New Casino Sites: What a Licence Actually Costs Operators

Every month another wave of new casino sites launches in the UK, each one promising a fresher lobby, a bigger welcome package, a smarter app. Most punters judge them on slots and bonuses. The sharper question is what it took to get the licence in the first place, and what it takes to keep it.

This page runs through the accountability side of the market: the UK Gambling Commission's licence conditions, the anti-money laundering obligations, the identity checks, the independent audits, and the enforcement actions that catch operators out. Concrete numbers, real cases, and the brands currently operating under those rules.

What It Takes to Launch a New Casino Site in the UK

A UK-facing casino cannot simply go live. The Gambling Act 2005 requires an operating licence from the Gambling Commission, and the application alone runs to hundreds of pages covering ownership, funding sources, key persons, and technical systems. Median processing time sits around 16 weeks for a remote casino licence, though complex group structures stretch longer.

Application fees are tiered by gross gambling yield. For a remote casino, the Commission charges a fee based on band, with the lowest band starting at £5,000 and higher bands reaching into six figures for large operators. On top of that sits an annual fee and a regulatory return submitted each quarter.

How long does a UK casino licence application actually take?

From submission to a decision, expect 4 to 6 months for a clean application with straightforward ownership. Anything involving offshore holding companies, layered beneficial ownership, or prior regulatory history adds 2 to 4 months of additional review. The Commission's published guidance states decisions on standard remote applications are targeted within 16 weeks of a complete submission.

Who are the "key persons" a new site must declare?

Every licensee must nominate key persons: typically the CEO, the compliance officer, the money laundering reporting officer, and anyone with 10% or more control of the business. These individuals pass fit-and-proper assessments, disclose bankruptcy and criminal history, and can be suspended personally if the operator breaches its duties. It puts named faces behind corporate decisions.

What technical standards must the gaming software meet?

Random number generators and game logic must be tested by a Commission-approved test house, typically eCOGRA, GLI or BMM Testlabs, against the Remote Gambling and Software Technical Standards (RTS). Certification is renewed when a game changes materially. A new site cannot ship a slot from Pragmatic Play or NetEnt without the operator holding valid certificates for that title.

What does the licence cost beyond the application fee?

Annual fees for remote casino licences are band-based and revised each April. Add the cost of a compliance function, an AML audit, quarterly reporting, and the technology needed to log every bet. For a mid-sized new brand, first-year compliance spend realistically lands between £150,000 and £400,000 before a single marketing pound is spent.

Why do some brands launch under a white-label instead?

White-label arrangements let a brand use an existing licensee's platform and licence, cutting the launch timeline from months to weeks. Gala Bingo, Monopoly Casino and Rainbow Riches Casino have all historically operated on shared platform deals. The trade-off is control: the licence holder, not the brand, answers to the Commission when something goes wrong.

Anti-Money Laundering Duties on New Casino Sites

AML is where new operators most often stumble. UK casinos fall under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, plus the Commission's own licence condition 12. Together they require a documented risk assessment, source-of-funds checks above set thresholds, and ongoing monitoring of every account.

The Commission can and does fine for weak AML controls. In 2023 the regulator issued £66.9 million in regulatory penalties across the gambling sector, with AML and social responsibility failures dominating the reasons. That figure came from the Commission's published enforcement register and covers fines and settlements recorded during the year.

What source-of-funds evidence must a new site collect?

When a player deposits large sums or shows patterns inconsistent with their profile, the operator must request documentary evidence: payslips, bank statements, sale of property, inheritance documents. The threshold is set by the operator's own risk assessment, but the Commission expects it to be defensible. Generic requests with no follow-up are a standard audit finding.

How does KYC differ from AML at onboarding?

KYC confirms identity at the point of registration or first deposit: name, date of birth, address, and often a photo ID match. AML goes further and runs for the life of the account, tracking deposits, withdrawals, and behavioural red flags. A new site that treats KYC as a one-off box-tick will fail its first independent audit.

What are the Politically Exposed Person rules?

Anyone holding a prominent public function, plus their family and close associates, is classed as a PEP. Casinos must apply enhanced due diligence: senior management approval for the relationship, source-of-wealth checks, and continuous monitoring. The rules apply regardless of the amount involved, which is why PEP flags slow down onboarding at brands like Bet365 casino and William Hill casino.

How do operators spot structuring in real time?

Structuring is splitting deposits to stay under reporting thresholds. Modern monitoring tools score transactions by velocity, device, payment method and geolocation, then flag clusters. A new site running manual review only will miss it. The Commission has repeatedly cited inadequate automated monitoring as an aggravating factor when it sets penalty levels.

What happens when an AML control fails?

Failure triggers an internal investigation, a report to the National Crime Agency where relevant, and a regulatory review. Outcomes range from a licence review under section 116 of the Gambling Act 2005 to a fine. In the most serious cases the Commission suspends the licence while investigations continue, taking the brand offline for weeks.

KYC, Affordability and Player Checks Under Scrutiny

Since the 2021 white paper review concluded, the Commission has pushed affordability checks harder. High-value customers face frictionless financial checks based on open banking data rather than intrusive document requests, but the underlying duty is unchanged: operators must not let customers gamble beyond their means.

Verification timing matters too. Under current rules, identity must be verified before a customer can deposit or play, not after a withdrawal request. That single change removed an entire category of late-stage complaints and forced new sites to rebuild their onboarding flows around speed and accuracy.

When must a new site verify a player's age?

Before any account can be used. The Commission requires age verification at the earliest opportunity and, in practice, before the first deposit. Sites using soft checks against credit reference data can clear most players in seconds; those that cannot fall back to manual document review, which adds hours and pushes drop-off rates up.

What affordability checks apply to casual players?

Full affordability evidence is triggered by sustained high spend or by indicators of harm. Below those triggers, operators rely on behavioural monitoring: chasing losses, session length, deposit frequency, time of day. New brands with weak monitoring get found out quickly, because the Commission samples customer journeys during compliance assessments.

How do open banking checks change the process?

Open banking lets a customer share read-only bank data with the operator, giving an instant view of income and outgoings without screenshots. Adoption accelerated after the 2023 guidance on frictionless checks. The practical effect is fewer abandoned registrations, and a cleaner audit trail when the Commission asks how affordability was assessed.

What records must a new operator keep, and for how long?

AML records, including transaction logs and identity documents, must be retained for five years after the account closes or the transaction ends. Betting records fall under separate retention rules in the Commission's licence conditions. Delete early and the operator loses the ability to answer a regulatory request, which itself counts as a breach.

Independent Audits and Ongoing Compliance Monitoring

Licence in hand is not the finish line. The Commission expects continuous compliance, evidenced by independent audits, board-level reporting, and a compliance officer with real authority. New sites that treat compliance as a launch-time checkbox run into trouble within their first two reporting cycles.

External auditors test AML controls, safer gambling processes, and complaint handling. Findings go to the board and, on request, to the Commission. A pattern of repeat findings is what turns a routine assessment into a formal licence review, and that is where the expensive lawyers arrive.

Who audits a new UK casino, and how often?

AML audits are annual at minimum, conducted by a firm approved or acceptable to the Commission. Safer gambling reviews usually run annually as well, with sample-based testing of customer interactions. Some operators add a mid-year health check after a platform migration or a change in ownership, which is sensible given how quickly controls drift.

What does the Commission look for during a compliance assessment?

Sampled customer journeys, board minutes, training records, alert handling times, and evidence that senior management actually reads the reports. The assessors ask for specific cases: show me this customer's file, show me why you did not intervene earlier. Vague policies with no case evidence are the fastest route to an action plan.

How often must compliance staff be trained?

At induction and at least annually thereafter, with additional refreshers when rules change. Training records are auditable. A new site that onboarded 40 staff in a rush and skipped documented AML training will find that gap flagged in the first audit, and repeat gaps read as a governance problem rather than an admin slip.

What happens after a poor audit result?

Expect an action plan with deadlines, a follow-up review, and increased monitoring. Persistent weaknesses escalate to a section 116 review, which can end in licence conditions being added, a financial penalty, or surrender. Several mid-tier operators have exited the UK market rather than absorb the cost of remediation plus ongoing oversight.

Do new sites publish their audit outcomes?

Not usually. Individual audit reports stay confidential between operator, auditor and regulator. What is public is the Commission's enforcement register, licence status pages, and any published assessment findings. Those three sources are where a player can see whether a brand has a clean record or a string of past actions.

Top New Casino Sites Operating Under UK Licence

The brands below are all licensed by the Gambling Commission and represent the current wave of new and recently relaunched casino sites. Each entry focuses on licence status, product scope, and the accountability features visible to players, rather than bonus headlines.

What separates a new site from an established one on paper?

Licence age and enforcement history. A brand licensed in 2024 or 2025 has passed a full application with current standards applied, but has no track record under assessment. Established operators carry years of published compliance data. Both can be trustworthy; the difference is how much evidence a player can actually read.

Which new brands sit under a larger group licence?

Several recent launches operate on platform deals: Foxy Bingo, Double Bubble Bingo and Rainbow Riches Casino share infrastructure with bigger licensees. That usually means faster onboarding and mature AML systems, at the cost of less brand-level control over product decisions. Check the licence number in the footer to see who holds it.

How do offshore-licensed brands differ for UK players?

Brands licensed in Curaçao, Anjouan or Kahnawake may accept UK players but are not covered by the Gambling Act 2005. That means no UK ADR route, no Commission enforcement, and different AML standards. Names in that category include Mystake, Goldenbet, Fat Pirate and Donbet. Players should read the licence terms before depositing.

What should a player check before depositing at a new site?

Licence number in the footer, verification of that number on the Commission's public register, responsible gambling tools visible without contacting support, and clear terms on withdrawals. Four checks, roughly five minutes. It is the cheapest insurance a player will ever buy.

Enforcement: What Happens When Operators Get It Wrong

The Commission's enforcement register is public and specific. Fines, licence conditions, and section 116 reviews are all recorded with dates and reasoning. Reading a handful of entries tells you more about how the regulator thinks than any policy document.

Recent penalties cluster around three themes: inadequate AML controls, failure to interact with customers showing signs of harm, and misleading marketing terms. Each of those maps directly onto the obligations described above, which is why the accountability angle matters more than a bonus comparison.

What penalties has the Commission issued recently?

Penalties in the sector have run from five-figure settlements for first-time control failures to eight-figure sums for systemic issues. The Commission published £66.9 million in total regulatory penalties for 2023, its highest annual total in recent years, driven by a small number of large cases plus a longer tail of smaller actions.

How does a section 116 review work?

The Commission serves notice that it is considering whether the licence is unsuitable to carry on the activity. The operator responds, evidence is exchanged, and the outcome can be a costs-free warning, added conditions, a financial penalty, suspension, or revocation. Timelines run from 3 months for straightforward cases to over a year for complex ones.

Which failures trigger the harshest outcomes?

Repeat AML breaches, allowing self-excluded customers to gamble, and misleading promotional terms. Marketing cases are common: "wager-free" offers with hidden rollover, or withdrawal restrictions not disclosed upfront. The Commission treats unclear terms as a consumer protection breach, separate from the underlying gambling offence.

Can a player claim compensation after an operator breach?

Yes, through an approved Alternative Dispute Resolution service, which is free for the consumer. If ADR cannot resolve it, the Commission can accept complaints about licence breaches, though it does not award damages itself. For unresolved disputes, the Gambling Ombudsman route applies to certain categories of complaint.

Responsible Gambling and Player Protection Tools

Accountability runs both ways. Licensed UK sites must offer deposit limits, loss limits, session reminders, time-outs and self-exclusion, all reachable from the account menu without asking support. The quality of those tools is now a compliance matter, not a marketing feature.

GamStop remains the national self-exclusion register. Registering blocks access to every UKGC-licensed operator for the chosen period, minimum 6 months and up to 5 years. Since its launch the register has processed over 480,000 registrations, with the majority choosing exclusions of 12 months or longer.

What tools must a new UK casino offer by law?

Deposit, loss and wager limits with the ability to lower them instantly and raise them only after a cooling-off period. Reality checks at set intervals. Time-outs from 24 hours to 6 weeks. Self-exclusion links to GamStop. Missing any one of these is a licence breach, and the Commission checks for them during every assessment.

How does GamStop work in practice?

A player registers once with identity details, chooses an exclusion period, and is blocked across all participating UKGC-licensed sites. Blocks apply within 24 hours. Marketing suppression follows. The register does not cover offshore operators, which is a recurring reason players report it as ineffective when they have accounts outside the UK regime.

What does the industry spend on harm prevention?

Operators contribute to research, education and treatment through the Gambling Research, Education and Treatment levy, with the current framework set at 1% of gross gambling yield for larger operators. Individual brands also fund treatment services directly: the National Gambling Support Network includes Gordon Moody, GamCare and BeGambleAware, all reachable on 0808 8020 133.

Where do new sites still fall short?

Behavioural analytics. Established operators tune intervention triggers over years of data; a site launched last quarter is working with thin samples. The tell is generic messaging: generic pop-ups at fixed intervals instead of tailored interventions driven by actual play patterns. Regulators have called this out repeatedly in assessment summaries.

Frequently Asked Questions

Are new casino sites legal in the UK?

Yes, provided they hold a Gambling Commission operating licence. The licence number appears in the site footer and can be checked against the Commission's public register. Unlicensed sites accepting UK players are breaking the law, and players using them have no UK regulatory protection if something goes wrong.

How do I verify a new casino's licence?

Copy the licence number from the footer, search it on the Gambling Commission's public register, and confirm the status reads "Operating" and the address matches. Check whether the licence covers remote casino activity. Two minutes of checking eliminates most of the risk associated with an unknown brand.

Do new casino sites pay out faster than established ones?

Not systematically. Payout speed depends on the payment provider and the operator's verification state, not licence age. Established brands with automated checks often clear withdrawals in under 24 hours. New sites may take 48 to 72 hours initially while their risk models settle and manual reviews are more frequent.

What is the minimum age to play at a UK casino site?

18 across all Gambling Commission-licensed operators, verified before the first deposit. Underage gambling attempts are logged and reported. Retail venues apply the same age rule, and online operators must re-verify age periodically, not just at registration.

Can I play at new casino sites not on GamStop?

Only at operators licensed outside the UK, typically in Curaçao or Anjouan. Those sites are not covered by UK regulation, do not contribute to UK treatment funding, and offer no UK ADR route. If you have an active GamStop exclusion, the register exists specifically to keep you off those platforms as well.

How do I complain about a new casino site?

Start with the operator's internal complaints process, which must respond within 8 weeks. If unresolved, take it to the ADR service named on the site, free of charge. For suspected licence breaches, report directly to the Gambling Commission, which can open a compliance review independently of your individual case.

What happens to my money if a new casino loses its licence?

Player funds must be held in segregated accounts under the Commission's licence conditions. If a licence is revoked, the operator must return balances within set timescales. Cases where funds are missing become insolvency matters, which is why segregation is checked during every application and annual review.

Final Word on New Casino Sites in the UK

The accountability chain behind a new casino site runs from application fee to annual audit, from KYC screen to enforcement register. Brands like Bet365 casino, William Hill casino, Sky Bet casino, Ladbrokes casino and Paddy Power casino publish their licence details openly; newer entrants should be held to the same standard, and now you know exactly what to check.

Licence number first, enforcement history second, tools third, bonuses last. Do it in that order and most of the risk disappears before a deposit is ever made, whether the brand launched last month or a decade ago.

The accountability chain behind a new casino site runs from application fee to annual audit, from KYC screen to enforcement register.

Brands like Bet365 casino, William Hill casino, Sky Bet casino, Ladbrokes casino and Paddy Power casino publish their licence details openly; newer entrants should be held to the same standard, and now you know exactly what to check.

Licence number first, enforcement history second, tools third, bonuses last. Do it in that order and most of the risk disappears before a deposit is ever made, whether the brand launched last month or a decade ago.

For anyone still weighing up an unfamiliar name, the practical test is simple: can you find the licence number, the ADR provider, the self-exclusion link and the withdrawal terms within five minutes? If any of those four are buried or absent, the site has told you everything you need to know about how seriously it treats its obligations.

The market will keep producing new brands, some well-run, some thinly capitalised, a few quietly cutting corners. The tools to tell them apart are public, free and unchanged by whatever bonus headline is running this week. Use them, and the rest of the decision gets a lot easier.