New Casino Sites: What a Licence Actually Requires in 2026

New casino sites launch in the UK every month, and the ones that survive more than a year share one trait: they treat their Gambling Commission licence as an operating constraint rather than a badge. This guide walks through what operators must do to get and keep that licence.

The focus here is accountability. Anti-money-laundering controls, know-your-customer checks, independent game audits, and the reporting obligations that follow. Concrete hypothetical examples sit alongside real operator names so the rules stop being abstract and start looking like a checklist you can use when comparing sites.

Expect numbers: fee bands, turnover thresholds, audit cycles, sanction timelines. If you are opening an account at a freshly launched brand, the questions in this article are the ones worth asking before you deposit, because a licence number alone tells you very little about how a site actually behaves.

How UK Casino Licensing Works in 2026

What does the Gambling Commission actually license?

The Gambling Commission (GC) licenses operators, not websites. A licence covers remote casino operations, betting, bingo, and lotto under defined activity codes. When a brand says it is "fully licensed", check the licence number in the public register and confirm the activity codes match what the site offers.

Two main licence types exist: operating licences for the business running the games, and personal management licences for the named individuals responsible for key functions. A site can hold a valid operating licence while one of its PML holders has left, which is why register dates matter as much as the licence status itself.

How long does it take to get a new licence?

From application to first trading, budget 6 to 12 months for a straightforward remote casino licence. The GC states a 4-week review period for complete applications, but completeness is doing heavy lifting in that sentence. Missing beneficial-ownership documentation or an unsatisfactory AML policy resets the clock.

Operators launching white-label products add another 3 to 4 months because the platform provider also needs due diligence. That timeline explains why announced launch dates slip. A brand teasing a "summer 2026 opening" in March is realistic only if its paperwork was filed in late 2025.

What does a licence cost?

Application fees start at around £350 for the smallest remote categories and run to several thousand pounds for major casino operations. Annual fees scale with gross gambling yield: a site turning over under £500,000 pays a different band than one reporting £50 million. The GC publishes the full band table each April.

On top of that sits the 0.21% Gaming Duty on gross gaming yield above £500,000, plus the annual fee, plus whatever compliance staff the operator employs. A new site with 10,000 active customers and a £2 million annual yield carries roughly £4,200 in duty alone before salaries and audit costs.

Which operators illustrate the current landscape?

The UK market in 2026 mixes long-standing names with recent entrants. Established groups such as bet365 casino, William Hill casino, Ladbrokes casino, Coral casino and Grosvenor Casinos operate under licences held for over a decade. Their compliance departments run into the hundreds of staff.

Newer additions like Pub Casino, Midnite casino, talkSPORT BET, LiveScore Bet and PricedUp casino launched between 2022 and 2025 with smaller teams and, in several cases, platform deals that let them skip building an in-house compliance function. That trade-off shapes everything that follows.

Anti-Money-Laundering Duties for New Casino Sites

What triggers an AML check on a UK player?

Under the Money Laundering Regulations 2017, operators must run customer due diligence when a player deposits £1,000 in a single transaction, or when cumulative activity crosses defined thresholds. Source-of-funds evidence becomes mandatory once patterns look unusual, regardless of the individual deposit size.

Consider a hypothetical player depositing £950 three times in one evening. Each transaction sits under the £1,000 line, but the combined £2,850 and the timing pattern should trigger a review. Operators using automated transaction monitoring flag this within minutes; manual-review-only setups catch it days later, which is precisely the gap the GC fines.

How much do AML failures cost operators?

Fines for AML and responsible-gambling failings have run from £1.2 million to over £19 million in the last five years. In 2023 the GC issued a £19.2 million penalty against an operator for inadequate source-of-funds checks. Smaller operators with thinner balance sheets rarely survive that scale of penalty.

The financial exposure is not just the fine. Licence reviews can suspend trading for weeks, and suspended operators lose the customer deposits in the pipeline. For a site processing £400,000 a month, a 6-week suspension costs roughly £600,000 in gross revenue plus the churn of returning players.

What does a source-of-funds request look like in practice?

A compliant request asks for documentation proportional to the amount in question: payslips for routine deposits, bank statements for larger sums, and for very high-value activity, evidence of asset sales or inheritance. The operator must verify the documents are genuine, not merely collect them.

Hypothetically, a player showing £15,000 in deposits across two weeks with a declared occupation as a warehouse assistant would trigger escalation. Accepting a screenshot of a bank balance without verifying the originating account is a documented failure mode the GC cites repeatedly in enforcement cases.

Which new brands handle AML differently?

Brands running on shared platforms inherit the platform's monitoring tools. MrQ casino, Slingo casino and Double Bubble Bingo operate with in-house compliance teams that review escalations manually. Offshore-licensed brands available to UK players, such as Mystake casino, Goldenbet casino and Donbet casino, run under different regulatory regimes with different AML thresholds.

That distinction matters when you deposit. A UKGC-licensed site must file a Suspicious Activity Report with the National Crime Agency if it suspects criminal proceeds. A site licensed elsewhere has no such obligation to UK authorities, and your recourse if something goes wrong changes accordingly.

Know Your Customer: Identity Checks Before First Withdrawal

When must a UK casino verify a player's identity?

The GC requires verification before any funds can be withdrawn, and before a player can access free-play or bonus features that carry a wagering requirement. Full verification typically involves photo ID, proof of address dated within three months, and sometimes a source-of-funds document.

Best practice, and what most reputable new sites now do, is verify at registration. BetMGM casino, PlayOJO casino and Duelz casino run electronic checks against electoral roll and credit-reference data that clear most applicants in under 60 seconds. Manual review only kicks in when electronic checks fail.

How long should verification take?

Electronic verification: seconds. Manual document review: up to 72 hours under most operators' published terms, though the GC expects "without delay" as the standard. A site taking 5 working days to verify a straightforward passport and utility bill is either understaffed or running a deliberately slow process.

Consider a hypothetical player who wins £2,400 on a first deposit of £50. If the site did not verify at registration, the withdrawal now waits on document review. Three days is annoying. Ten days, which happens, is the kind of experience that ends up on review sites and costs the operator far more than the verification it skipped.

What happens when verification fails?

Failed verification means the account is frozen and deposited funds are returned to the original payment method. The operator cannot legally release winnings to an unverified account, even if the games were played fairly. This is a hard rule, not a policy preference.

Repeated failed attempts can lead to account closure with funds held pending investigation. Players using a VPN, a prepaid card in someone else's name, or an address that does not match the electoral roll hit this wall most often. It is inconvenient, and it is also the mechanism that stops stolen card deposits from becoming withdrawals.

Which sites verify fastest in 2026?

Speed depends on the verification provider, not the brand name. Operators using Onfido, Sumsub or Jumio clear most applicants in under a minute. Sites still asking for scans sent to a generic email address are running a 2015 process in a 2026 market.

• Fast lane: PlayOJO, MrQ, bet365 casino, Sky Vegas casino, Virgin Games casino
• Standard: Ladbrokes casino, Coral casino, Gala Casino, Unibet casino, 888 Casino
• Slower, document-heavy: some newer white-label brands and offshore sites

Do offshore casinos verify UK players at all?

Some do, some do not, and the difference is usually tied to payment processing rather than regulation. Card networks require know-your-customer checks for merchant accounts, so a Curacao-licensed site taking Visa still verifies identity before large withdrawals.

Sites accepting only cryptocurrency often skip formal verification until a withdrawal threshold is hit. Roobet casino, Donbet casino and Rainbet fall into this category. The trade-off: faster onboarding, weaker dispute resolution, and no UK regulatory body to complain to if funds are withheld.

Independent Audits and Game Fairness

Who tests the games on a new UK casino site?

Every game on a UKGC-licensed site must be tested by a recognised laboratory before it can be offered. eCOGRA, BMM Testlabs, GLI and NMi are the four names you will see most often. Testing covers random number generator integrity, return-to-player accuracy, and game-rule implementation.

The test certificate is not a one-off. Games get retested after major updates, and the operator must hold current certificates for every title on the lobby. A site listing 3,000 slots should have 3,000 valid certificates, which is why smaller lobbies from newer brands like Kwiff casino or BetGoodwin casino are sometimes easier to audit end to end.

What does RTP actually mean in practice?

Return to player is a long-run statistical average across millions of spins, not a promise about your session. A slot published at 96.0% RTP will return £96 per £100 wagered across its entire player base over time. Your individual session can be anywhere from 0% to 400%.

Providers publish these figures: NetEnt slots typically sit between 95.0% and 96.5%, Pragmatic Play titles range from 94.0% to 96.5%, and Hacksaw Gaming runs some games at 92.0% for specific markets. That 4.5-point spread between two slots matters more over 10,000 spins than any welcome bonus.

How often are audits repeated?

The GC requires ongoing monitoring rather than fixed audit cycles, but in practice most operators commission annual compliance reviews covering AML, responsible gambling, and complaints handling. Game-level testing happens continuously as new titles are added, typically weekly for a site adding 20 to 40 games a month.

Hypothetically, a site launching with 800 games from Pragmatic, NetEnt, Microgaming and Evolution needs 800 valid certificates on day one. Missing certificates for even a handful of titles is a compliance breach, and the GC has issued formal warnings for exactly this.

Which new sites publish their RTP figures?

UKGC rules require operators to make game RTP information accessible, but the presentation varies wildly. Some brands publish a full table in the footer; others bury it in a help article three clicks deep. PlayOJO casino went further by attaching its no-wagering bonus model to published RTP data on every game page.

Smaller operators like Pub Casino, Ivy Casino and SpinGenie generally follow the same disclosure pattern as their platform provider, which means the quality of disclosure tracks the platform, not the brand. Worth checking before you commit a bankroll.

What about live dealer games?

Live casino streams from Evolution, Pragmatic Play Live and Playtech are audited differently from RNG slots. The audit covers studio procedures, dealer training, wheel and card integrity, and stream latency. Physical equipment gets inspected on a schedule defined by the studio's own licence.

A hypothetical live roulette wheel showing a bias over 10,000 spins would be caught by the studio's own monitoring before most players notice. That monitoring is why live blackjack RTP of 99.2% to 99.5% is credible while a slot claiming 99% from an unknown provider is not.

Keeping the Licence: Ongoing Obligations

What must a licensed site report to the GC?

Quarterly regulatory returns covering gross gambling yield, active customers, and complaint volumes. Annual compliance statements signed by a PML holder. Immediate notification of material changes: a new ownership stake above 10%, a change of platform, a serious security incident, or any matter affecting player safety.

The reporting calendar is unforgiving. Missing a quarterly return by even a few days puts the operator on the GC's escalation list, and repeat misses feed directly into licence renewal decisions. Larger groups like Entain (Gala Bingo, Ladbrokes casino, Coral casino) and Flutter (Sky Bet casino, Paddy Power casino, bet365-adjacent brands) run dedicated regulatory reporting teams for this reason.

How does the GC monitor compliance between reports?

Through data requests, thematic reviews, and published enforcement bulletins. Recent themes have included affordability checks, VIP scheme safeguards, and marketing to lapsed customers. An operator can be perfectly current on filings and still face a review if its marketing data shows 18-to-24-year-old deposit patterns that look wrong.

Hypothetically, a site sending reactivation offers to 5,000 players who had self-excluded six months earlier would fail a thematic review regardless of its filing record. The data sits in the operator's own systems; the GC asks for it directly.

What happens when an operator breaches licence conditions?

The GC follows a published escalation path: informal improvement action, formal warning, licence review, then suspension or revocation. In practice the jump from warning to review is fast when the breach involves player funds or AML failures. The register publishes every step.

Penalties issued in 2024 and 2025 ranged from £40,000 for marketing breaches to multi-million-pound settlements for systemic AML failings. For a newly launched site with limited revenue, even a £250,000 penalty can force a sale or closure. That risk sits behind the operator's balance sheet, not the player's screen.

Which new operators have clean records so far?

Clean records are relative: newer brands have had less time to accumulate findings. MrQ casino, Virgin Games casino, JackpotJoy casino and Heart Bingo have operated without major published enforcement in recent cycles. Betway casino and bwin casino carry historical penalties that are publicly documented on the GC register.

Checking that register takes about two minutes and answers more questions than any review site. Search the licence number, read the enforcement history, and note the date of the last regulatory return. That is the accountability test, and it is entirely public.

Responsible Gambling Requirements

What tools must a UK casino provide?

Deposit limits, loss limits, session time reminders, reality checks, self-exclusion via GamStop, and access to account history. These are licence conditions, not optional extras. A site missing any of them is in breach from day one, and the GC checks for them during initial licence assessment.

Beyond the basics, operators must monitor for signs of harm: chasing losses, escalating deposits, late-night play patterns, and rapid withdrawals followed by re-deposits. Automated systems flag these; the response must be documented. Hypothetically, a player depositing £200 nightly for 14 consecutive nights should receive an intervention, not a loyalty offer.

How does GamStop work with new casino sites?

Every UKGC-licensed operator must participate in GamStop, the national self-exclusion scheme. Registering blocks you from all participating sites for 6 months, 12 months, or 5 years. There is no partial opt-out and no early removal during the chosen period.

Offshore sites are not part of GamStop. If a self-excluded player registers at Mystake casino or Goldenbet casino, the exclusion does not follow them there. That is the practical difference the scheme cannot bridge, and it is worth stating plainly when comparing operator choices.

What affordability checks apply in 2026?

Following the 2025 consultations, operators must conduct affordability assessments when a player's cumulative losses cross defined thresholds. The exact figures vary by operator policy, but the GC expects checks at £1,000 net loss in a rolling 30-day period as a minimum, with higher scrutiny above £5,000.

Checks involve income evidence or open-banking data. Players who decline the check can have deposit limits applied instead. It is friction, and it is the mechanism that replaced the looser approach pre-2023. Sites like bet365 casino and William Hill casino implemented these early; smaller launches are still catching up.

Which operators invest most in player protection?

Investment shows up as staff ratios and tooling depth. The larger UK groups publish responsible-gambling spend figures annually: Entain and Flutter each report hundreds of millions of pounds in RG investment across their brands. Gala Bingo, Sky Vegas casino and Coral casino benefit from that group-level spending.

Newer independent operators have to build the same function with a fraction of the budget. Pub Casino, Duelz casino and Mr.Play casino typically rely on platform-provided tooling. The tools are usually adequate; the human review behind them is where the difference shows.

What should a player do before depositing at a new site?

Three checks take under five minutes. Open the GC register and confirm the licence number and activity codes. Search the operator name in the enforcement section. Read the responsible-gambling page for the full tool set, not just the presence of a GamStop logo.

Then set a deposit limit before your first deposit, not after your first loss. The operators worth using make that flow obvious within two clicks of registration. If setting a limit requires emailing support, you have learned something about how the site prioritises its players.

Frequently Asked Questions

Are new casino sites safe to play at in the UK?

UKGC-licensed new sites are safe in the regulatory sense: player funds must be segregated, games must be independently tested, and disputes route to IBAS before reaching the GC. Safety depends on the licence, not the brand's age. Check the register, read the enforcement history, and confirm the activity codes before depositing.

How do I verify a casino licence myself?

Search the licence number on the Gambling Commission public register. Confirm the licensee name matches the site's footer, the status reads "Operating", and the activity codes cover remote casino. Note the personal management licence holders and any published enforcement actions from the last three years.

Why do new casinos take so long to verify withdrawals?

Because verification cannot legally be skipped. If the account was not verified at registration, the withdrawal triggers a document review covering photo ID, proof of address, and sometimes source of funds. Electronic checks clear most cases in minutes; manual review takes up to 72 hours under standard operator terms.

What is the minimum age to gamble in the UK?

18. Every UKGC-licensed operator must verify age before any gambling activity, including free-to-play games with prize potential. Under-18 accounts are closed and funds returned. Offshore sites accepting UK players carry the same legal minimum age requirement even where their regulator enforces it differently.

Can I play at new casino sites not on GamStop?

Yes, offshore-licensed sites are outside the GamStop network, but so is regulatory protection. Disputes route to the offshore regulator, player funds are not subject to UK segregation rules, and UK advertising standards do not apply. The trade-off between access and recourse is yours to weigh.

How often does the GC audit a licensed operator?

There is no fixed schedule. The GC uses data requests, thematic reviews, and triggered investigations. Operators self-report quarterly and annually. In practice, a compliant site might go years without a full audit, while a site showing concerning patterns in its own returns can be reviewed within weeks.

Do new casino sites pay out faster than established ones?

Not systematically. Payout speed depends on the payment provider and the verification status, not the brand's age. Established operators with dedicated payments teams often process faster because their verification was completed at registration. Check published withdrawal times and read recent player reports before assuming newer means quicker.

The accountability chain runs from licence application to quarterly return to enforcement bulletin, and every link is public. New casino sites in 2026 operate under tighter AML rules, faster verification expectations, and more frequent affordability checks than at any point since the 2005 Act came into force, which makes the register the single most useful tool a player has.