Crypto Casinos: Licences, AML, KYC and Operator Accountability in 2026

Crypto casinos accept Bitcoin, Ethereum, USDT and other digital coins instead of, or alongside, euros. They run the same slots and live tables you'd find at a fiat site, but the money moves on a blockchain. The licence, not the coin, decides whether your deposit is protected.

Spain's regulator, the Dirección General de Ordenación del Juego (DGOJ), authorised roughly 80 operators by early 2026. None of them hold a Spanish licence for crypto-only play; local law still routes deposits through licensed payment intermediaries. Offshore brands with Curaçao or Anjouan permits accept crypto directly and market to Spanish players anyway.

That gap is the whole story. A crypto casino can be perfectly honest and still sit outside Spanish consumer protection, because accountability starts with the licence and the audit trail behind it. Below we unpack what it actually takes for an operator to get and keep permission to run.

What Counts as a Crypto Casino in 2026

How is a crypto casino defined?

A crypto casino is an online gambling site where the balance is held in cryptocurrency: deposits, bets and withdrawals all settle in BTC, ETH, USDT or similar tokens. Some hybrid operators let you fund in euros and convert internally, but the wallet you see in your account is denominated in crypto.

The distinction matters for taxes and disputes. Under Spanish rules, winnings in fiat money from a licensed operator are generally tax-free for the player, while crypto-to-crypto gains can fall under the IRPF capital gains regime at 19–28%. Keep that in mind before you celebrate a big ETH cashout.

Which licences do crypto casinos actually hold?

Most crypto casinos operate under a Curaçao eGaming licence (issued through the regulator since the 2023 overhaul), an Anjouan licence, or a Kahnawà:ke permit. A handful, like those in the Stars Group family, combine a Spanish DGOJ licence for fiat play with offshore crypto rails for international customers.

Each permit has a different price tag and audit burden. A Curaçao licence costs around $12,000–$20,000 per year plus a one-off application fee, while a full DGOJ licence in Spain demands a bank guarantee of roughly €2.5 million and quarterly RTP reporting to the regulator.

Do hybrid operators like Bet365 or Betfair accept crypto?

Not directly. Bet365 casino, Betfair casino, bwin casino and William Hill casino process deposits through Visa, Mastercard, PayPal and Spanish e-wallets. Their crypto exposure is indirect: you might buy BTC on an exchange, convert to fiat, then fund the account. The operator never touches the chain.

Offshore-leaning brands take the opposite route. 1xBet casino, 22bet casino, 1win casino, Stake-style operations and Megapari casino advertise instant USDT deposits with no conversion fee. Their licence sits abroad, which is exactly why AML scrutiny depends on the regulator's appetite rather than Spanish law.

What does "provably fair" mean in plain language?

Provably fair is a checksum trick. The casino hashes a secret seed before the round, you supply a client seed, and the outcome is derived from both. After the spin you can recompute the hash and confirm nothing changed mid-game. It replaces an audit with maths you can run yourself.

Practical limit: it proves the result wasn't altered after the fact, not that the house edge is fair or that payouts will arrive. Betsson casino, Casumo casino and LeoVegas casino publish RTP tables instead, audited by eCOGRA or iTech Labs. Both approaches work; they answer different questions.

Getting a Licence: The Entry Bar

How much capital does an operator need upfront?

Expect a six-figure sum before a single game goes live. A Curaçao licence application in 2026 requires proof of at least $400,000 in liquid funds plus a technical infrastructure review. Malta's MGA asks for a €100,000 guarantee and a detailed business plan covering three years of projected cash flow.

Spain sits at the top of the range. Applicants for a DGOJ licence must lodge a bank guarantee of approximately €2.5 million, cover integration costs with the regulator's central server, and demonstrate a payment intermediary contract. Small operators rarely clear that hurdle; the DGOJ register is dominated by groups like Codere, Luckia and Sportium.

What background checks run on the beneficial owners?

Regulators trace every shareholder holding more than 5–10% back to a natural person. Police clearance certificates, credit bureau reports and source-of-wealth declarations are standard. Curaçao's 2023 framework added a fit-and-proper test modelled on financial services, rejecting owners with prior insolvency or fraud rulings.

Spain goes further. The DGOJ cross-checks applicants against the Registro Central de Delincuentes Sexuales and tax records, and disqualifies anyone with a gambling-related conviction in the previous 10 years. This is why operators like Paf casino and Casino GranVia publish ownership details openly: transparency is cheaper than a rejected application.

Which technical standards must the platform meet?

Random number generators must be certified by an accredited lab before launch. Pragmatic Play, NetEnt, Evolution and Hacksaw supply games already tested by GLI or BMM Testlabs, but the operator's own wallet layer, session handling and bet logging need separate sign-off.

Uptime commitments typically reach 99.5% or higher, with transaction logs retained for a minimum of five years. In practice, that means redundant servers in at least two data centres, encrypted backups, and an incident response plan filed with the regulator. Miss the log, lose the licence.

How long does approval take in practice?

Curaçao processes complete applications in 4–8 weeks once the 2023 reforms stabilised the queue. Malta runs 3–6 months including a public consultation phase. Spain is the slowest: applicants report 9–14 months from first submission to appearing on the DGOJ register, with rounds of clarifications on payment flows.

Timeline pressure explains the market structure. Brands like DAZN Bet casino and Marathonbet casino entered Spain through acquisition of existing licences rather than fresh applications, saving roughly a year. Startups with crypto-native products rarely wait; they launch offshore first and file in regulated markets later.

What happens if an application is rejected?

Most refusals cite incomplete source-of-funds evidence or an unresolved corporate structure. The applicant can refile after addressing the gap, but the regulator keeps a record. Three consecutive rejections usually end the conversation in that jurisdiction.

Operators respond pragmatically. GoldenPark casino and Kirolbet casino restructured their holding companies before reapplying in Spain; several crypto-first brands simply moved to Anjouan and targeted markets with lighter entry requirements. The licence map you see today reflects those decisions.

Keeping the Licence: AML Obligations

What does AML mean for a crypto casino?

Anti-money laundering rules oblige the operator to spot and report suspicious transactions. In crypto terms that means monitoring wallet addresses against sanctions lists, flagging rapid deposit-withdrawal cycles, and filing a report with the national Financial Intelligence Unit when a pattern looks wrong.

The Financial Action Task Force (FATF) Travel Rule is the global reference. It requires exchanges and, increasingly, gambling operators to pass originator and beneficiary data above a $1,000 / €1,000 threshold. Curaçao now mandates Travel Rule compliance for licensees; Anjouan enforcement remains patchy.

How do operators monitor on-chain transactions?

Tools from Chainalysis, Elliptic or TRM Labs score wallet addresses in real time. A deposit from a wallet previously linked to a mixer, darknet market or sanctioned entity triggers an automatic hold. The compliance team then decides: release, request documentation, or report.

Well-run sites apply these checks before crediting the balance. Play UZU casino, RetaBet casino and Winamax casino (fiat operators in Spain) run equivalent checks through their payment providers. Offshore crypto casinos handle it in-house, which is why review quality varies so much between brands.

What triggers a suspicious activity report?

Typical red flags: structuring deposits just under the reporting threshold, using a fresh wallet funded from a mixer, or a sudden spike in volume inconsistent with the player's profile. One report per month is common for a mid-size operator; large platforms file dozens.

Reporting is confidential. The player is never told that a report was filed, and the funds may stay frozen for weeks while the investigation runs. That surprises people, but it is the price of operating under a real licence rather than a paper one.

How often must internal audits happen?

Curaçao requires an annual independent AML audit submitted with the licence renewal. Malta demands quarterly internal reviews plus an external audit every two years. Spain obliges operators to run continuous transaction monitoring with documented monthly sign-off by a designated compliance officer.

Cost reality: an external AML audit for a mid-size casino runs €15,000–€40,000 per year, depending on transaction volume. Add a compliance officer salary of €50,000–€70,000 in Spain and you understand why some offshore brands keep their teams small and their risk appetite high.

What records must be kept and for how long?

Five years is the common floor, measured from the end of the business relationship. Records include identification documents, transaction logs, IP addresses, device fingerprints and all correspondence about a case. Spain extends this to six years for tax purposes.

Retention without organisation is useless. Regulators test by asking for a specific transaction trail on short notice; operators who cannot produce it face fines or suspension. Betway casino, 888 Casino and PokerStars casino run dedicated records teams for exactly this reason.

Which penalties apply for AML failures?

Fines scale with turnover. In Spain, the DGOJ can impose penalties up to €50,000 per infringement, with cumulative ceilings in the hundreds of thousands for repeated breaches. Licence suspension is the nuclear option and has been used against operators failing to implement deposit limits.

Curaçao's 2023 regime introduced warnings, monetary penalties and, ultimately, revocation. Anjouan applies lighter sanctions but publicises them less. The practical risk for players is not the fine; it is the day the site stops responding to withdrawal requests.

KYC: Who You Are Before You Play

When does identity verification happen?

Regulated markets verify at registration or before the first deposit. Spain requires full ID plus address confirmation before any wager is placed. The check typically completes in 2–10 minutes using an automated document scan and a selfie match.

Offshore crypto casinos often defer verification until withdrawal. You can deposit and play anonymously, then face a document request when you cash out. That delay frustrates players, but it is a deliberate design: lower friction at entry, tighter control at exit.

What documents does a crypto casino ask for?

Standard package: passport or national ID (both sides), proof of address dated within three months, and sometimes a selfie holding the document. For larger withdrawals, source of funds evidence such as a payslip, bank statement or exchange transaction record.

Crypto-specific additions appear above certain thresholds. Some operators ask for the public address you withdrew from, the exchange account name, or a screenshot showing the origin of the coins. Nine Casino and Mystake casino both request wallet provenance for withdrawals above €5,000.

How long does KYC take in practice?

Automated checks clear in under 5 minutes for most Spanish players. Manual review, triggered by mismatched data or a low-quality scan, adds 12–48 hours. Complex cases involving source-of-funds documentation can stretch to 5 business days.

Speed depends on the operator's staffing. Mr Green casino and Betsson casino publish median verification times; smaller brands rarely do. If a site quotes "instant verification" for every case, treat the claim with healthy suspicion.

Can you play with no KYC at all?

Some offshore casinos advertise "no-KYC" play for small deposits. In practice, verification reappears at withdrawal, at a win threshold, or when automated systems flag the account. There is no licence that permanently waives identity checks; AML rules bind every operator with a real permit.

No-KYC also means no recourse. If the site withholds winnings, you have no verified identity on file to escalate with. For low-stakes entertainment the risk is small. For a five-figure balance, it is a bad trade.

What is the difference between KYC and AML?

KYC verifies who you are: name, address, date of birth, document. AML is the wider system that uses that identity to monitor transactions and report suspicious behaviour. KYC is one input; AML is the whole process around it.

Confusing the two leads to bad questions at support desks. Asking "why do you need my passport if this is a crypto casino?" is answered by the licence, not by the coin. Every regulator from the DGOJ to Curaçao treats identity verification as non-negotiable.

How is player data protected after verification?

Regulated operators encrypt documents at rest, restrict access to compliance staff, and delete data once retention periods expire. Spain applies the GDPR on top of gambling law, giving players rights to access, rectification and, in limited cases, erasure.

Offshore sites follow their own privacy policies, which vary widely. Before uploading a passport scan, check where the company is registered, which data protection regime applies, and whether the policy mentions a European representative. A two-minute read saves headaches later.

Accountability in Practice: Audits and Fair Play

Who audits the games you play?

Independent testing labs certify the random number generator and the published payout percentage. eCOGRA, iTech Labs, GLI and BMM Testlabs are the four names you will see most often. Their seals link to a report you can open and read.

Pragmatic Play, NetEnt, Microgaming, Evolution and Hacksaw ship games already certified at studio level, but the casino must still verify integration. A misconfigured bonus hook can push actual RTP below the advertised figure, which is exactly what quarterly audits are designed to catch.

What does an RTP report actually show?

Return to Player is the theoretical percentage of wagered money a game returns over millions of rounds. A slot advertised at 96% RTP should pay back €96 per €100 wagered in the long run. The report compares measured results against the advertised value across a sample.

Spanish licence holders must file RTP data quarterly. Look for variance between the theoretical figure and the measured one: a gap above 1–2 percentage points usually means a configuration issue worth raising with support before you deposit heavily.

How are disputes with an operator resolved?

First stop is the operator's internal complaints channel; regulated sites must respond within 8 business days in Spain. If that fails, escalate to the regulator. The DGOJ runs a formal mediation service, while Curaçao's disputes process is handled by the licence holder's own compliance unit.

Third-party mediators add another layer. eCOGRA's dispute service and the Independent Betting Adjudication Service (IBAS) cover many international brands. Neither can force payment from an unlicensed operator, which is the recurring lesson for players choosing offshore crypto casinos.

What responsible gambling tools are mandatory?

Spain mandates deposit limits, loss limits, session time reminders, cooling-off periods and self-exclusion through the RG0 register. Operators must display these controls prominently, not bury them three clicks deep in settings. The DGOJ audits interface compliance annually.

Offshore crypto casinos offer voluntary versions: reality checks, deposit caps, temporary block. Availability varies by brand. PlayJango casino, BacanaPlay casino and ZEbet casino publish their limit tools openly; smaller crypto-native sites often implement only a basic self-exclusion toggle.

Which operators publish audit certificates openly?

Transparency is a competitive signal. Bet365 casino, William Hill casino, PokerStars casino and 888 Casino link their RTP reports and test certificates from the footer. In the crypto space, sites like Bitcasino and Stake-style brands publish wallet proofs and occasional reserve attestations.

Mid-tier operators sit in between: certificates exist but live in the support section. If you cannot find an audit reference within two minutes of looking, ask support directly. A licensed operator answers within hours; an unlicensed one goes quiet.

Top Operators and Their Crypto Stance

Which Spanish-licensed brands accept crypto indirectly?

Codere casino, Sportium casino, Luckia casino, Wanabet casino and GoldenPark casino all hold DGOJ licences and process fiat only. Their crypto relationship runs through payment gateways: you buy crypto on an exchange, sell it for euros, then deposit. The operator's ledger never sees a wallet address.

That structure keeps them fully inside Spanish AML rules. Every deposit passes through a supervised intermediary with its own KYC, which is why onboarding at these brands feels heavier than at an offshore site. Heavier, but legally complete.

Which offshore brands take crypto directly?

1xBet casino, 22bet casino, 1win casino, Megapari casino, Mystake casino, Nine Casino and Betsson's international skin all process BTC, ETH and USDT natively. Deposits confirm in 1–3 blockchain confirmations, typically 2–15 minutes depending on network congestion and gas fees.

Licences here come from Curaçao or Anjouan. Player protection exists on paper: self-exclusion, deposit limits, complaint channels. Enforcement is thinner than in Spain, and that gap is exactly what the accountability angle of this article is about.

How do hybrid brands like Betway and 888 handle crypto?

Betway casino and 888 Casino run separate product lines by market. In Spain and the UK they are fiat-only, fully audited, with quarterly RTP filings. On international skins they may accept crypto through a third-party processor that handles conversion behind the scenes.

Read the terms: the entity named in the footer determines which rules apply. A "888 Casino" branded site licensed in Gibraltar follows Gibraltar's AML framework; the same brand under a Curaçao entity follows Curaçao's. The logo does not tell you which one you got.

What about crypto-native operators like Play UZU or RetaBet?

Play UZU casino and RetaBet casino operate in Spain under local licences and remain fiat-focused. Their parent groups (SkillOnNet and others) run crypto-friendly brands elsewhere, so the technology exists, but the Spanish-facing product routes through regulated payment rails.

Expect that to evolve. The DGOJ has signalled consultation on digital asset payments for licensed operators, with a draft framework circulating among stakeholders in late 2025. Nothing is in force yet; treat any Spanish site claiming "crypto deposits approved by DGOJ" with scepticism.

Which operators should you approach with extra caution?

Red flags: no licence number in the footer, no audit certificate, withdrawal times quoted only as "fast", and support that cannot name the regulator. Several brands on the wider market list operate with minimal disclosure; verify the permit yourself on the regulator's public register.

Counter-examples exist. LeoVegas casino, Casumo casino, Mr Green casino and Videoslots casino publish licence details, audit links and responsible gambling tools without being asked. That habit correlates with better complaint handling, in our reading of the market.

How do you verify a licence in under a minute?

Scroll to the footer, find the licence number, then search that number on the regulator's site: DGOJ's public register, the Malta Gaming Authority's licensee list, or Curaçao's eGaming portal. If the number does not resolve, walk away.

Cross-check the domain. Regulated operators use exact-match domains; cloned sites add letters or swap extensions. A quick WHOIS lookup showing registration two months ago, combined with a claim of "10 years of experience", is not a good sign.

Money Movement: Deposits, Withdrawals and Fees

How fast are crypto withdrawals in reality?

Blockchain confirmation sets the floor: Bitcoin averages 10–60 minutes per confirmation, Ethereum 1–5 minutes, USDT on Tron 1–3 minutes. Add the operator's internal processing, which ranges from instant for automated systems to 24–72 hours for manual review.

First withdrawals take longest because KYC runs at that moment. Once verified, repeat cashouts at efficient operators clear within the hour. If a site quotes "up to 5 business days" for crypto, the delay is internal, not technical.

What fees should you expect?

Network fees are unavoidable: roughly 0.00005–0.0005 BTC per Bitcoin transfer, 0.001–0.01 ETH on Ethereum, and under $1 for USDT on Tron or BEP-20. Ethereum mainnet spikes during congestion; layer-2 options keep costs near cents.

Operators add their own layer. Some charge a flat 1–3% withdrawal fee, others a fixed amount per transaction, and a few absorb the cost entirely. Always check the fee schedule before depositing; a "0% deposit fee" paired with a 5% withdrawal fee is a common pattern.

Which coins are most widely accepted?

BTC, ETH and USDT cover the majority of sites. USDT dominates by volume because its dollar peg removes price swings during a session. Solana, Litecoin, XRP and TRX appear frequently; newer tokens show up mainly on crypto-native platforms.

Stablecoin choice matters for fees. USDT on Ethereum can cost $5–$20 per transfer during congestion; the same amount on Tron or Arbitrum costs cents. Compare networks before confirming, and never send a token to a chain the casino does not support.

How are winnings taxed for Spanish players?

Winnings from a DGOJ-licensed operator in euros are exempt from IRPF for the player. Gains from crypto, however, are capital gains: 19% on the first €6,000, rising to 21%, 23%, 26% and up to 28% for amounts above €300,000 in a year.

Track your cost basis. Converting BTC to ETH, then cashing out to euros, creates a taxable event at each swap. Keep exchange records; the Agencia Tributaria has increased crypto-related inspections since 2024, with penalties for unreported disposals.

What happens to funds if a casino shuts down?

Regulated operators must keep player balances in segregated accounts, separate from operating funds. Spain enforces this through the bank guarantee mechanism. If the licence is revoked, the regulator coordinates return of remaining balances.

Offshore sites rarely offer the same separation. When a Curaçao-licensed brand collapses, players join a queue behind creditors with no guarantee of recovery. That asymmetry is the strongest argument for choosing a licensed operator even when the crypto convenience looks tempting.

Responsible Gambling and Player Protection

What tools exist to keep play under control?

Deposit limits, loss limits, wagering limits, session timers, reality checks, cooling-off periods and full self-exclusion. Regulated Spanish operators must offer all of them and record every change for audit. Offshore brands typically provide a subset.

Set the limits before you deposit, not after a bad session. The psychology is simple: a limit configured in a calm moment holds; one configured in the middle of a chase gets overridden within minutes.

How does self-exclusion work in Spain?

The RG0 register (Registro de Exclusión Voluntaria) blocks access to all DGOJ-licensed operators simultaneously. Registration takes effect within 24 hours and lasts for the period you choose, from 6 months to permanently. Voluntary reactivation requires a 72-hour waiting period.

Crypto casinos outside Spain run their own versions: account-level blocks, sometimes a central register shared among sister brands. Effectiveness varies. A player excluded from one Curaçao site can open an account at a competitor in minutes, which is the structural weakness of offshore self-exclusion.

What is the legal age for gambling in Spain?

18 years, without exception. Operators must verify age during registration and re-verify if data changes. Underage gambling results in immediate account closure and forfeiture of winnings, plus regulatory penalties for the operator.

Age checks are the first line of KYC. If a site lets you deposit without confirming your date of birth, it is not complying with any recognised regulatory framework.

Where can you get help?

Spain's national gambling helpline operates at 024, free and confidential, 24 hours a day. The DGOJ also maintains the self-exclusion register RG0 and a public list of licensed operators. Support groups include Jugadores Anónimos España, which runs meetings across major cities.

International resources include the National Council on Problem Gambling helpline in the US (1-800-522-4700) and GamCare in the UK (0808 8020 133). If gambling stops being entertainment, stop playing and call; the cost of a call is zero, the cost of ignoring it is not.

Which operators invest in player protection?

William Hill casino, Bet365 casino, PokerStars casino and Mr Green casino fund research and run mandatory staff training on problem gambling indicators. Paf casino caps maximum losses for all players by default, a policy it has held since 2018.

In the crypto space, commitment is uneven. Some sites integrate third-party reality-check tools; others offer a single self-exclusion button. Compare before you commit a balance, and treat the availability of limit tools as a quality signal rather than an afterthought.

What should you do if you suspect a rigged game?

Document everything: game ID, timestamp, bet history, screenshots. Raise it with support and request the underlying round log; licensed operators retain these for at least five years. If the answer is unsatisfactory, escalate to the regulator with the case number.

Independent reviewers and testing labs can re-run statistical checks on exported histories. A single losing streak proves nothing; a deviation across thousands of rounds does. That is why audits sample millions of spins rather than a weekend of play.

FAQ

Are crypto casinos legal in Spain?

Crypto casinos are not illegal for Spanish players, but they are not licensed by the DGOJ either. Spanish-licensed operators accept fiat only; offshore brands with Curaçao or Anjouan permits accept crypto and serve Spanish customers under foreign rules. Player protection under Spanish law does not extend to those sites.

Do I pay taxes on crypto casino winnings in Spain?

Winnings from a licensed Spanish operator in euros are exempt from personal income tax. Gains from crypto are taxable as capital gains at 19–28%, and each conversion between coins counts as a disposal. Keep records of every transaction to calculate cost basis correctly.

Can a crypto casino refuse my withdrawal?

Yes, if KYC is incomplete, the source of funds looks suspicious, or bonus terms were breached. Licensed operators must explain the refusal in writing and offer a complaint route. Unlicensed sites may simply stop responding, which is why verifying the licence before depositing matters.

Is "no-KYC" play really anonymous?

Only until a withdrawal threshold, a flagged transaction or a bonus claim triggers verification. Every licence that matters requires identity checks at some point. Anonymous play also removes your leverage in a dispute, since there is no verified identity to escalate with.

What happens if a crypto casino loses its licence?

Regulated operators must freeze new deposits, honour pending withdrawals and return segregated balances under supervisory oversight. Offshore revocations follow a less predictable path; players often wait months with no guarantee of recovery. Check the regulator's register status before depositing large sums.

How do I verify that an operator's audit is genuine?

Open the certificate link and confirm it resolves to the testing lab's domain, not a screenshot hosted on the casino's own site. Search the lab's published client list for the operator's name. If the link is broken or the certificate is undated, ask support for a current report.

Which coins are safest to deposit?

Stablecoins like USDT or USDC remove price risk during play, and layer-2 networks keep fees low. Bitcoin remains the most widely accepted but carries confirmation delays. Avoid obscure tokens unless you understand the contract risk and the withdrawal conditions attached to them.

Crypto casinos sit at the intersection of two systems: fast, self-custodial money on one side, slow, documented regulation on the other. The licence decides which side protects you when something goes wrong, and everything in this article, from AML audits to KYC timing, follows from that single fact. Check the permit, read the audit, set your limits, and play only with money you can afford to lose; the national helpline 024 is free, confidential and open 24 hours a day if the balance stops feeling like entertainment.