Crypto Casino: How Operators Get and Keep a Licence

A crypto casino runs on blockchain deposits, but the licence behind it decides whether your funds are safe. This guide breaks down the compliance stack operators face: AML programmes, KYC thresholds, third-party audits and the real cost of keeping a gaming authorisation in 2026.

What Separates a Licensed Crypto Casino From an Unlicensed One

Is a crypto casino legal in Italy?

In Italy only operators holding an ADM (Agenzia delle Dogane e dei Monopoli) concession can offer real-money games to Italian residents. Crypto deposits are not accepted by ADM-licensed brands; they hold euros under the 2011 Finance Act framework. Playing offshore with crypto is legally grey and falls outside Italian consumer protection.

The practical difference between a licensed venue and an unlicensed one shows up in boring places: withdrawal queues, dispute handling, payout ratios published monthly, and whether the regulator can freeze an account in 24 hours. Italy's ADM publishes certified RTP figures per game category, and licensed operators must display them before a bet is placed.

Across the market, roughly 40-plus brands target Italian players, but only a subset hold full ADM concessions. Names like Sisal, Lottomatica, Eurobet, Snai, GoldBet, Bet365 and StarCasinò operate under Italian licences with euro-only cashier systems. Others listed in the market, such as Stake, 1xBet, Betsson and 22bet, run under Curaçao or Anjouan licences and accept crypto.

That split matters when something goes wrong. Under ADM rules, player funds must sit in segregated Italian bank accounts, and disputes go to a certified alternative resolution body. Offshore crypto brands route complaints to their own support desks, and the licence authority's role is limited to reviewing licence fees and annual reporting.

Which jurisdictions issue crypto gambling licences?

Four jurisdictions dominate crypto gambling licensing in 2026: Curaçao (via the Curaçao Gaming Authority), Anjouan (Comoros), Kahnawake and Malta. Curaçao reformed its framework in March 2024, splitting the old master-licence system into individual B2C and B2B licences with defined AML obligations and a €40,000-ish application cost band.

The cost table above is only the entry ticket. Operators also pay game-testing fees per title, monthly revenue reporting, and in Italy a concession royalty that has historically run around 20% of gross gaming revenue plus a fixed annual fee. For a crypto casino, the licence fee is often the smallest line item in year one.

Do crypto casinos publish payout percentages?

Yes, licensed ones do, and the numbers are auditable. Italian ADM concessionaires must publish monthly RTP by game type: slot machines around 90–95%, table games 97–99%, and instant win around 87–92%. Crypto casinos licensed offshore typically publish RTP in the game info panel, with figures supplied by providers such as Pragmatic Play, NetEnt, Evolution and Hacksaw Gaming.

Independent testing labs verify those figures before a title goes live. GLI (Gaming Laboratories International), BMM Testlabs and eCOGRA run statistical checks over millions of spins, confirming that actual results fall inside the declared RTP band with a confidence interval usually set at 99%. A slot from Pragmatic Play that claims 96.5% RTP must demonstrate that number across a sample of at least 10 million rounds.

What separates a serious crypto casino from a shell operation is whether it re-tests after every provider update. Providers push new math models and bonus mechanics several times a year; a licence holder that skips re-certification is running on stale paperwork. In practice, top-tier operators like Betflag, PokerStars, 888 Casino and bwin publish their test certificates openly.

Anti-Money Laundering: The Programme Behind the Cashier

What does an AML programme actually include?

Ask any compliance officer what keeps them awake, and the answer is the source-of-funds file. An AML programme for a crypto casino has four pillars: a documented risk assessment, transaction monitoring rules, a named Money Laundering Reporting Officer, and a retention schedule for records that typically runs five to ten years depending on jurisdiction.

Crypto complicates the risk assessment because deposits arrive from wallets rather than banks. Operators respond by running wallet screening against chain-analytics tools such as Chainalysis Reactor or Elliptic Lens, which flag addresses linked to mixers, sanctioned entities, or darknet markets. A deposit from a blacklisted address triggers an automatic hold and an internal suspicious activity report.

Under Italy's AML decree (D.Lgs 231/2007), ADM-licensed operators must report transactions above €10,000 in cash-equivalent terms and file suspicious activity reports with the UIF (Unità di Informazione Finanziaria) within 30 days. Offshore crypto casinos follow similar thresholds if their licence authority has adopted FATF Recommendation 15, which since 2019 requires virtual asset service providers to be registered and supervised.

How do transaction monitoring rules work in practice?

Monitoring software scores every deposit and withdrawal against a rule set. Typical triggers: three or more deposits within 60 minutes from different wallet addresses into one account, a withdrawal of 80% or more of the balance within 24 hours of a large win, or cumulative deposits crossing a jurisdiction-specific threshold such as €2,000 in 30 days without identity verification completed.

Rules are tuned per risk tier. A player verified with a passport, proof of address and a liveness selfie sits in the low-risk bucket and rarely trips alerts. An account funded by three unlabeled wallets and closed after one session sits in the high-risk bucket, where every transaction routes to a human analyst before release.

False positives are the hidden cost. Industry benchmarks put manual review rates at 5–15% of transactions for a well-tuned system, and each review costs a compliance analyst somewhere between 8 and 20 minutes. Multiply that by a casino processing 50,000 transactions a month and you see why AML staffing is a real line item, not a checkbox.

Which crypto casinos hold a Curaçao licence after the 2024 reform?

The Curaçao Gaming Authority completed its transition from the old master-licence system in March 2024, and by late 2025 only operators holding a direct B2C licence could legally serve international players. Brands like Stake, 1xBet, Betsson, 22bet, Rabona, Nomini and Powbet have re-registered under the new framework with documented AML officers and local substance requirements.

Substance requirements mean a physical office, at least one locally resident compliance officer, and audited annual accounts filed with the regulator. Operators that failed to meet the deadline lost the right to display the Curaçao seal, and several white-label brands quietly migrated to Anjouan licences instead, trading scrutiny for speed.

For a player, the practical test is simple: open the site footer, find the licence number, and check it against the Curaçao Gaming Authority's public register. If the number isn't listed or the register shows an expired status, the crypto casino is operating without current authorisation, regardless of how polished the front end looks.

KYC: When Identity Checks Kick In

When does a crypto casino ask for ID?

Two moments trigger KYC: the first withdrawal, and any deposit or withdrawal crossing a value threshold set by the licence. At StarVegas, Eurobet and Snai, verification starts at registration. At most offshore crypto casinos, you can deposit and play anonymously, but the moment you request a withdrawal the account freezes until documents clear.

Standard document sets include a government ID (passport, national ID card or driving licence), a proof of address dated within 90 days (utility bill, bank statement), and sometimes a source-of-wealth declaration for deposits above a set amount. Crypto casinos add a wallet ownership check, usually a signed message from the address or a micro-transfer back to the originating wallet.

Timelines vary. ADM-licensed Italian operators must complete verification before any real-money bet is placed, which is why Sisal, Lottomatica and Planetwin365 ask for documents during signup. Offshore crypto casinos advertise 5–30 minute automated checks using providers like Jumio or Onfido, with manual review adding 12–48 hours when the algorithm can't read the document.

What documents do crypto casinos accept for verification?

The core set is stable across jurisdictions: passport, national ID, driving licence, utility bill or bank statement for address, and occasionally a selfie or short video for liveness. Screenshots of crypto wallets are accepted as supplementary evidence of ownership but never as a substitute for a government ID when the licence requires full KYC.

Some operators ask for more. A crypto casino with a Malta licence may require a bank statement showing the origin of funds if cumulative deposits exceed €2,000. Others request a payslip, tax return, or notarised affidavit when a player's deposit pattern looks inconsistent with the declared occupation, which is a standard red flag under FATF guidance.

Rejected documents are common and mostly boring: expired passport, blurred photo, address older than 90 days, name mismatch between ID and payment method. Operators like bwin, William Hill and NetBet publish their rejection reasons in the help centre, which saves a round trip when the first upload fails.

Can you play at a crypto casino without KYC?

Some crypto casinos market themselves as "no-KYC" and let you deposit, play and withdraw with only an email address. In practice these operators still run wallet screening and reserve the right to demand documents for large withdrawals, typically above 1 BTC or the equivalent in another coin. The absence of upfront KYC does not mean the absence of monitoring.

From a regulatory standpoint, a no-KYC stance puts the operator at odds with FATF Recommendation 10, which requires customer identification "on the basis of reliable, independent source documents" before a business relationship is established. Jurisdictions enforcing that rule include Malta, Kahnawake and post-reform Curaçao, so a no-KYC crypto casino is by definition not licensed there.

Players weigh the trade-off. Faster onboarding and privacy on one side; no recourse if an account is closed, no segregated funds, and a withdrawal cap that can be enforced unilaterally on the other. For small stakes, the risk is manageable. For a five-figure balance, it is a different conversation.

Audits: Who Checks the Numbers?

How often are crypto casinos audited?

Annual financial audits are the baseline, and most jurisdictions require them as a licence condition. Malta's MGA mandates audited accounts within six months of fiscal year end. Curaçao's reformed framework requires annual submission of audited financial statements plus a compliance report signed by the appointed AML officer.

Game audits run on a different cadence. Every new title gets certified before launch, and providers like Evolution, NetEnt, Pragmatic Play and Hacksaw submit their RNG algorithms to GLI, BMM or eCOGRA for testing. Re-certification follows major updates; a crypto casino hosting 3,000+ slots sees a steady stream of certificates arriving through the year.

Periodic AML audits are less visible but increasingly common. Independent firms such as Deloitte, KPMG and smaller specialist shops run thematic reviews of transaction monitoring, sampling alerts, testing escalation paths and verifying that suspicious activity reports actually reached the regulator. Findings feed directly into licence renewals.

Which testing labs certify casino games?

Three names cover most of the market: GLI, BMM Testlabs and eCOGRA. Each publishes test methodology, and each issues certificates with a scope statement that specifies which games, which math models and which jurisdictions the approval covers. A certificate issued for the EU does not automatically cover a crypto casino targeting other markets.

eCOGRA additionally publishes monthly RTP reports for casinos carrying its seal, showing actual payout percentages by game category over the previous month. Those reports are one of the few independent, player-facing data sources in the industry, and they make it possible to compare what a crypto casino claims against what it pays.

Smaller labs exist and some are credible, but the big three carry weight precisely because regulators recognise them by name. When an ADM concessionaire or an MGA licensee files game certifications, the paperwork must reference an approved lab, which is why you will see GLI and BMM certificates on the sites of Lottomatica, Sisal, PokerStars and 888 Casino.

What happens when an operator fails an audit?

Consequences scale with severity. A minor finding, such as late filing of a compliance report, usually produces a written warning and a remediation deadline of 30–90 days. A material finding, such as unreported suspicious transactions or commingled player funds, can trigger a fine, a suspension of new player registrations, or revocation of the licence.

Recent enforcement illustrates the range. Regulators across Europe have issued fines in the €100,000 to €5,000,000 band over the past three years for AML failures, with the largest penalties attached to cases involving inadequate source-of-funds checks on high-value customers. Licence revocations remain rare but are no longer theoretical.

For players, the signal is in the operator's response. A crypto casino that publishes its remediation plan, updates its terms, and adds new verification steps after a finding is behaving like a regulated business. Silence, or a quietly rewritten terms page, tells you something else entirely.

Choosing a Crypto Casino: Practical Checks

Which crypto casinos accept Italian players legally?

None of the ADM-licensed brands accept cryptocurrency. Sisal, Lottomatica, Eurobet, Snai, GoldBet, Betflag, StarCasinò, Planetwin365, William Hill and PokerStars operate in euro only, with deposits through Italian payment systems and verification at signup. Italian players who want crypto must look offshore, which puts them outside ADM's consumer-protection net.

Offshore brands commonly visible to Italian-language audiences include Stake, 1xBet, Betsson, 22bet, Rabona, Nomini, Powbet, Boomerang, Casinia and LibraBet. These hold Curaçao, Anjouan or Malta licences, accept BTC, ETH, USDT and often 20+ other coins, and publish their licence numbers in the footer. Language support in Italian varies from full localisation to machine-translated pages.

The legal exposure sits with the player, not the operator. Italian tax rules require declaration of gambling winnings earned abroad, and the Agenzia delle Entrate has been tightening reporting on cross-border digital payments. A crypto casino win is not invisible simply because it settled on-chain.

How fast are crypto withdrawals compared to bank transfers?

Blockchain settlement is quick. Once an operator approves a withdrawal, a BTC transfer typically confirms in 10–60 minutes, ETH in 1–5 minutes, and USDT on Tron or Polygon in under 2 minutes. Bank transfers through SEPA take 1–3 business days, and card withdrawals can stretch to 5 days depending on the issuer.

The approval step is where time goes. A first withdrawal at a crypto casino triggers KYC review, which adds 12–72 hours at most operators. Subsequent withdrawals from a verified account with a cleared wallet often process in under 30 minutes, especially at crypto-native brands that run automated compliance checks.

Watch the fine print on limits. Many crypto casinos cap daily withdrawals at the equivalent of €5,000–€20,000, with progressive limits unlocked by loyalty status. A few, including some Anjouan-licensed operators, enforce lower ceilings of €1,000–€2,000 per day, which matters if you hit a large jackpot on a Pragmatic Play or Hacksaw slot.

Which game providers should a serious crypto casino carry?

The provider list is a quick credibility signal. Evolution dominates live dealer tables, Pragmatic Play and NetEnt anchor the slots catalogue, Hacksaw Gaming brings high-volatility titles popular with crypto players, and Microgaming (now Games Global) supplies progressive jackpot networks that have paid out over €1.5 billion cumulatively.

Look for breadth rather than volume. A crypto casino with 8,000 titles from 90+ studios, including Play'n GO, Red Tiger, Nolimit City, Push Gaming and Big Time Gaming, is more likely investing in content licensing than a site padding its lobby with 30 unrecognised names. Licensed studios also carry the test certificates mentioned earlier.

Live casino deserves separate attention. A crypto casino running Evolution's full suite, including Lightning Roulette, Crazy Time and the live blackjack variants, is paying real licensing fees, which correlates with higher overall operational spending. Budget operators typically carry a single live provider or none at all.

What should you check before depositing at a crypto casino?

Five checks cover most of the risk: verify the licence number against the regulator's public register, confirm the withdrawal limits and KYC triggers in the terms, check whether player funds are segregated, read the bonus wagering requirements (30x–50x is normal, 80x+ is a warning), and look for an independent audit seal from eCOGRA, GLI or BMM.

Also check the responsible gambling tools. Reputable operators offer deposit limits, loss limits, session timers, cooling-off periods of 24 hours to 7 days, and self-exclusion options. In Italy, the RUA (Registro degli Utenti Autoesclusi) run by ADM lets players self-exclude from all licensed operators at once, a tool offshore crypto casinos cannot replicate.

Finally, test support before you fund the account. A 2-minute chat with a real question about withdrawal times tells you more than any homepage claim. Operators with 24/7 multilingual support and published response times, such as Bet365, bwin and StarCasinò, tend to handle disputes better than sites where support is a ticket form with a 48-hour promise.

Frequently Asked Questions

Is a crypto casino safe to play at?

Safety depends on the licence, not the currency. A Curaçao or Malta-licensed crypto casino with published audits, segregated funds and enforced KYC is measurably safer than an unlicensed site accepting anonymous deposits. Check the licence register, confirm the game testing certificates, and verify withdrawal limits before depositing anything.

Do crypto casinos pay taxes for Italian players?

In Italy, gambling winnings are generally not taxed for recreational players under current rules, but winnings earned from operators outside Italy must be declared, and crypto-to-euro conversions can trigger reporting obligations. Consult a commercialista for balances above a few thousand euro, especially where on-chain transactions complicate the paper trail.

How long does KYC take at a crypto casino?

Automated checks using providers like Jumio or Onfido clear documents in 5–30 minutes. Manual review, triggered by poor image quality or mismatched data, adds 12–48 hours. First-time withdrawals always take longer than subsequent ones; after the account is verified, most operators process payouts in under an hour.

Which coins do crypto casinos usually accept?

BTC, ETH and USDT cover the majority of deposits, with USDT on Tron being the most used network for low fees. Most operators also accept LTC, XRP, DOGE, SOL, TRX and a dozen stablecoins. Some, like Stake and Rabona, support 30+ coins; others stick to 5–8 to keep treasury management simple.

Can a crypto casino close my account after a big win?

Licensed operators cannot close an account arbitrarily; they must honour settled bets and process verified withdrawals. Account closure for terms violations, multi-accounting or bonus abuse is documented and usually comes with an explanation. Unlicensed sites have no such constraint, which is the single strongest argument for checking the licence before depositing.

What is the minimum deposit at a crypto casino?

Typical minimums run 0.0001 BTC, 0.01 ETH or 10 USDT, which translates to roughly €5–€20 depending on market rates. Some operators set higher floors of €20–€50 for bonus eligibility. Fiat-parallel casinos like NetBet, Betfair and Unibet usually require €10–€20 as a minimum first deposit.

Responsible gambling: gambling is for adults only. In Italy the legal age is 18 years. If play stops being fun, contact the national helpline at 800 558822 (free, 24/7) or use the ADM self-exclusion register RUA to block access to all licensed operators. Set deposit limits before you start, never chase losses, and never gamble with funds needed for rent, bills or savings.