Secure iGaming Licence in 2026: The Real Process Explained

Securing an iGaming licence in 2026 takes longer than almost every operator expects when they start. Not because the process is deliberately obstructive. Because the preparation required is more specific than most application guides describe, and most operators arrive at submission with gaps they didn’t know were gaps.

A Malta applicant in early 2024 submitted what felt like a complete package. Thirty-page AML policy. Detailed responsible gaming procedures. Nominated key functions with strong backgrounds. The MGA returned an information request six weeks later covering three items: the AML risk assessment needed to be rewritten for the specific target markets rather than describing a generic online casino, the source of wealth documentation for one UBO needed employment history covering an additional jurisdiction, and the compliance officer role structure needed clarification relative to the other key functions.

Fourteen weeks added. Not from a fundamental problem. From preparation gaps.

That’s the story this article is trying to interrupt.

The Provisional Licence Is Not the Finish Line

Worth getting this out of the way early. A provisional licence means the regulator has reviewed the ownership structure and compliance framework and found them acceptable in principle. It does not mean the operator can open to real-money players.

Go-live requires completed technical certification. RNG certification from an approved laboratory. Platform technical approval. Player fund protection verified and in place. Each of those has its own timeline.

RNG certification from first engagement to certificate: typically eight to fourteen weeks. Testing labs have queues. The most in-demand labs have booking backlogs. An operator who starts this process after receiving provisional approval is adding three to four months to their launch date. The right time to start certification is at application submission. Not after provisional approval. Not after the compliance review is done.

Operators who build launch plans around the provisional licence date rather than the go-live approval date consistently miss their launch dates by significant margins. This probably sounds like an obvious point. It’s consistently missed.

Secure iGaming Licence in Malta: What the MGA Actually Looks At

The Malta Gaming Authority‘s B2C application covers five areas. Ownership and UBO documentation. Financial requirements including share capital and player fund protection. The compliance framework AML, responsible gaming, data protection. Key function appointments. Technical and gaming system requirements. Any of the five can generate information requests independently. A gap in one pauses the whole review.

Secure iGaming Licence: Source of Wealth — Where Most Timelines Die

The ownership chain needs every entity documented. Every UBO above 10% needs source of wealth documentation that tells a verifiable story from income origin to funds available today.

This is where applications stall most often. Not because UBOs are hiding things. Because documenting complex wealth histories across multiple jurisdictions and business interests to regulatory standards takes more work than operators budget for.

A UBO with a salary history at a large employer and a straightforward asset accumulation: relatively straightforward to document. A UBO who sold a business, took proceeds across borders, reinvested in property, participated in a private equity exit, then funded a gaming operation: that’s a documentation project. Not impossible. Not fast.

Getting source of wealth documentation specialist-reviewed before submission is the single most effective thing an operator can do to reduce the Malta application timeline. This is not the place to cut costs.

Key functions — the substance problem that keeps appearing

Five mandatory roles under the MGA framework. Compliance Officer, MLRO, Responsible Gaming Function, Technical Function, Financial Function. The MGA assesses nominees their experience, their authority structure within the company, and whether the role is genuinely organised to give them independence.

Financial services compliance experience without gaming-specific experience is a flag. A Compliance Officer who has worked exclusively in banking compliance, with no gaming exposure, generates follow-up questions. The MGA has been reviewing key function nominees for years and can recognise the difference between someone with genuine gaming compliance background and someone with a generic compliance background that’s been repositioned for a gaming application.

The other consistent flag: compliance officers structurally subordinate to commercial directors. No direct board reporting line. The role exists on paper but doesn’t have the organisational independence that the MGA expects. These structures generate clarification requests that are slow to resolve because they involve restructuring, not just providing more documentation.

Secure iGaming Licence: AML Framework — Generic Versus Specific

This comes up repeatedly so it’s worth being direct about it. A generic AML framework one that describes what any online gaming operator’s AML programme looks like is not what the MGA is assessing. The MGA wants to see the risk assessment describe the actual business: the specific markets being served, the specific payment methods being accepted, the specific player profile, the monitoring thresholds calibrated to the expected transaction patterns of this operation.

Generic submissions generate specific information requests. The requests ask: what is the expected geographic breakdown of players, what is the risk assessment for each payment method accepted, how were the transaction monitoring thresholds calibrated. If the original submission doesn’t address those questions, it pauses until it does.

Curaçao After the LOK — Not What Pre-2025 Content Describes

The LOK reformed Curaçao licensing substantially. The sub-licence model ended. Direct applications to the Curaçao Gaming Authority are now how it works.

The Curaçao Gaming Authority application under the LOK involves genuine UBO fit-and-proper assessment, AML framework review, responsible gaming tool verification before go-live, and substance requirements that include both a Curaçao-incorporated entity and a managing director who genuinely lives in Curaçao. Content written about Curaçao licensing before 2025 describes a different process.

The resident managing director — where nominee arrangements fail

A managing director who has a Curaçao address but doesn’t genuinely live there doesn’t satisfy the requirement. The CGA has been verifying this. Whether a specific nominee service’s offering meets the genuine residency standard is a question worth asking explicitly before submission, with documentation of the answer. Discovering the issue during review is much more expensive than confirming it beforehand.

Genuine residency means genuine residency. It’s probably worth hiring a Curaçao-based compliance professional to advise on what the CGA specifically assesses rather than assuming a nominee arrangement covers it.

Secure iGaming Licence Timeline — Accurate Range, Variable Outcomes

Eight to sixteen weeks for a provisional licence from a complete, well-prepared submission. That range is accurate. Where an application lands within it depends on the same variables as Malta ownership documentation completeness, AML specificity, key person experience though the MGA depth of scrutiny is higher.

The go-live condition under the LOK is more substantive than pre-LOK. Platform technical approval and verified responsible gaming tool implementation before the operator can accept deposits. Operators who treat Curaçao as equivalent to the pre-2025 version and don’t plan for the go-live assessment find the timeline extends beyond what they budgeted.

What Actually Determines Whether Applications Move Fast or Stall

This is a harder question to answer than it looks, because the honest answer has two parts that don’t sit comfortably together.

Part one: preparation quality is entirely within the operator’s control and has a significant effect on timeline. Operators who invest in specialist legal review of source of wealth documentation before submission, who build specific rather than generic AML frameworks, who appoint key function nominees with demonstrable gaming experience and appropriate authority structures these operators consistently generate fewer information requests and experience shorter total timelines.

Part two: complex ownership structures take time regardless of preparation quality. A UBO chain with entities across four jurisdictions and private business histories spanning fifteen years is a documentation project that cannot be compressed beyond a certain point. You need to obtain, verify, and present the documentation correctly. That takes the time it takes.

What preparation quality determines is whether the timeline extends only as long as the complexity requires, or also extends for preventable gaps. The difference between those two outcomes can be six months.

Corporate Structure and Why It Matters Before the Application Starts

The corporate structure behind the licence application determines what the ownership disclosure looks like, how you frame the source of wealth documentation, what the AML framework must address, and how you organise the key function structure.

This point comes up because a lot of operators who approach gaming licensing have existing corporate structures built for other purposes tax efficiency, holding multiple businesses, earlier-stage planning that didn’t account for gaming licensing requirements. Those structures sometimes work fine for a gaming application. Sometimes they don’t, and the discovery of what needs to change comes mid-application when changing it is expensive.

There’s a version of this that comes up specifically with UBO chains built to optimise something else property holding, for example that have accumulated complexity across multiple jurisdictions that makes gaming licensing documentation very hard. The structure made sense for what it was built for. For a gaming application, it’s a problem that would have been much cheaper to address before the application than during it.

How to build or adjust the corporate structure to work for a gaming licence application is in iGaming corporate structure in 2026.

Secure iGaming Licence: What Securing the Licence Doesn’t Mean

The licence is not the finish line. I repeat this because operators consistently underweight it.

After go-live, the MGA conducts ongoing monitoring. Board reports are reviewed. AML monitoring records are assessed against what the submitted framework said would happen. Key function outputs are checked. Operators must undergo annual independent compliance audits, and auditors assess whether the compliance programme described in the application matches the one actually running.

It often isn’t. Operators who treated the application as the compliance exercise built the framework to pass the review, moved on to building the commercial operation, let the compliance programme drift are the ones generating findings in year two.

The compliance framework submitted in the application describes a programme. Running that programme is what maintaining the licence requires. Those two things sound the same. In practice they’re often different.

What the AML requirements look like operationally after licensing is in iGaming AML compliance in 2026. The full compliance checklist covering the ongoing obligations is in the iGaming compliance checklist in 2026. The jurisdiction decision that should come before the application is in iGaming licence jurisdictions 2026.

Frequently Asked Questions

How long does it actually take to secure an iGaming licence?

Malta: six to twelve months from a complete application to go-live approval. Curaçao: eight to sixteen weeks for provisional licence, with go-live requiring additional technical approval on top of that. Both ranges assume well-prepared complete submissions. Each information request round adds six to ten weeks. Operators who start technical certification at the same time as submission avoid adding another three to four months at the end.

What is the most common reason applications are delayed?

Source of wealth documentation gaps for UBOs with complex wealth histories. Then generic AML frameworks that don’t describe the specific business being licensed. Then key function nominees without demonstrable gaming-specific compliance experience. All three are fixable before submission discovering any of them mid-review is significantly more expensive in time and advisory cost than resolving them beforehand.

What is the difference between a provisional licence and go-live approval?

Large. A provisional licence means the regulator has completed its review of the ownership structure and compliance framework. It is not permission to accept real-money players. Go-live requires completed RNG and platform technical certification plus verified player fund protection. If you don’t start certification at application submission, expect three to four additional months after provisional approval before go-live.

Does the corporate structure matter for the licence application?

More than most operators account for. The structure determines what the UBO chain looks like, how you present the source of wealth documentation, what the AML framework must address, and how you organise the key function structure. Structures built for other purposes tax efficiency, holding multiple businesses sometimes create documentation complexity in gaming applications that would have been much cheaper to address before the application than during it.

What changed about securing a Curaçao licence after the LOK?

Applications now go directly to the Curaçao Gaming Authority. The application involves genuine UBO assessment, AML review, and verified substance requirements including a managing director who genuinely lives in Curaçao not a nominee with a theoretical address. Go-live verification under the LOK is more substantive than under the pre-2025 system. Curaçao is still faster and less expensive than Malta. The low-compliance version of Curaçao that pre-2025 content describes no longer exists.

What happens after the licence is secured?

Ongoing compliance monitoring. Board reports reviewed. AML monitoring records assessed against the framework submitted in the application. Annual independent compliance audits checking whether the compliance programme described in the application is the one actually running which it often isn’t, for operators who treated the application as the compliance exercise and then let things drift. Year two findings commonly stem from year one drift from the submitted framework.