Ontario iGaming regulations sit in three layers. The federal Criminal Code sets the base rule. Ontario’s Gaming Control Act, 1992 and Regulation 78/12 build on it. The Registrar’s Standards for Internet Gaming, issued by the Alcohol and Gaming Commission of Ontario, carry the operating detail. Registration gets you into the market, but the Standards govern how you run once you are in it. This guide covers the six risk themes, the Control Activity Matrix and its audit, the Centralized Self-Exclusion Program arriving in 2026, certification duties, annual compliance costs, and where operators fall short.
Key takeaways
- Regulator: Alcohol and Gaming Commission of Ontario (AGCO); iGaming Ontario (iGO) holds the operating agreement
- Legal basis: Gaming Control Act, 1992 and Regulation 78/12
- The Registrar’s Standards for Internet Gaming took effect on 4 April 2022
- Structure: the Standards are grouped into six risk themes
- Audit: an independently audited Control Activity Matrix is due before registration or within three months of go-live
- Self-exclusion: a Centralized Self-Exclusion Program launches in 2026 under Standard 2.14.1
- Scope: the framework covers players located in Ontario only
What Ontario iGaming regulations cover
The Criminal Code reserves the conduct and management of gambling to the province. Ontario meets that rule through iGaming Ontario. iGO conducts and manages the market, and private operators run their brands as its agents. The Gaming Control Act, 1992 and Regulation 78/12 then give the AGCO Registrar the power to set binding standards. You can read the Gaming Control Act, 1992 in full on the Ontario government site.
So Ontario iGaming regulations apply to three groups at once. Operators and gaming-related suppliers carry most of the duties. Several standards, though, place obligations on iGaming Ontario itself. That split matters when you map each requirement to an owner inside your compliance function. If you are still at the entry stage, our guide to the Ontario iGaming licence covers eligibility, fees and the registration route.
The six risk themes in the Registrar’s Standards
Ontario iGaming regulations group the Standards by risk rather than by department. That structure matters when you build a compliance map. One business unit often carries duties drawn from several themes at once. The six themes are set out below.
| Theme | What it governs |
|---|---|
| Entity level | Governance, code of conduct, conflicts of interest, dealings with the Registrar |
| Responsible gambling | Player limits, high-risk play, self-exclusion, safer gambling messaging |
| Access and player accounts | Age and identity checks, excluded persons, account controls, player funds |
| Game integrity and player awareness | Game design, return to player disclosure, certification of games and systems |
| Public safety and protection of assets | Information security, data protection, business continuity |
| Minimising unlawful activity | Anti-money laundering controls, betting integrity, incident reporting |
Each theme contains numbered standards, and most standards carry requirements beneath them. In practice you treat the requirement as the unit of compliance, not the theme. The current text sits on the AGCO’s Registrar’s Standards for Internet Gaming page. The AGCO then amends it through published bulletins.
Responsible gambling and the 2026 self-exclusion change
Responsible gambling carries the heaviest ongoing duties in Ontario iGaming regulations. Operators identify players at risk of harm, act on what they find, and record what they did. The AGCO issued a 105,000 CAD penalty to one operator over an alleged failure to address a patron’s high-risk gambling. So the regulator tests outcomes, not policy documents.
The bigger change lands in 2026. iGaming Ontario is launching a Centralized Self-Exclusion Program. The AGCO published new Standard 2.14.1 on 2 April 2026 to support it. Players will exclude themselves from every regulated site through one registration, in six-month, one-year and five-year terms. Operators also keep their own site-level programme under Standard 2.14. The AGCO will revisit that requirement no more than 12 months after the central programme goes live.
The operational requirements are specific. Once a person joins the Centralized Self-Exclusion Registry, you have 24 hours to stop all marketing to them. In the same window you cancel their outstanding wagers and refund them to the player wallet. Wagers on events starting within those 24 hours sit outside the refund duty. When you confirm that a logged-in player has joined the Centralized Self-Exclusion Registry, log them out immediately. You also hold a mechanism to return unused funds, and you plan for registry outages. A system disruption does not suspend the duty to keep those players out. Our compliance and AML officer roles own this work day to day.
Control Activity Matrix requirements under Ontario iGaming regulations
The audit duty is the part of Ontario iGaming regulations that first-time applicants most often underestimate. Every operator documents the controls it uses to meet each applicable standard. Those controls are then summarised in a Control Activity Matrix. The CAM covers all controls related to the gaming site, including controls sitting inside a third-party platform. For that reason you assemble it with your platform provider rather than alone.
The CAM then goes to an independent audit. The reviewing unit must not have helped build the matrix. So an internal audit function that stayed outside the project can do it, or an external auditor can. The audit result confirming compliance goes in with the submission. Timing depends on the risk rating the AGCO assigns during eligibility review.
| Risk assessment | CAM submission deadline |
|---|---|
| Elevated risk at eligibility review | May be required with the application, before registration is issued |
| Not assessed as elevated risk | Within three months of the go-live date in Ontario |
The AGCO lists what pushes an applicant into the elevated group. The factors include no prior igaming experience and no licences held elsewhere. A history of significant non-compliance counts, and so does a gap analysis showing a poor grasp of the Standards. Because the CAM can then gate the registration itself, build it early. The detail sits in the AGCO’s Control Activity Matrix requirements. Suppliers running critical gaming systems hold their own CAM and confirm it in a technology letter. They do not file it unless the AGCO asks.
Game and system certification duties
Games, random number generators and critical gaming systems need certification before they go live. The testing is done by an Independent Testing Laboratory registered with the AGCO. Because the duty is continuous, every new studio, game release or platform change brings its own testing scope. Certification evidence must exist when the game is offered, not when the regulator asks for it.
Enforcement under Ontario iGaming regulations is routine here. The AGCO issued 70,000 CAD in penalties across three operators for offering uncertified slot games. It has also ordered operators to stop taking bets on specific events over betting integrity concerns. A 350,000 CAD penalty against one operator concerned the reporting of unusual and suspicious betting activity. So the reporting duties carry the same weight as the technical ones.
Advertising and inducement rules
Ontario iGaming regulations prohibit public advertising of bonuses, inducements and credits. The ban covers every channel, including affiliate sites, search and social. You may present an offer on your own platform. You may also send it directly to a player who has actively consented. Standard 2.03 bars active and retired athletes from igaming advertising, apart from responsible gambling messaging. Our guide sets out the Ontario advertising restrictions in detail.
Affiliate conduct is your exposure. Liability follows the brand being promoted, so an affiliate breach reaches the operator. Operators arriving from markets with looser promotion rules often find the closest comparison in the Italy gambling advertising ban. The full marketing detail and the fee structure sit in our guide to AGCO registration and the iGO agreement.
What compliance costs an Ontario operator each year
The 100,000 CAD annual regulatory fee per gaming site is the visible number. The recurring compliance spend sits underneath it, and most of it goes to third parties. The table below sets out what an Ontario budget carries after launch.
| Recurring item | What drives the cost |
|---|---|
| Independent CAM audit | Standards in scope, and internal audit versus an external firm |
| ITL certification | Volume of new games and system changes released each year |
| Responsible gambling programme | Monitoring tools, staff training, self-exclusion handling |
| Regulatory reporting | Incident reports, data submissions, responses to AGCO requests |
| Compliance staffing | Named owners per theme, plus AML and reporting functions |
| Legal and advisory | Standards interpretation, enforcement responses, iGO agreement changes |
Ontario iGaming regulations also let the AGCO charge investigation costs on top of the regulatory fee. Those costs are not fixed in advance. For that reason, treat the annual fee as a floor rather than a total. See what Ontario registration costs in full for the fee schedule and the investigation cost position. Our audit and reporting support covers the assurance side. The wider financial reporting obligations for licensed operators run alongside it.
Common breaches of Ontario iGaming regulations
Published enforcement shows a consistent pattern, and none of it involves obscure rules. The recurring failures are these:
- Games or systems offered without current ITL certification
- High-risk play identified by the system but not acted on or documented
- Unusual or suspicious betting activity not escalated within the reporting window
- Bonus and inducement content published by affiliates outside the permitted channels
- A CAM that describes intended controls rather than controls in operation
- Marketing sent to a self-excluded player after the exclusion took effect
Each of these is a control failure rather than a drafting failure. Ontario iGaming regulations are enforced on evidence, so the fix is ownership. Name the person accountable for every standard. Evidence the control monthly, and keep the CAM current between audits. Our gaming licensing compliance team builds that control map and updates it as the AGCO issues bulletins.
What the Ontario framework does not cover
Ontario iGaming regulations authorise play by users physically located in the province. The framework gives no access to other Canadian provinces, and each province sets its own rules. Alberta has legislated a separate regulated market, which will require its own registration when it launches. Our Alberta iGaming Act overview sets out that framework. Outside Canada, an Ontario registration carries no weight in the European Union, the United Kingdom or the United States. In the United States each state runs its own regulator, such as the Michigan Gaming Control Board.
Two further limits matter operationally. First, federal anti-money laundering law applies independently of the Standards. Provincial compliance does not discharge your duties under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Second, iGO market data excludes OLG’s own igaming offering and pari-mutuel horse racing wagering. That is why published figures for Ontario iGaming revenue describe the private-operator market only. If you are weighing Ontario against another market, our gaming licence acquisition service maps the obligations side by side.
Planning against Ontario iGaming regulations
Two dates decide your first year. The first is the CAM submission deadline set in your AGCO notification. The second is the go-live of the Centralized Self-Exclusion Program in 2026. Confirm both in writing with the AGCO before you fix a launch date, because an elevated-risk rating moves the audit ahead of registration. For a costed Ontario compliance plan, contact the DD Consultus advisory team at contact@licencegaming.com or +356 99408536.
Frequently asked questions
Who regulates iGaming in Ontario?
The Alcohol and Gaming Commission of Ontario regulates the market and registers operators and suppliers. iGaming Ontario conducts and manages the market and holds the operating agreement with each registered operator. Both bodies draw their authority from the Gaming Control Act, 1992 and Regulation 78/12.
What are the Registrar’s Standards for Internet Gaming?
They are the binding rules the AGCO Registrar sets for the Ontario igaming market, in force since 4 April 2022. The Standards are grouped into six risk themes. Those themes cover entity-level governance, responsible gambling, access and account controls, game integrity, asset protection and unlawful activity.
What is a Control Activity Matrix?
A Control Activity Matrix summarises every control an operator uses to meet the applicable standards for its gaming site. It must be independently audited by a function that did not build it. The audit result is submitted with it. Suppliers running critical gaming systems keep their own matrix.
When must an operator submit its CAM?
Timing depends on the risk rating the AGCO assigns during eligibility review. Operators assessed as posing elevated risk may have to submit the matrix before registration is issued. All other operators submit within three months of going live in Ontario.
What is the Centralized Self-Exclusion Program?
It is an iGaming Ontario programme launching in 2026. A player will exclude themselves from every regulated site through one registration, in six-month, one-year or five-year terms. Standard 2.14.1 requires operators to block those players, stop marketing within 24 hours, and refund outstanding wagers to the player wallet.
Can operators advertise bonuses in Ontario?
Public advertising of bonuses, inducements and credits is prohibited on every channel, including affiliate content and social media. An offer may appear on the operator’s own site. It may also go directly to a player who has actively consented. The AGCO has issued penalties for affiliate inducement marketing.
Do Ontario iGaming regulations replace federal AML rules?
No. The Registrar’s Standards contain anti-money laundering requirements, but federal law applies separately. Operators report under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act as well. Both sets of obligations are evidenced separately.
Does an Ontario registration cover the rest of Canada?
No. It authorises play by users located in Ontario only, and other provinces run their own frameworks. Alberta has legislated a separate regulated market that will require its own registration when it opens.