How to Choose a Safe Online Casino: Licences and Red Flags in 2026

A licence is permission from a regulator to offer gambling, tied to conditions: how the operator checks identity, handles player money, deals with complaints and protects people who gamble too much. How much that helps you depends on two things. Does the regulator actually enforce those conditions, and does its licence cover the country you play from?

The second question is the one most guides skip. A licence only makes an operator legal where that licence is recognised. Germany, Denmark, France and Bulgaria each license operators themselves and treat a foreign licence as no licence. Even Anjouan Gaming, the regulator behind many new crypto casinos, said in a public statement that "no licensing authority can exempt an operator from local law in jurisdictions where local authorisation is required".

So before comparing Curaçao with Anjouan, it helps to know that for a player in our four markets both are offshore licences. They tell you something about the operator, but you won't have the protection a national licence gives, such as the national self-exclusion register, deposit limits checked across operators or a regulator that can step in for you.

We record the licence in every review, together with the number and its source. Across the 39 casinos the picture on 9 November 2026 was:

• Curaçao: 23 casinos, among them Vavada, Mostbet, Stake, Winity, Goldex and BetWinner. Most publish a new-style number in the format OGL/2024/…, and for BetWinner we found the licence in the regulator's own register.
• Anjouan: 10 casinos, among them BC.GAME, PeerGame, Legiano and AllySpin.
• Both named: 1 casino. Celsius mentions Curaçao in its terms and an Anjouan licence in the site footer.
• Not confirmed: 5 casinos. For Zotabet, GW Casino, Pokie Spins, Spin Million and Prestige Casino the sources disagree (Curaçao, Tobique or no licence), so we say so in the review.
• German, Danish, French, Bulgarian or Maltese licence: none.

We don't hide this in the small print because it's the single most useful fact about any of these sites. If you want a casino that is legal in your country, the regulator's own list (see below) is the place to look, not a comparison site like ours.

For years a Curaçao licence usually meant a sub-licence under one of four master licence holders, with little checking by the government. That system ended when the National Ordinance on Games of Chance (LOK) came into force on 24 December 2024. The Gaming Control Board became the Curaçao Gaming Authority (CGA) and is now the only body that issues licences. Old licences stayed valid until 24 June 2025, with a possible six-month extension, which is why reviews in 2025 still quoted a mix of old and new numbers.

What changed for you as a player: an operator now holds its own licence from the regulator, usually with a number like OGL/2024/822/0338, and you can check the holder and its approved domains in the CGA register. We did this for Zotabet and found a licence for the parent company, but zotabet.com wasn't among the approved domains, which is why we list it as unconfirmed.

What didn't change: the CGA says on its own website that it does not handle individual complaints against operators and cannot mediate, arbitrate or order compensation. You can still email it, because complaints may point to breaches of the LOK, but the advice is to settle the dispute with the operator and, if that fails, through legal channels. A Curaçao licence is a better sign than it was in 2023. It still doesn't give you a body that will get your withdrawal paid.

Anjouan is one of the islands of the Comoros. Its licences have been issued since May 2023 and became popular with crypto casinos because they are cheap and quick to get. In July 2026 Anjouan Gaming said it had issued more than 1,650 internet gaming licences, of which nearly 1,500 were active. After a FATF report on money laundering risks in gambling it said it had tightened its licence conditions, without saying which ones (Focus Gaming News, September 2026).

The bigger issue is whether the licences are valid at all. In December 2025 the Central Bank of the Comoros called the Anjouan Offshore Finance Authority and Anjouan Corporate Services "fictitious entities". In October 2026 the Comoros government asked the UK for help against what the central bank called "illegal activity by people abusively using the name of the Comoros Islands", and said it is preparing legal action at home (Gambling.com and Casino.org, 20 October 2026). Anjouan Gaming maintains its licences are valid and cites a legal opinion it hasn't published.

We can't settle that dispute. What it means in practice is simple: treat an Anjouan licence as weak evidence. The 11 casinos in our list that name one get the same checks as everyone else, and their reviews say which licence they show. We haven't found any published complaints procedure from Anjouan that a player could use.

Germany. Online slots are legal only from operators licensed under the Interstate Treaty on Gambling 2021 and listed on the official whitelist of the Joint Gambling Authority of the Länder (GGL). For virtual slot machines § 22a sets the rules: a stake of no more than €1 per spin, an average spin time of at least five seconds, no autoplay, no jackpots and no playing several slots at once. Deposits are capped at €1,000 a month across all licensed operators together, checked through the LUGAS system, and OASIS is the self-exclusion register. Offshore casinos ignore all of this, which is exactly why they look more generous. A foreign licence has no validity in Germany.

Denmark. The Danish Gambling Authority (Spillemyndigheden) licenses online casino games under the Gambling Act; licences run for five years. Licensed sites must check ROFUS, the national self-exclusion register. Offering gambling in Denmark without a Danish licence is prohibited, and the authority regularly gets court orders to block unlicensed sites.

France. Online you can legally bet on sport and horse racing and play poker with operators approved by the ANJ, plus the games of FDJ. Slots, roulette and blackjack are banned online and only allowed in land-based casinos. A site that isn't on the ANJ's list of approved operators is illegal, even if it shows an ANJ logo, since illegal sites copy it. Since March 2022 the ANJ can block illegal sites itself; it blocked 1,337 in 2024.

Bulgaria. The National Revenue Agency (NRA) has licensed and supervised gambling since 2020 and keeps a public register of licensed operators and a blacklist of unlicensed sites that internet providers have to block. Licensed operators must check the national self-exclusion register; since 27 March 2025 the minimum exclusion is one year.

The national registers and limits only bind operators licensed in that country. If you've excluded yourself through OASIS, ROFUS, the ANJ or the NRA, an offshore casino won't know and won't stop you. Our responsible gambling page lists the helplines and blocking tools for each country.

Whatever the licence, these signs come up again and again in disputes:

• No licence details, or details that don't check out. A footer badge that isn't clickable, a licence number you can't find in the register, or a register entry for another company or domain.
• Terms that contradict each other or change often. Different complaint deadlines in different sections, vague "irregular play" clauses or fees for contacting a regulator are bad signs. Read the withdrawal and bonus sections before you deposit, and save a copy.
• No clear withdrawal limits. Our reviews list daily, weekly and monthly limits where the casino publishes them. If it doesn't, you find out when you win.
• Documents requested only after a win, and then again. One KYC check is normal, and it's easier if you do it right after sign-up. Repeated new requests after a large win are a common way to stall.
• Bonuses that look too good. A huge match with a high wagering requirement, a low maximum cashout or a short deadline is usually worth less than nothing. Our bonus terms guide and the wagering calculator show how to check.
• A pattern of the same complaint. Every big casino has some complaints. Search the name together with "withdrawal" or "account closed" and look for the same story told by different players.

1. Find the licence and check it at the source. Note the regulator, the number and the company name, then look them up in the regulator's own register, and check that the domain you're on is listed.

2. Read who you're contracting with. The terms name the operating company. If it differs from the licence holder or a payment agent appears, write the names down.

3. Check the withdrawal rules. Minimum and maximum withdrawal, processing time, fees and whether you must withdraw to the method you used to deposit. Our withdrawal guide goes through this step by step.

4. Do KYC early. Upload your documents before you play, not after a win.

5. Start small. Make a small deposit and a small withdrawal first. A casino that pays €20 in a day will probably pay €2,000 too; one that stalls on €20 won't improve.

6. Set your own limits. Offshore casinos don't connect to LUGAS, ROFUS or the NRA register, so use the casino's deposit limits and your bank's gambling block if you need them.

7. Ask support one question. How fast and how clearly they answer before you deposit tells you a lot.

Start with a written complaint through the casino's own complaints procedure. Include dates, amounts, transaction IDs and screenshots, and ask for a case number. Under the GDPR you can also ask for a copy of the personal data the casino holds about you, which sometimes shows how a decision on your account was made.

If that doesn't work, your options depend on the licence. Under an MGA licence you can lodge a complaint with the Malta Gaming Authority through its online form; it recommends trying the operator first. The CGA in Curaçao accepts complaints by email but says it won't intervene in individual cases. For Anjouan we found no complaints procedure.

Public complaint pages on large review forums sometimes help, because operators care about their reputation, but they have no legal power. If a casino owes you a lot of money, a lawyer is the realistic route. With an offshore operator that is slow and expensive, so the real protection is the checking you do before you deposit.

Checked on 9 November 2026: Curaçao Gaming Authority, online gaming page (LOK in force 24 December 2024, no handling of individual complaints); Intelium Law on the LOK transition (old licences valid to 24 June 2025); Focus Gaming News, 23 September 2026 (Anjouan licence numbers and tightened rules) and Anjouan Gaming's statement on local law; Gambling.com, 20 October 2026, and Casino.org, 19 October 2026 (Comoros government and central bank on Anjouan licensing); GlüStV 2021 § 22a (stake, spin time, autoplay, jackpots, parallel play) and Tech-Insider, August 2026 (LUGAS €1,000 limit, OASIS); SoftSwiss regulation map for Denmark (licences, ROFUS, blocking); Société Générale, April 2026, and the ANJ's 2025 brochure (games legal online in France, blocking powers, 1,337 sites blocked in 2024); Innovires Legal, April 2026 (NRA licensing, register, blacklist); Malta Gaming Authority complaint page. Licences of the casinos we review: our review data, each with its own sources and date.