players

A licence holder's liability for customer balances, pending withdrawals and prizes it has committed to pay should be separately identifiable at any point in time. The operator should be able to show enough cash and cash equivalents to pay them. Customers should not be given credit for gambling, other than through a promotion or bonus.

Uncontested funds in a suspended account should be paid to the customer on request, after identity and security checks. Before an account is treated as dormant and charged, the operator should give at least 14 days' written notice. Dormancy follows the period set in the terms, typically 12 months.

Game testing and fairness

Equipment and software must meet very strict technical standards of fairness, and all random number generators must be tested by independent specialists. Certificates of that testing, from an approved independent testing house or suitable in-house facilities, are needed for all gambling software and equipment within one year of the licence being granted and before commercial use. Operators also monitor game outcomes, including the range and distribution of numbers produced and how often customers win or lose. If the Commissioner is not satisfied with software or a supplier, the Commissioner can ban its use by written notice.

Test results should be accessible on the operator's website. They show who tested the software, that the output is random and, where applicable, the Return to Player (RTP) percentage. Actual RTP should be close to the theoretical long-term RTP, usually 95% or over. RTP measures all play by all players of a game pooled together, not the return to any one player. Live games run in strictly controlled studios, are fully recorded and monitored, and are checked statistically in the same way as RNG games.

The Division's list of approved testing facilities starts with eCOGRA, iTech Labs and Gaming Associates, all approved since 2007. The 11th entry, Global Lab Ltd, is approved since 2026.

Each game's rules should be reachable by a conspicuous link on gaming home pages, game selection screens and within the game. A game whose rules and information are unavailable should not be offered for gambling.

Advertising

Operators must follow the advertising law and guidelines of every jurisdiction where their facilities can be accessed. Adverts must not be indecent, pornographic or offensive, false, deceptive or misleading, or intended to appeal specifically to people under the minimum permitted age. They must also not breach copyright.

Duties, fees and reporting

The Division administers and collects licence fees and gambling duty. General Betting Duty is calculated on gross betting profit and General Gaming Duty on gross gaming profit. The licensing year runs from 1 April to 31 March. The Gambling (Duties and Licence Fees) Regulations 2026 (2026/065) are dated 1 April 2026. Administrative guidelines on duties and fees were first released on 30 April 2026 and amended on 12 June 2026 on payments.

Late payment or non-submission can bring interest, administrative follow-up, recovery action and a review of the operator's fitness and propriety. Each licence holder also sends the Commissioner quarterly statistical and financial returns for each licence, and transaction records are kept for at least 5 years.

The protections below are what the rules and guidance ask of operators. The later parts cover what the licence leaves out and how a complaint runs.

Account and withdrawal rules

Operators must apply strict age verification, identification and security procedures for deposits, gambling and withdrawals. Players must be registered with at least a full name, residential address and age or date of birth. Registration pages should warn that withdrawing deposits or winnings may not be permitted until identity verification is complete.

Subject to legitimate restrictions such as ongoing security checks, a customer should be able to start a withdrawal at any time. Processing should normally finish within 5 working days (excluding weekends and bank holidays) of the end of verification. Terms and conditions should describe the withdrawal process and the time normally taken for each type of withdrawal. Customers should have direct online access to at least thirty days of account history, with older records available on request.

Accounts are often suspended when a name, phone number, address, computer details or bank account appears to be used by more than one person, to protect against identity fraud. Enquiries behind a suspension can take between 6 and 8 weeks, sometimes longer.

Staff mistakes in odds, results or winnings do not entitle customers to an apparent windfall, and obvious errors let the operator cancel the bet. A player who finds a software fault in their favour cannot expect to keep unfair winnings. If a major outage aborts bets, stakes must be refunded fairly and in line with the Act, and harmful or suspicious outages are reported to the Commissioner within 2 working days.

Bonus terms

Accepting a bonus affects the ability to withdraw money from the account. Operators must state in their terms that play is monitored for bonus abuse, what the qualifying rules are and when the operator may void or disqualify an account. A bonus abuser who wins is not entitled to the bonus or the winnings, and one who loses is not entitled to money back.

Terms still apply to a customer who did not read them. They should be fair and reasonable, and operators must point out unusual terms and review any that cause confusion.

Self-exclusion and limits

Operators must offer defined tools for managing gambling, including self-exclusion and spending, time or loss limits for agreed periods. A time out locks the account at the customer's request for an agreed period, between 24 hours and six months.

Self-exclusion should block all known accounts, stop new accounts under the same or very similar details and remove the customer early from gambling marketing databases. The operator must confirm receipt of the request and explain the process, the consequences and the point at which the exclusion starts. The Commissioner does not normally treat self-exclusion as in place until the licence holder has confirmed it. The request should be a written record made through the operator's own procedure: vague chats with customer service or emails to general inboxes should not be expected to be implemented immediately, accurately or fully.

If a self-excluded person breaches the exclusion, the operator must keep a record and tell the Commissioner, who expects any winnings to be kept by the operator. Where an operator was careless and did too little to control access, reimbursement may be considered. Where a customer misunderstood the terms or defeated the operator's controls by deceit, the operator is unlikely to be held responsible for the losses.

Online operators must show a conspicuous link to responsible gambling information and help organisations on the website and at the start of each session, and should name a senior person to keep responsible gambling policies current. Systems should warn customers not to gamble beyond their means. This site's own page on responsible gambling gives further help.

Age checks

Licence holders must take all reasonable steps to stop anyone under the minimum permitted age from using their facilities, and no one under 18 or the minimum permitted age may take part. Where there is a substantive reason to believe a customer may be underage, gambling should be suspended and no winnings paid out. If age cannot be confirmed within 72 hours of a first deposit, the account should be suspended.

When an operator finds that an underage person has used its services, it must tell the Commissioner at the earliest opportunity. It must also return the stakes, forfeit unpaid winnings to the Government Consolidated Fund and not try to recover winnings already paid.

Where UK players stand

UK facing operators in Gibraltar are licensed in both Gibraltar and the UK, and both regulators' websites can be used to check a site's status. The guide to the UK Gambling Commission licence covers the UK side. Complaints about remote gambling by customers located in the UK should ordinarily go through the complaint and dispute arrangements that apply in the UK. The Gibraltar Commissioner will not ordinarily investigate or decide individual UK customer disputes. In exceptional circumstances a matter may be considered if it raises a material issue about a Gibraltar licensed operator's conduct or compliance, or a significant Gibraltar regulatory interest.

Affiliate websites that drive UK consumers to unregulated markets are the subject of a Gibraltar warning, and customers are advised not to use them.

What the licence does not give

The Commissioner has no formal power to order consumer redress, though a court may be asked to consider it where a case shows serious regulatory breaches. An upheld complaint, in whole or in part, does not automatically lead to redress. Justified complaints can lead to licence holders being required to change arrangements or systems or to review their decision.

The Commissioner's complaint advice is advice only and does not override an operator's agreed terms. Complaints that date back more than 2 years are not investigated except in exceptional circumstances. Findings by regulators in other jurisdictions may be persuasive but are not binding. It is very difficult to find in favour of a customer who has not been honest with the operator or the regulator.

How a complaint runs

Except in exceptional circumstances, such as allegations of gross misconduct, dishonesty or corruption by management, every complaint goes to the operator first, usually through customer services. The Commissioner accepts a complaint only if there are grounds (for example a breach of rules or terms), it concerns a Gibraltar remote gambling licence holder and the operator's own complaints procedure has been used and exhausted.

1. Put the complaint to the operator in writing, citing the time and date of any calls and the name of the person spoken to. The operator should acknowledge it within 2 or 3 working days.
2. With no response within a week, contact the operator again and ask for a supervisor.
3. If two weeks pass without a satisfactory response or a reasonable timescale, consider referral to the Commissioner. Operators must tell customers about Alternative Dispute Resolution options if the complaint stays unresolved. Where an operator uses independent adjudication, the customer is expected to cooperate, and the outcome usually binds the operator but not the customer.
4. Email the Complaint Resolution Request Form, with every section completed, to gccomplaints@gibraltar.gov.gi. Telephone complaints cannot be handled. A first reply is aimed for within one week.
5. Complaints that need more examination go to a case officer, who emails the determination with a copy to the licence holder. Further representations are considered by the Commissioner independently of the case officer, and that decision is final, subject to the courts.

Complain early and keep emails, screenshots and game records, and ask the operator to keep them too. Check which regulator applies: an operator can hold its casino licence from one jurisdiction and its poker licence from another. Most operators show their regulator on the home page and will say if asked.

The public register is the Register of Licence Holders on the Gambling Division's licence holders page. The general method across regimes is in the guide on how to check a casino licence.

What to look for on the casino site

A Gibraltar licence holder must display on its home page a link to a page giving:

• the full name of the licence holder and the address in Gibraltar from which it carries on business
• a statement that it is licensed by the Gibraltar Licensing Authority
• a statement that it is regulated by the Gibraltar Gambling Commissioner
• the permitted age for gambling

The Government motif must work as a live link to the Gambling Division website. The operator's rules must also be reachable by a live link from the home page, the about us page and the customer registration pages.

Steps to check an entry

1. Note the company name and Gibraltar address on the casino's licence page.
2. Find the same company in the register, in the section that matches what it does, such as B2C remote gambling operators for a casino.
3. Compare the group name and the licensed activities, for example Gaming Operator or Bookmaker, with what the site offers.
4. Look at the consumer warnings list of companies and websites that are not established or licensed in Gibraltar.

What a mismatch looks like

• The company is missing from the register. Some websites falsely claim or imply Gibraltar licensing when they are unlicensed or licensed in another, often less reputable, jurisdiction.
• A Gibraltar company registration or address proves nothing. Atari Casino has neither applied for nor been granted a Gibraltar gambling licence, although a company associated with it was registered in Gibraltar without notice to the Commissioner. One warned site gave a Gibraltar address that is a trust and company services office, and another gave a virtual office, neither an approved premises for remote gambling.
• The licence number is not genuine and the named company is not incorporated in Gibraltar.
• A site claims licences from both the UK Gambling Commission and the Gibraltar Licensing Authority and appears on the warnings list.
• A site claims membership of the Gibraltar Betting and Gaming Association or shows the IBAS logo without being a member or registered.
• A lookalike address copies a real operator. Boylesports is a Gibraltar licensed operator, and a warning dated 7 January 2026 covers URLs not affiliated with it that try to mislead the public. Other URLs wrongly associated themselves with the Gamesys brands Double Bubble Bingo, Virgin Games and Bally's Casino.
• A social gaming site is not a licence holder. Pulsz has a corporate association with Gibraltar but is not licensed there, because it is not real money gambling under Gibraltar's definitions.

Consumers are advised not to register or deposit on sites that falsely claim a Gibraltar licence, and not to send further money in the hope that winnings will be released. More on invented and copied licences is in the guide to fake and cloned casino licences.

Our team tests casinos and checks every licence line on this page against the regulator's own pages and register.

Each regulator publishes its own wording on what a licence asks of a casino and what a player can do, so regimes compare best side by side rather than by label. The guides below show how the other regimes handle the same questions.

• Casino licences compared
• UK Gambling Commission licence explained
• Malta gaming licence (MGA) explained
• Curacao gaming licence explained
• Anjouan gaming licence explained
• Non-UKGC casinos explained

A regulator may change a rule, or a line on this page may be mistaken. Write to info@biglicence.co.uk and say which line. The team then reads the Gambling Division's page or register again and corrects this page.

• Big Licence team checks of the licences we cover
• gamblingdivision.gov.gi Used for the Gibraltar Gambling Division's own pages and guidance.
• gibraltar.gov.gi Used for HM Government of Gibraltar's Remote Gambling page.
• gibraltarlaws.gov.gi Used for the Gibraltar Gambling Act 2025.