Roughly one in every eight casinos we look at either lists a licence that does not exist, lists a real licence held by someone else, or lists a number in the format of a regulator that never issued it. It is not always malicious. Marketing teams reuse footers across regions, licences get revoked without the badge coming down, sub-brand pages point at the parent company holder without saying so. But whatever the reason, an unverified licence on our site is not a licence.
Here is the actual sequence we run for every operator that lands in our queue.
Step one. Copy the number from the operator's own footer, not from an affiliate list.
Affiliate directories are downstream. They copy each other, and their errors propagate. The licence number that matters is the one printed at the very bottom of the operator's live homepage, next to the regulator logo. If the footer only shows a logo and no number, we mark the check as failed at this step and move on.
A few operators show their licence on a dedicated page, often called "About us", "Legal" or "Licenças", rather than the footer. That is fine. What is not fine is a licence number that only appears in press releases, review sites or the About page of a sister brand.
Step two. Paste the number into the regulator's public register.
Every regulator we cover publishes a searchable register. Here is where they live:
-
UK Gambling Commission, the Public Register at gamblingcommission.gov.uk/public-register. Searchable by trading name, company number or licence account number.
-
Malta Gaming Authority, the Licensee Register on mga.org.mt. Search by company name; each entry shows the current licence class and status.
-
Spelinspektionen (Sweden), spelinspektionen.se under "Sök i licenshavarregistret". Every commercial online licence is listed with expiry date.
-
Spillemyndigheden (Denmark), "Tilladelsesindehavere" list on spillemyndigheden.dk. The Danish list does not always show a fresh issue date, so we cross-check against Wayback captures.
-
Kansspelautoriteit (Netherlands), the KOA register on kansspelautoriteit.nl. Every domain that legally offers online gaming is listed with the domain and the licence-holder.
-
ANJ (France), the list of agréments on anj.fr, broken down by product (paris sportifs, poker, hippiques). Casino is not on that list because online casino is not legal in France.
-
Curaçao GCB, the new Curaçao Gaming Control Board register at gaming-control.org. Old "sub-licences" under 1668/JAZ, 8048/JAZ, 5536/JAZ etc. are being phased out; the new format is OGL/2024/
Step three. Match three fields, not one.
A licence number that appears in a register is necessary but not sufficient. We match three fields before we accept the result. First, the licence status must be active, not revoked, not expired, not suspended. Second, the licence-holder in the register must match the trading name or the parent company disclosed on the operator's Terms of Service page. Third, the licence class must cover the product being offered on the site: a Curaçao Class B for lotteries does not cover a casino, a UKGC remote gambling software licence does not cover taking bets from consumers.
When those three fields line up, we mark the licence check as passed and move on to the payout audit. When any of them fails, the operator does not get scored. There is no diplomatic language, no "under review" category. The site is dropped from the toplist and the review is not published.
The spoofing patterns we now recognise on sight.
A few patterns come up often enough that we spot them without a register check:
-
MGA licences with a leading zero. Real MGA remote gaming licences follow the format MGA/B2C/ followed by three or four digits with no leading zero. Anything that reads "MGA/B2C/025/2018" with a leading zero is almost always fabricated.
-
Curaçao Master 1668/JAZ badges on new sites. The 1668/JAZ master licence was sunsetted. A new brand launched in 2025 claiming a 1668/JAZ number is either running under an old sub-licence quietly (which is being phased out) or has copied the badge from a template.
-
Sweden without a Spelpaus reference. Every Swedish-licensed operator must link Spelpaus. If we cannot find "Spelpaus" anywhere on the site, the SGA licence claim is fake, no matter how it appears in the footer.
-
Dutch sites without CRUKS wording. Same principle. The KSA requires CRUKS integration; an operator that never mentions CRUKS in its account or responsible gaming pages is not KSA-licensed.
Why we do not accept "Costa Rica" anywhere on this site.
Costa Rica does not license online gambling. It issues a general commercial data-processing permit that some casinos display in their footer as if it were a gambling licence. It is not, and the Costa Rican government has said so publicly. We reject any brand whose only claim is a Costa Rican "licence", there is no regulator to complain to when something goes wrong.
What passing the licence check gets you.
A passing licence check is the entry ticket, not the finish line. From there, the operator still has to survive the payout audit, the bonus fairness read, the game catalogue count, the support responsiveness test and the responsible-gambling tooling audit. Any one of those can knock a licensed brand out of the toplist.
But without the licence, nothing else matters. If the regulator does not know who you are, we do not either.