Crypto Casino: What a Licence Really Costs Operators in 2026

A crypto casino lives or dies on paperwork. Players see the slots and the welcome bonus; regulators see transaction logs, source-of-funds forms and audit trails. This guide walks through what it takes to obtain and keep a gambling licence while handling Bitcoin, Ethereum and stablecoin deposits across regulated markets.

What defines a crypto casino in 2026

Is a crypto casino legal in Italy and the EU?

Legal where the licence says it is. In Italy, ADM (Agenzia delle Dogane e dei Monopoli) authorises online gambling under the D.Lgs. 313/2001 framework, and crypto-denominated balances are treated as a payment instrument, not an exemption. A crypto casino serving Italian players must hold a valid ADM concession and report in euro.

Crypto does not launder away regulatory obligations. Any operator accepting deposits in BTC, ETH or USDT from Italian residents falls under the same AMLD5 rules as a bank: customer due diligence above €15,000 in cumulative crypto flows, transaction monitoring and suspicious-activity reporting to the Financial Intelligence Unit.

Offshore licences from Curaçao, Anjouan or Kahnawake remain common among crypto-native brands, but they do not authorise Italian-facing activity. Curaçao's Gaming Authority restructured licensing in 2024 into four separate classes, tightening capital and responsible-gambling requirements, yet none of those classes carry EU passporting rights.

Which coins do licensed operators actually accept?

Bitcoin and Ethereum dominate, but stablecoins carry most of the deposit volume. USDT on Tron and ERC-20 plus USDC account for the bulk of crypto gambling turnover because players want price stability while a session runs.

Licensed operators typically list 8 to 25 coins, with BTC, ETH, USDT, USDC, LTC, XRP, SOL, DOGE, TRX, ADA, BNB, MATIC, TON, DAI, BCH, LINK, AVAX, SHIB, DOT, UNI, ATOM, XLM, NEAR, APT, ARB, OP, BUSD, FDUSD, TUSD, EURT, CHZ, ENJ, SAND, MANA, GALA, AXS, FTM, ALGO, IOTA, EOS, THETA, FLOW, EGLD, HBAR, QNT, AAVE, MKR, CRV, UNI, GRT, LDO, SNX, COMP, SUSHI, YFI, 1INCH, ZRX, BAT, ZIL, KSM, WAVES, NEO, QTUM, ZEC, DASH, XMR, PIVX, GRS, VTC, RVN, ETC, BTG, BTM, XEM, STRAT, KMD, LSK, ARDR, NXT, PPC, VIA, XVG, DCR, XST, BLK, FTC, NMC, NVC, PPC, and XPM listed at various points.

Monero and other privacy coins are the exception. Malta's Gaming Authority and ADM both require operators to reject privacy coins because chain analytics cannot trace flows, which breaks the AML obligation. Operators that accept XMR do so under offshore licences and are automatically excluded from EU-facing white-label partnerships.

How is a crypto casino different from a fiat online casino?

Settlement speed and volatility are the two structural differences. A fiat deposit clears through Satispay, PayPal or a card acquirer in minutes; a crypto deposit confirms on-chain in 10 seconds on Solana or 30 minutes on Bitcoin base layer. The operator carries price risk between deposit and withdrawal unless it converts to fiat immediately.

KYC timing changes too. With fiat rails, the bank has already verified the customer. With crypto, the operator must run identity checks itself, plus wallet-screening through providers such as Chainalysis or Elliptic to flag mixer outputs, sanctioned addresses and darknet-linked funds before crediting a balance.

Licence types operators pursue

What does an ADM concession require in Italy?

The Italian online gambling concession is the hardest licence in Europe to obtain and the most expensive to keep. Applicants must demonstrate share capital, a technical platform certified by an authorised laboratory, an Italian-domain (.it) presence, and a guarantee deposit currently set at €1,500,000 for online casino games plus separate sums for poker and bingo verticals.

Processing takes 6 to 12 months from complete submission. ADM reviews the beneficial ownership chain, the AML policy, the responsible-gambling tools and the RNG certification. Any change of control above 10% triggers a fresh notification and can suspend the concession while the file is re-examined.

Operators holding the concession include Lottomatica, Sisal, Snai, Eurobet, GoldBet and Planetwin365. All of them report GGR monthly and pay a concession tax that, for online casino, runs at 25% of gross gaming revenue after the 2024 budget adjustment.

Which offshore licences do crypto casinos prefer?

Curaçao remains the default for crypto-native operators: application fees start around $40,000 for a master licence holder's sub-licence, with annual renewals near $12,000 and a 2% to 4% GGR tax. Anjouan under the 2023 e-gaming law quotes $17,500 upfront and roughly $30,000 in year one all-in, which explains its rapid adoption since 2024.

Kahnawake, Isle of Man and Gibraltar sit higher: Gibraltar's Class 1 remote-licence fee is £100,000 per year, Isle of Man's remote-operations licence costs £35,000 plus a 0.1% to 1.5% GGR levy, and Kahnawake charges $40,000 setup with $20,000 annual maintenance. None of these authorise Italian-facing play.

Anjouan's growth has been remarkable: the jurisdiction issued over 200 licences by the end of 2025, up from fewer than 30 in 2023. The trade-off is thin enforcement; players depositing to an Anjouan-licensed crypto casino have no EU ombudsman to escalate to.

Malta vs Curaçao for a crypto operator

Malta Gaming Authority's Critical Gaming Supply licence (B2B) costs €5,000 in application fee and €25,000 annual licence fee, plus a compliance officer salary requirement. It carries EU credibility and lets a brand white-label into regulated markets. Curaçao costs less and moves faster, but banks treat it as higher risk when opening merchant accounts.

The choice is rarely about the licence itself. It is about which banking partners, game aggregators and payment processors will work with you afterwards. A Curaçao licence gets a crypto casino live in four months; a Malta licence gets it a merchant account with a Tier-1 processor.

AML obligations for crypto gambling operators

What is the AMLD5 threshold for crypto transactions?

EU Anti-Money Laundering Directive 5 (2018/843) brought virtual-asset service providers inside the perimeter. For crypto casinos operating in Europe, the operative thresholds are €15,000 for occasional transactions requiring enhanced due diligence and €1,000 for any single crypto transfer requiring full identity verification under the transfer-of-funds rule.

Practically, that means a player depositing 0.02 BTC (roughly €1,700 at early-2026 prices) must be identified before the balance is usable. Operators who credit anonymous deposits are running an unlicensed financial service alongside their casino, and that is the charge that has closed brands in the Netherlands and Germany.

The 2024 AML package (Regulation 2024/1624, Directive 2024/1640, AMLA regulation) replaces the directives from 2027. AMLA in Frankfurt will supervise the riskiest cross-border entities directly, and crypto casinos above the €100m annual turnover threshold will be in that first supervisory cohort.

How do operators screen wallet addresses?

Chain-analytics tools score every deposit address before funds are credited. Chainalysis Reactor, Elliptic Lens and TRM Labs are the three most integrated APIs in gambling stacks; they return a risk tier (clean, elevated, high) plus attribution tags such as mixer, sanctioned entity, darknet market or ransomware wallet.

A high-risk score triggers one of three outcomes: outright rejection, manual review by the compliance desk, or acceptance with a source-of-funds questionnaire. Licensed operators document the decision either way, because an auditor will sample 50 to 100 transactions per quarter and expect a paper trail on each.

• Pre-deposit screening against OFAC, EU and UN sanctions lists, refreshed daily
• Post-deposit monitoring for structuring patterns: 4 to 6 deposits just under the €1,000 threshold within 24 hours
• Withdrawal checks against the original deposit route, with re-verification above €2,000 cumulative
• Periodic re-screening of stored addresses every 90 days for newly sanctioned wallets

Who files the suspicious activity report?

The Money Laundering Reporting Officer (MLRO) signs off. In Italy that person must be nominated to ADM and hold a clean professional record; in Malta the MGA requires a Key Function Holder for AML with a recognised certification such as ICA or CAMS. The report goes to the national FIU within the timeframe set by local law, typically 24 to 72 hours after suspicion crystallises.

Failure to file carries personal liability. In 2025 the Dutch KSA fined an offshore operator €1.7m partly for missing SARs, and the UK Gambling Commission's 2024 settlement with a major brand included a £19m penalty where weak transaction monitoring was cited across 11 months of activity.

The conclusion is blunt: an operator that cannot name its MLRO, produce three months of SAR logs and show the escalation path on request is not running a compliant crypto casino, whatever the licence certificate on the homepage says.

KYC in practice for crypto players

When must a crypto casino verify identity?

Before the first withdrawal, always. Before the first deposit, in most regulated markets. Italy, Spain, France, Germany and the Netherlands all require verification at registration or before funds are staked, while Curaçao and Anjouan permit verification at withdrawal, which is why anonymous play survives offshore.

Standard documents: passport or national ID, proof of address dated within 90 days (utility bill, bank statement, council tax notice), and a selfie with the document for liveness checks. Crypto-native operators add a wallet-ownership attestation for withdrawals above €5,000, asking the player to sign a message from the destination address.

Turnaround matters commercially. Automated KYC vendors such as Sumsub, Jumio and Veriff clear 70% to 85% of cases within 90 seconds, and the rest route to manual review inside 4 hours. Anything slower and deposit conversion drops, because players bounce to the next brand.

How does source-of-funds verification work for large deposits?

Triggers are set by risk appetite, not by law alone. Typical thresholds: cumulative deposits of €5,000 in 30 days, any single deposit above €10,000, or a pattern of rapid deposit-withdrawal cycling. Above those, the operator requests payslips, tax returns, sale contracts or exchange statements proving the crypto was not obtained illicitly.

The uncomfortable part for players is that mining rewards, airdrops and DeFi yields are hard to document. Operators accept a wallet history export from a reputable exchange as sufficient when the deposit route is traceable to a KYC'd venue, and reject cold-wallet transfers with no provenance more often than not.

Conclusion: source-of-funds is not a formality. It is the single most common reason a €50,000 withdrawal sits in review for 72 hours, and no amount of VIP status shortens it below the compliance floor.

What happens when a player fails KYC?

The account is frozen, not closed. Funds remain in a segregated account while the operator issues one remediation request with a 7-day deadline. If documents do not arrive or fail liveness, the balance is returned to the original crypto deposit address where possible, or held pending a legal process if the source is disputed.

Repeat failures are logged. A player who fails KYC at three brands inside a shared fraud database will be auto-declined at the fourth; operators exchange these signals through services like the European Gaming and Betting Association's integrity scheme.

Final position: a crypto casino that lets a failed-KYC player withdraw to an unrelated wallet has effectively laundered the deposit, and regulators treat that as a control failure even when no criminal proceeds were involved.

Audits, RNG and ongoing compliance

Which labs certify casino games for crypto operators?

eCOGRA, GLI (Gaming Laboratories International), BMM Testlabs and iTech Labs are the four names that appear in licence files. Each audits the RNG, measures return-to-player over millions of simulated spins, and issues a certificate with an expiry date that ADM, MGA and the KSA all accept.

Typical cost: €8,000 to €25,000 per game family, with annual re-testing at 20% of the original fee. A crypto casino launching with 1,200 slots from Pragmatic, NetEnt, Play'n GO, Hacksaw, Nolimit City and Evolution will spend €150,000 to €300,000 in the first certification cycle, then €30,000 to €60,000 annually to keep certificates current.

Provably-fair crypto games get audited differently. The hash-seed mechanism is verified mathematically rather than statistically, so a lab will publish the algorithm and let players recompute outcomes. It does not replace a licence, but it does answer the trust question players actually ask.

How often must a licensed operator submit to audit?

Quarterly financial audits in Malta and Italy, semi-annual in Curaçao, annual in Anjouan with no fixed technical audit requirement. Italian operators additionally file monthly GGR returns to ADM by the 15th of the following month, with payment due by the 20th.

Technical audits cover the wallet infrastructure: hot/cold storage split, key management, insurance coverage on custodied funds and disaster recovery. A typical requirement is 95% of player balances held in cold storage with multi-signature withdrawal approval by two of three key holders.

Unannounced audits exist. MGA conducts them under its compliance framework, and ADM inspectors can request the transaction database with 48 hours' notice. An operator whose reporting only works when the finance team has warning is an operator that will fail one.

What responsible-gambling tools must be built in?

Deposit limits, loss limits, session-time limits, reality checks every 60 minutes, self-exclusion and a cooling-off period of 24 hours to 6 weeks. Italy's RUA (Rete degli Autoesclusi) register, operated by ADM, blocks self-excluded players across every licensed brand simultaneously, and operators must reconcile their player lists against RUA daily.

Crypto adds a loophole: a self-excluded player can register with a fresh wallet. Licensed operators therefore match on identity documents, not on wallet address, which is why KYC at registration is a responsible-gambling control as much as an AML one.

The requirement is unambiguous. A crypto casino without working self-exclusion, limit tools and a visible 18+ notice cannot hold a licence in Italy, Malta or any EU jurisdiction, and offshore brands that skip these tools are excluded from every regulated market entry.

Top operators running crypto-friendly casinos in 2026

Which ADM-licensed brands accept crypto indirectly?

Lottomatica, Sisal, Snai, Eurobet and GoldBet all support deposits through licensed crypto-on-ramp providers, converting to euro at the point of transaction so the ledger stays in fiat. The player sees a BTC amount; the operator books EUR. Planetwin365 and BetFlag followed the same pattern from mid-2025 after ADM clarified the treatment of virtual-asset intermediaries.

StarCasinò and Bwin added crypto deposit rails in Q1 2026 through a partnership with a MiCA-licensed exchange, making them the first Italian-facing brands where a player can move value from a self-custodied wallet without an external conversion step. Withdrawals still settle in euro to an Italian IBAN.

Expect more. The MiCA framework (Regulation 2023/1114) fully applied from December 2024, and once a CASP (crypto-asset service provider) is authorised in one member state it can passport across the EU, which gives ADM a regulated counterparty to point at.

Which offshore crypto casinos are most visible to Italian players?

Stake, 1xBet, Betsson, Betsson-owned Rizk, 22Bet, BetWinner, Mystake, Rolletto, Jackbit and Lucky Block dominate affiliate listings aimed at Italian-language traffic. Most hold Curaçao or Anjouan licences; a few operate with no verifiable licence at all, which is a different risk category entirely.

Stake and Betsson at least publish monthly payout figures and hold publicly audited financial statements. Mystake and Jackbit publish game counts and bonus terms but rarely disclose ownership. The distinction matters when a withdrawal dispute has nowhere else to go.

Italian players accessing these sites do so outside the ADM perimeter. Winnings are not covered by the Italian consumer-protection regime, and ADM's blacklist (the "oscuramento" orders) blocks hundreds of unlicensed domains each year, currently over 9,000 URLs listed since the mechanism began.

How do the big brands compare on crypto support?

The table below summarises publicly stated coin counts, licence type and typical withdrawal times for crypto-capable operators as of early 2026. Figures come from operator terms pages and published payout reports; where a brand does not disclose, the cell says so.

What separates a credible crypto casino from a risky one?

Published licence number you can verify on the regulator's register, named MLRO or compliance officer, published RTP certificates from GLI or eCOGRA, and a complaints process with a 7-day response window. Four checkboxes, and most brands fail at least one.

Second tier of evidence: segregated player funds, published audit summary, insurance on custodied crypto, and a responsible-gambling page that does more than link to GamCare. Operators like Bet365, William Hill and 888 Casino clear all of these in their regulated markets, though their crypto support varies by jurisdiction.

The answer, in one line: a crypto casino is credible when its licence, its audits and its withdrawal records are all publicly verifiable without contacting support.

Costs, timelines and the 2026 outlook

How much does it cost to launch a licensed crypto casino?

Budget lines for a mid-size operation targeting regulated EU markets: licence and guarantee deposits €500,000 to €2,000,000; game content aggregation €100,000 to €250,000 annually; KYC and AML tooling €60,000 to €180,000 per year; compliance staff (MLRO, AML analyst, two QA) €250,000 to €400,000 in salaries; audit and certification €150,000 to €300,000 in year one.

Working capital matters more than founders expect. Payment processors hold reserves of 5% to 15% for the first 6 months, and crypto custody providers require insurance deductibles. A realistic launch budget for an ADM-facing crypto casino sits between €3m and €6m before the first euro of revenue.

Timeline: 6 to 12 months for the licence, 2 to 4 months for platform build and certification, 1 month for soft launch with capped stakes. Total 9 to 17 months from decision to full operation, assuming no adverse findings in the ownership review.

What will regulators change next?

Three concrete changes are already legislated. AMLA begins direct supervision in 2027 with a crypto-focused unit. The EU's Regulation on transfer of funds and crypto-assets applies from December 2026, requiring originator and beneficiary information on every crypto transfer regardless of amount. And Italy's ADM has signalled a review of the concession tax structure in the 2026 budget, with a shift from turnover-based to GGR-based reporting under discussion.

Expect tighter advertising rules too. Italy already bans gambling ads on broadcast media outside specific windows; extending that to influencer and affiliate content is under consultation, with a decision expected by mid-2026.

The direction is fixed: more reporting, faster deadlines, higher penalties. Operators that treat compliance as a launch cost rather than a running cost will be the ones paying seven-figure fines in 2027.

Should a player choose a licensed crypto casino over an offshore one?

Yes, when the licence covers their jurisdiction. A regulated brand gives deposit limits that actually work, a self-exclusion register that blocks across operators, segregated funds if the company fails, and a complaints route to a regulator with fining power. An offshore brand gives none of those, though it may offer faster payouts and higher bonus ceilings.

The trade-off is real and worth stating plainly: regulated crypto casinos in Italy convert to euro, cap bonuses at €5,000 wagering requirements per promotion, and verify identity at registration. Offshore brands accept anonymous play, pay in crypto directly, and answer to a regulator most players have never heard of.

Choose with eyes open. Verify the licence number on the regulator's own register before depositing, check the RTP certificate date, and read the withdrawal terms for maximum processing time. That takes ten minutes and prevents most disputes.

Frequently asked questions

Is a crypto casino safe to play at?

Safe when the operator holds a verifiable licence, publishes audit certificates and keeps player funds segregated. Check the licence number against the regulator's register, confirm RNG certification from GLI or eCOGRA is current, and read withdrawal limits before depositing. An unlicensed crypto casino offers no recourse if funds disappear.

Do I pay tax on crypto casino winnings in Italy?

Yes. Italian tax law treats gambling winnings as income above €500 per session at 20%, rising to 25% for amounts above €1,000 under the current regime. Winnings from unlicensed offshore sites are also taxable and, separately, may constitute an administrative offence under the ADM framework.

How long does a crypto casino withdrawal take?

On-chain settlement is minutes, but licensed operators hold withdrawals pending KYC checks. Expect 10 to 60 minutes for a verified account under €1,000, and 24 to 72 hours for larger sums or first-time withdrawals. Operators with a 7-day pending window are within their rights but should be disclosed in the terms.

Can a crypto casino block my account without reason?

Not without reason stated in the terms. Licensed operators must cite a specific clause, usually related to KYC failure, bonus abuse or duplicate accounts, and must return deposited funds if no breach occurred. Offshore brands can freeze balances with less explanation, which is the main practical downside of an unregulated site.

Which cryptocurrencies are best for casino deposits?

Stablecoins first: USDT and USDC keep balance value stable during a session and settle fast on Tron and Polygon. Bitcoin base layer is slowest at around 30 minutes confirmation; Solana and Litecoin clear in seconds. Avoid privacy coins at licensed sites, which reject XMR deposits by policy.

What is the minimum age for a crypto casino?

18 across Italy, Malta, Curaçao and most EU jurisdictions; 21 in a handful of US states where crypto gambling is licensed. Licensed operators verify age at registration through document checks, and self-exclusion registers block underage attempts across all participating brands simultaneously.

Licences, AML controls, KYC workflows and audits are the four load-bearing walls of any crypto casino, and the operators that treat them as afterthoughts are the ones regulators shut down first.