Crypto Casino: What a Licence Actually Costs Operators in 2026

A crypto casino accepts Bitcoin, Ethereum or stablecoins for deposits and withdrawals, and in return it must prove something most players never see: who runs it, who audits it, and what happens when a suspicious wallet touches the cashier. This guide breaks down that machinery.

The market split is stark. Roughly 60% of crypto-facing brands operating toward French-speaking players hold either a Curaçao licence under the new Curaçao Gaming Authority framework, an Anjouan licence, or a Maltese MGA certificate, while the remainder run on white-label agreements that obscure the real licensee.

Below, we map the licence types, the AML and KYC obligations attached to each, the audit cadence operators face, and a roster of 40+ brands with their regulatory status spelled out. Numbers come from published regulator fees and operator terms, not from marketing decks.

Which licence does a crypto casino actually hold?

Licences for crypto casinos cluster around four jurisdictions: Curaçao, Anjouan (Comoros), Malta, and Kahnawake. Each imposes different capital requirements, reporting duties and player-protection rules, and the gap between them explains why two casinos with identical game lobbies can offer wildly different recourse when something goes wrong.

What changed in Curaçao in 2025?

Curaçao replaced its four sub-licence system with direct licences issued by the Curaçao Gaming Authority on 1 March 2025. Operators previously working under a master licence had until 31 March 2025 to transition, and capital requirements rose to a minimum of ANG 250,000 for a B2C licence, roughly €130,000 at 2026 rates.

The CGA now requires operators to hold player funds in segregated accounts, publish monthly RTP reports for in-house games, and file suspicious transaction reports directly with the Financial Intelligence Unit. Brands like Instant Casino, Vave and Lucky Block operate under this framework, with licence numbers verifiable in the CGA public register.

Anjouan's Alternative Investment Promotion Authority issues licences in 4–6 weeks at roughly €17,000–€24,000 per year, with a lower capital floor. That speed explains why newer brands such as Mystake, Rainbet and Donbet chose Anjouan over Malta, which demands audited financials and a minimum of €100,000 in initial share capital.

Why does Malta's MGA licence cost more?

The Malta Gaming Authority charges an application fee of €5,000, a licence fee of €25,000 per year, and a gaming tax of 5% of gross gaming revenue with a minimum annual payment of €15,000. Those numbers buy the strictest player-protection regime available to offshore-facing crypto operators.

MGA-licensed brands must maintain a complaint mechanism with a 10-day response deadline, run self-exclusion tools compatible with the national register, and submit to annual independent audits of their random number generators. Few crypto-native brands hold an MGA licence; PokerStars casino and Partouche Online sit in this tier for their European-facing products.

Contrast that with unlicensed sites, which publish no RTP figures, answer no regulator, and can rewrite withdrawal terms overnight. The licence fee is the visible part; the operational overhead behind it runs 3–5 times higher once compliance staff, wallet screening and audit cycles are counted.

Which brands operate without any licence?

A meaningful slice of crypto casinos runs without a verifiable licence at all, relying instead on a registration certificate from a company registry that has nothing to do with gambling. Players discover this only when a withdrawal stalls beyond the advertised 24-hour window.

Brands in this category typically skip published ownership details, list no regulator on their footer, and offer no independent audit of game fairness. The practical difference: with a licensed operator, a disputed payout can be escalated to a regulator; without one, the only remaining lever is a public complaint on a review site.

Check the footer. A licence number you can type into a regulator's register is the cheapest due diligence a player can do, and it separates the operators who invested six figures in compliance from those who bought a domain for €12.

How do AML rules reach crypto deposits?

Anti-money-laundering obligations for crypto casinos start with the same Travel Rule that banks follow: any transfer above a set threshold must carry originator and beneficiary data. For operators licensed in Curaçao and Malta, that threshold is €1,000 for occasional transactions, and screening happens before the funds hit the game balance.

What is the Travel Rule threshold for crypto casinos?

Under the FATF Recommendation 16 as implemented in EU member states and mirrored in Curaçao's 2025 AML decree, virtual asset transfers of €1,000 or more require originator and beneficiary information to travel with the transaction. Operators integrate a blockchain analytics provider such as Chainalysis or Elliptic to check wallet risk scores.

A wallet flagged for mixer usage, darknet exposure or sanctioned addresses triggers an automatic hold. The operator then files a Suspicious Activity Report with its local Financial Intelligence Unit, typically within 24–72 hours of detection, and informs the player only if legally permitted to do so.

Unlicensed casinos skip all of this. No analytics provider, no SAR filings, no wallet screening. Deposits from a sanctioned address clear in seconds, and the operator has no obligation to report anything to anyone.

Which blockchain analytics tools do operators use?

The three dominant providers among licensed crypto casinos are Chainalysis KYT, Elliptic Lens, and TRM Labs. Integration costs run from $20,000 to $150,000 per year depending on transaction volume, which is a real line item for a mid-size operator handling 5,000 deposits a month.

Screening happens at two points: deposit address generation, where the casino checks the sending wallet, and withdrawal request, where the destination wallet is scored before broadcast. A score above the operator's risk threshold routes the transaction to a manual review queue staffed by compliance analysts.

Operators like Roobet, Shuffle and Rollbit publish their use of these tools in their AML policies. Brands that publish nothing usually run nothing.

What happens when a player fails AML screening?

Failed screening produces one of three outcomes: a request for source-of-funds documentation, a transaction hold pending review, or account closure with funds returned to the originating wallet. Licensed operators must document each decision and retain records for a minimum of 5 years.

Source-of-funds requests typically ask for payslips, sale contracts, or wallet export histories showing how crypto was acquired. Players who cannot substantiate balances above €5,000–€10,000 commonly see their accounts restricted rather than banned, with the balance returned on-chain.

The contrast with unlicensed sites is procedural, not philosophical. When an unlicensed casino wants a player gone, it closes the account and keeps the balance. When a licensed one does it, there is a documented trail and a regulator to complain to.

What does KYC look like at a crypto casino?

Know Your Customer procedures at licensed crypto casinos run in three tiers: account creation with email only, identity verification triggered at a deposit or withdrawal threshold, and enhanced due diligence for high-value players. Tier two is where most players first encounter the process, usually at the €2,000 cumulative deposit mark or the first large withdrawal.

When is full identity verification required?

Curaçao's 2025 licence conditions require full KYC before any withdrawal above €2,000 or before cumulative deposits reach €5,000, whichever comes first. Documents accepted include a passport, national ID card or driving licence, plus proof of address dated within the last 3 months.

Verification windows vary by operator: Betify and Nine Casino advertise 15-minute automated checks via providers like Jumio or Sumsub, while brands with manual review quote 12–48 hours. Crypto-native casinos sometimes defer KYC until withdrawal, which regulators increasingly treat as a compliance gap.

Operators with no licence run no verification at all, or ask for documents they never actually review. The absence of a check is not a feature; it is a liability that surfaces when the account is reported or the wallet is frozen upstream.

Which documents do players need to submit?

The standard package is a government photo ID, a selfie holding that ID, and a proof of address. Some operators add a liveness check requiring the player to blink or turn their head, which cuts synthetic-identity fraud by a wide margin compared with static uploads.

For crypto deposits, licensed casinos may additionally request a wallet export or an on-chain proof of ownership, usually a micro-transaction signature from the deposit address. This step is rare below €10,000 in lifetime deposits but standard above it.

Brands like Wild Sultan, Winamax casino and Parions Sport casino publish their document lists in the cashier section. If a site's requirements appear only after you request a withdrawal, treat that as a warning sign.

How long does verification take in practice?

Automated checks clear in under 5 minutes for roughly 70% of submissions; the remaining 30% route to manual review, where queues stretch to 48 hours during peak periods. Rejected documents, usually blurry photos or expired IDs, add 24 hours per resubmission.

Operators publishing their own numbers: NetBet casino reports a 92% first-pass approval rate, bwin casino cites median review time of 11 minutes, and Unibet casino states that 95% of European players complete verification without manual intervention.

Unlicensed casinos that claim "instant withdrawals" typically mean they never check anything. Fast is not the same as compliant, and the difference shows up the first time a withdrawal hits a chain-analysis flag.

Which audits keep a crypto casino honest?

Independent audits cover three surfaces: game fairness through RNG certification, payout reporting through monthly RTP publications, and financial solvency through segregated player-fund accounts. Licensed operators commission these on fixed cycles; unlicensed ones commission nothing.

Who certifies the random number generator?

Leading certifiers are eCOGRA, iTech Labs, GLI (Gaming Laboratories International) and BMM Testlabs. Certification involves running millions of simulated game rounds to confirm outcomes match theoretical distribution, with re-testing required after any software update from Pragmatic, NetEnt, Evolution or Hacksaw.

A full RNG certification typically costs $15,000–$40,000 per game studio integration and takes 6–10 weeks. Operators running proprietary in-house games face a separate, more expensive cycle because the house code itself must be reviewed.

Brands publishing their certification include Goldenvegas casino, Casino Action and Arlequin Casino, each linking the certificate PDF in their footer. An operator without a visible certificate is either running uncertified games or hiding the result.

What RTP figures do operators publish?

Curaçao's new rules require monthly RTP disclosure for in-house titles, with a floor of 95% for slots and no published floor for table games. Third-party titles report the RTP set by the provider: Pragmatic slots run 94.5%–96.5%, NetEnt titles cluster around 95.0%–97.0%, and Evolution live tables sit at 97.3% for blackjack.

Published averages from operators: VBET casino reports 96.2% across its slot library, Casino Extra shows 95.8%, and Lucky8 casino lists 96.4% for its top 50 titles. Unlicensed casinos publish no figures at all, which tells you exactly how much weight to give their advertised "97% payout".

The gap matters over volume. A 1.5 percentage-point RTP difference on €100,000 of slot turnover is €1,500, which compounds across a year of play into real money.

How are player funds protected?

Segregated accounts mean player balances sit in a trust or separate operating account, not in the casino's general treasury. Curaçao's 2025 conditions mandate segregation, monthly reconciliation, and disclosure of the banking partner in the terms of service.

Practical test: check whether the operator names its payment processor and banking partner. Brands like NetBet casino, Partouche Online and Zeetin-backed ZEbet casino publish these details; operators that say only "payments processed securely" are telling you nothing.

Insolvency is rare but not hypothetical. When a licensed operator fails, segregated funds return to players ahead of general creditors. When an unlicensed one fails, the balance evaporates with the domain.

Which crypto casinos are worth checking in 2026?

The brands below are grouped by licence tier and the concrete details players actually ask about: withdrawal windows, supported coins, and game providers. Numbers reflect published terms as of early 2026; always confirm in the cashier before depositing.

Which Curaçao-licensed brands dominate French-facing traffic?

Instant Casino runs under a Curaçao licence with 10-minute crypto withdrawals, a 10% welcome cashback with no wagering, and a library spanning Pragmatic, Hacksaw and Evolution across roughly 4,500 titles. Vave pairs a Curaçao licence with a two-part welcome offer of 100% up to 1 BTC plus 100 free spins, and supports BTC, ETH, LTC and USDT.

Lucky Block holds a Curaçao licence, advertises payouts within 10 minutes, and lists 3,000+ games from NetEnt, Pragmatic and Push Gaming. Mystake and Donbet, both Anjouan-licensed, offer similar lobbies with distinct welcome structures: Mystake at 150% up to €1,000 on first deposit, Donbet at 120% up to €600.

Shuffle and Roobet sit in the crypto-native tier, with Shuffle publishing a provably-fair system for its in-house titles and Roobet running a VIP cashback ladder that returns 10% of weekly net losses to top-tier players.

What do traditional European brands bring to crypto players?

Betclic casino, Winamax casino and Parions Sport casino operate under French ANJ oversight for their sports and casino products, accepting crypto only through licensed intermediaries. Their strength is dispute resolution: a French player escalating a payout reaches a domestic regulator, not an offshore mailbox.

Unibet casino and bwin casino hold MGA licences for their international arms and publish monthly RTP summaries. NetBet casino accepts crypto deposits via a third-party processor, with verification completed before the first withdrawal rather than at sign-up.

On the crypto-native side, Rollbit combines a Curaçao licence with a 100% deposit match and integrated NFT staking, while BetFury offers a native BFG token with daily staking yields quoted at 5–15% APY depending on tier. Both publish their licence numbers in the site footer.

Which newer operators should players watch closely?

Brands launched in 2024–2025 include Wild Robin, RoboCat casino, Spinsy and Casombie, each holding a Curaçao licence with withdrawal windows advertised at 0–24 hours. Their game libraries typically run 3,000–6,000 titles, weighted toward Pragmatic Play and Hacksaw Gaming.

Spinanga and Posido differentiate with weekly cashback of 10–15% credited automatically, no opt-in required. Nomini and Wazamba, both long-running Curaçao brands, keep loyalty programmes with tiered reload bonuses ranging from 25% to 100% depending on VIP level.

Lesser-known names like Jeton Rouge, GrandZ, Feelingbet and CasinoClic deserve a slower look: verify the licence number in the Curaçao register before depositing, and check whether the operator names its game providers in the lobby footer.

How do players protect themselves at a crypto casino?

Self-protection starts before the first deposit: verify the licence, read the withdrawal terms, and set a hard budget in fiat terms rather than crypto, because a volatile balance distorts how much you are actually risking.

What should you check before depositing?

Four checks cover most of the risk. Confirm the licence number in the regulator's public register, read the maximum withdrawal limits and timeframes, look for published RTP or audit certificates, and verify that the operator names its game providers.

Cross-reference the brand name against your national self-exclusion register before signing up, particularly if you have previously self-excluded. Re-registering under a new email at an offshore site defeats the purpose of the exclusion and is precisely the pattern regulators are closing.

Keep records. Screenshot the terms at registration, save deposit addresses, and note withdrawal request timestamps. Disputes resolve faster when you can show what the operator promised on a specific date.

Which red flags signal an unlicensed operator?

Three signals recur: no licence number in the footer, no named game providers, and withdrawal terms that appear only after you request a payout. A fourth, subtler one is a welcome bonus with no published wagering requirement, because the missing number is usually worse than any published figure.

Unlicensed casinos also tend to promise "instant, unlimited withdrawals with no KYC". That combination is a marketing claim, not a policy, and it collapses the moment a compliance question arises on-chain.

Contrast with a licensed operator: withdrawal limits are stated in euros, verification steps are listed before you deposit, and the complaints route names a specific regulator. Boring paperwork beats a shiny homepage every time.

Where do you turn when a withdrawal goes wrong?

Licensed operators must publish a complaints procedure with response deadlines, typically 10 business days at MGA-licensed sites and 14 days under Curaçao's 2025 framework. Escalate to the named regulator if the deadline passes without resolution.

For French residents, ANJ handles complaints against locally licensed brands; for offshore brands, the Curaçao Gaming Authority accepts player complaints through its online portal, though processing runs 4–8 weeks. Document everything before filing.

With an unlicensed casino, the realistic options are a public review, a chargeback if you paid by card, or writing the balance off. Crypto deposits are irreversible by design, which is exactly why pre-deposit verification matters more than any bonus offer.

What responsible-gambling tools should you use?

Deposit limits, loss limits, session timers and self-exclusion are the four tools regulators consider baseline. Licensed operators must offer all four; unlicensed sites may offer none, and often hide the settings behind a support request.

Set a deposit limit in your first session, not your tenth. A limit set after a losing streak is a limit set too late, and the operators who see the least player harm are the ones whose players set limits before the first deposit cleared.

Legal age for online gambling is 18 in France, Belgium and most EU states, 21 in parts of the US, and 18 across Curaçao-licensed sites. Underage accounts are closed on detection, with balances forfeited to the extent local law permits.

Responsible gambling: Online gambling is legal only for adults aged 18 and over (21 in some jurisdictions). In France, the national helpline is 09 74 75 13 13 (Joueurs Info Service, free call from mainland France). Players can self-exclude via the ANJ register (listefrancoisedesjoueurs) or international tools such as GamStop and Gamban. Set deposit limits before you play, never chase losses, and treat every stake as money you can afford to lose.

Frequently asked questions

Is a crypto casino legal in France?

Only operators holding an ANJ licence may offer online casino games to French residents. Brands licensed in Curaçao or Anjouan accept French players at their own discretion but fall outside ANJ's protection, meaning complaints cannot be escalated to a domestic regulator.

Do I need to verify my identity at a crypto casino?

Yes, at any licensed operator. Full KYC is triggered at €2,000 in cumulative deposits or on the first withdrawal above €2,000, using a photo ID, selfie and proof of address. Skipping verification is only possible at unlicensed sites, which is precisely the risk.

How fast are crypto withdrawals really?

Licensed operators advertise 0–60 minutes for BTC and USDT once KYC is complete, with the first withdrawal often slower because verification runs at that point. Actual times depend on network congestion and manual review queues, not on the casino's marketing page.

Can a casino refuse to pay out my winnings?

A licensed operator can refuse only for documented reasons: failed verification, bonus terms breach, or AML flags. It must state the reason in writing and return the original deposit where the refusal stems from a compliance check rather than player conduct.

Which cryptocurrencies are accepted most often?

Bitcoin, Ethereum, USDT and Litecoin cover roughly 90% of crypto casino cashier options, with Solana, Tron and XRP appearing on newer brands. Stablecoins dominate withdrawal requests because they remove price volatility between request and broadcast.

What happens to my balance if the casino loses its licence?

Segregated player funds are returned to players first, per Curaçao's 2025 conditions and MGA's player-protection rules. Without segregation, balances become part of the insolvency estate and recovery typically runs below 50% of the claimed amount.

The licence is not paperwork for its own sake; it is the mechanism that converts a casino's promise into an enforceable obligation. Check the register, read the withdrawal terms, set a limit, and play only where someone with authority can hold the operator to what it advertised.