Who’s Actually Protecting You When You Play?A jurisdiction-by-jurisdiction look at gambling licensing and player protections, plus the bankroll systems that keep the math from working against you faster than it has to
A license number in a footer looks the same everywhere — a few letters, a few digits, a badge. What it actually guarantees is not the same everywhere. Some regulators run a single national self-exclusion list that covers every licensed operator at once; others leave self-exclusion to each individual site. Some mandate independent dispute resolution; others leave a player to sort out a disagreement directly with the operator that’s disagreeing with them. This page breaks down what the major licensing bodies actually require, what protection tools are typically available and how they differ, and then turns to the one variable a player controls directly regardless of jurisdiction: how a bankroll is sized and managed. Last reviewed September 2026.
Jump to: Licensing by jurisdiction · Protection tools · Bankroll basics · Bankroll systems · Glossary · FAQ
Not every license means the same thing
Licensing bodies regulate different things to different degrees: some focus heavily on player protection and dispute resolution, others focus mainly on anti-money-laundering and financial soundness, and the practical gap between “licensed” and “well-protected” can be large. The list below isn’t exhaustive, but it covers the regulators most frequently seen on casino footers.
Every UKGC-licensed remote operator must register with GAMSTOP, the UK’s single national self-exclusion service — one signup blocks a player across every GAMSTOP-registered site, not just one. UKGC licensees are also required to use an approved independent dispute-resolution (ADR) provider rather than handling every complaint in-house. As of 2026, the UKGC has been phasing in a framework of financial risk checks tied to deposit and loss levels, with the exact thresholds and rollout timing still being finalized — the direction is toward more automated, largely invisible background checks rather than a blanket document-upload requirement, but a player should check an individual operator’s current terms rather than assume a fixed number.
An EU-based regulator with a long operating history and a mandatory independent ADR requirement of its own — MGA’s own complaints unit deals with unlawful or unsafe conduct rather than routine payment disputes, which get routed to a recognized third-party ADR entity instead. Self-exclusion under MGA is generally handled at the individual operator level rather than through one shared national registry, so excluding from one MGA-licensed site doesn’t automatically exclude a player from another.
Curaçao’s old system — a handful of “master license” holders sub-licensing out to hundreds of operators with little direct oversight of any single one — was legally phased out, with the Curaçao Gaming Authority now issuing licenses directly and imposing its own AML obligations. On paper this is a meaningfully stronger framework than the old model. In practice, the new authority has gone through visible growing pains since launch — leadership turnover and reporting of internal disputes over how provisional licenses were being handled — so the reform is real but still maturing operationally. A Curaçao license today is not yet the same thing as a UKGC or Spelinspektionen license in terms of proven, consistent enforcement, which makes checking an individual operator’s own standing worth the extra few minutes.
Operated from the Mohawk Territory of Kahnawake in Canada since the 1990s, with a dedicated Dispute Resolution Officer role for player complaints — a genuine, long-standing regulator, though generally ranked below UKGC, MGA, and the strongest European national frameworks in independent comparisons. One notable quirk: self-exclusion granted under Kahnawake is described as permanent and irrevocable once approved, which is stricter in one specific sense than jurisdictions offering tiered, renewable exclusion periods, but also means there’s no formal path back once granted.
Both are established, state-backed licensing frameworks with public licensee registers and active oversight, generally grouped alongside or just below UKGC and MGA in independent strictness comparisons. Neither runs a single shared self-exclusion registry on the scale of GAMSTOP or Spelpaus — protections here tend to be enforced at the operator level, within a regulator that’s actively watching.
There’s no federal online gambling regulator and no national self-exclusion list. Each state that has legalized online casino or poker play — New Jersey, Pennsylvania, Michigan, and a growing list of others — runs its own gaming board with its own rules and its own separate self-exclusion program. Self-excluding in one state does not exclude a player in another; there’s currently no real-time data-sharing between state lists, so cross-border tracking is a genuine structural gap in the US model rather than an oversight of any one operator.
Ontario’s regulated market splits standard-setting (AGCO) from day-to-day market operation (iGaming Ontario). For several years after the market opened in 2022, self-exclusion here was operator-by-operator, similar to the US model — that changed in 2026 with a centralized, cross-operator self-exclusion program covering every licensed Ontario operator through one registration, closing the gap that had existed since launch. AGCO’s standards separately restrict how and where betting bonuses can be advertised and require operators to give players a built-in way to track time spent playing.
Sweden’s Spelpaus and Denmark’s ROFUS are held up as the strictest national model: a single registration blocks a player across every licensed operator in the country, online and land-based, at once. Sweden added a short-term exclusion option (roughly ten days, alongside the existing longer tiers) in 2026 for players who want a brief break rather than a long one, and moved operators onto real-time registry checks instead of periodic batch updates. Both countries have also restricted or banned funding deposits with credit rather than a player’s own available funds.
Does self-exclusion here cover one operator, or every licensed operator in the jurisdiction at once? A national-registry model (UK, Sweden, Denmark, and now Ontario) means one decision actually removes the option everywhere it’s regulated. A single-operator model (the general pattern for MGA, Gibraltar, Isle of Man, Kahnawake, and every individual US state) means excluding from one site leaves every other licensed site in that same jurisdiction still reachable.
The tools on offer, and who actually has to offer them
Regardless of jurisdiction, most regulated operators offer a broadly similar toolkit. What differs is which tools are mandatory, which are opt-in, and how much friction sits between deciding to use one and it actually taking effect.
Available almost universally, and almost always opt-in — the player sets the number, not the operator, unless an account has already been flagged by a risk-assessment process. Most regulators require these tools be easy to find and set, and a lowered limit typically takes effect immediately while a raised limit is often delayed by a day or more, specifically to prevent chasing losses by loosening a limit mid-session.
Shorter and generally reversible compared to full self-exclusion — commonly ranging from a single day up to several weeks, depending on the operator. Sweden’s short-term Spelpaus option is a national-registry version of the same idea. These sit below self-exclusion specifically for players who want a pause without triggering a longer, harder-to-reverse process.
The longest and most restrictive tool, ranging from several months up to a lifetime depending on the jurisdiction — see the licensing section above for which registries cover one operator versus an entire regulated market at once. Reinstatement after a self-exclusion period, where it’s offered at all, typically requires the player to actively opt back in; an operator can’t simply let it lapse and resume marketing.
Automated pop-ups showing elapsed session time and, on many platforms, net spend so far — required by several major regulators, including UKGC and Ontario’s AGCO, specifically because time and spend are both easy to lose track of during play. Default intervals vary by operator; most let a player adjust the frequency rather than turn the feature off entirely.
Triggered either by a specific deposit or loss threshold, or by AML rules tied to transaction size, rather than being applied to every player uniformly. The UK’s version of this is the most developed and the most actively evolving as of 2026 — worth checking an operator’s current terms directly rather than relying on any single figure, since thresholds have been under active revision.
A downloadable or on-request record of deposits, withdrawals, and net results over a chosen period — increasingly standard, and useful independent of any protection concern simply as a way to see the real numbers rather than a felt impression of how a period of play went.
A bankroll is a number set before playing, not during
A bankroll is the amount specifically set aside for gambling — separate from rent, bills, savings, or general spending money — precisely because gambling outcomes have variance. A given session can land well above or below the “expected” result even when the underlying math hasn’t changed at all, so a bankroll needs to be sized to absorb that swing without touching money earmarked for anything else. Two splits are worth making deliberately rather than figuring out mid-session:
The full amount allocated to gambling over a longer period — a month, for example — decided in advance and treated as the hard ceiling, not a starting suggestion.
A slice of the total, set aside for one sitting. A player working with a $400 monthly bankroll and planning four sessions might split that into four $100 session bankrolls up front, rather than deciding session-by-session how much of what’s left feels right to spend — the second approach is where limits tend to quietly erode.
Three approaches to sizing bets, and what each one actually controls
Every system below manages variance — how far a session can swing from the expected result. None of them change the expected result itself. That distinction matters enough that it gets its own callout further down.
Each bet is sized as a small, fixed percentage of the session bankroll — commonly cited in the 1-2% range — rather than varying with how the session is going. A $100 session bankroll under a 2% unit size means $2 bets. The appeal is that a losing streak shrinks the bet size proportionally along with the bankroll, rather than a fixed bet size consuming a shrinking bankroll faster and faster.
A number decided before play begins — “stop if this session is down $40” or “stop if it’s up $60” — that removes the decision from the moment it’s hardest to make well. This is a behavioral tool: it changes how a session tends to end (more sessions closing at a small planned point rather than an unplanned one) without changing the underlying odds of any individual bet.
Splitting a total bankroll into fixed session-sized portions ahead of time, as in the $400-into-four-$100-sessions example above, and treating each portion as sealed once a session starts. Running out mid-session means the session is over, not a prompt to reallocate from a future one.
The Kelly Criterion — a formula for sizing bets to maximize long-run growth — is sometimes referenced in gambling contexts, but it was built for situations with a genuine positive expected value, like advantage-play blackjack or arbitrage betting. Run the same formula on a standard negative-EV casino game and its own math says the optimal bet is zero — Kelly logic itself confirms there’s no sizing trick that makes a -EV game profitable, only ways to manage how fast or slow the expected loss arrives. The same logic applies to progressive systems like Martingale, which double the bet after every loss: each individual bet in the sequence still carries the same house edge, table and bet limits cap how long a doubling streak can run before hitting a wall, and the bankroll required to survive even a moderate losing streak grows exponentially — often into hundreds of times the original bet after eight or ten straight losses, which isn’t a rare event over enough sessions. In a negative-EV game, the probability of eventually losing the full bankroll — its “risk of ruin” — trends toward certainty the longer play continues, regardless of how bets are sized along the way.
Key terms in this guide
Questions readers ask most
Generally, but not automatically. What matters more than reputation alone is what a specific license actually requires — mandatory independent dispute resolution, a national versus operator-level self-exclusion model, and how mature the regulator’s enforcement actually is in practice. A newly reformed framework can look strong on paper while still working through implementation issues, which is why checking an individual operator’s own standing is worth the extra few minutes even under a well-regarded regulator.
It depends entirely on the jurisdiction’s model. Under a national registry — the UK, Sweden, Denmark, and now Ontario — yes, one registration covers every licensed operator. Under an operator-level model, which covers most of the US, MGA, Kahnawake, Gibraltar, and the Isle of Man, excluding from one site leaves every other licensed site in that jurisdiction still reachable.
In almost every jurisdiction, setting a limit is opt-in — the tool has to be easy to find, but a player generally has to actively use it. The exception is when an account has already been flagged by a risk-assessment process, at which point an operator-imposed restriction can be applied without the player requesting it.
No. Unit betting, stop-loss rules, and session envelopes all manage variance and reduce the risk of losing an entire bankroll quickly — none of them change the underlying house edge of the game being played. A negative-expected-value game stays negative-expected-value regardless of how the bets on top of it are sized.
Because every bet in the sequence still carries the same house edge on its own, and two real-world limits cap how far the sequence can run: table or bet maximums, and the size of the bankroll actually available. A losing streak long enough to hit either wall — which happens more often than it feels like it should — locks in a large loss instead of the intended recovery.
Commonly cited unit sizes fall around 1-2% of a session bankroll, though there’s no single “correct” number — the point of a smaller unit size is reducing how fast a losing streak can end a session, not optimizing for any particular outcome.
Duration and reversibility. A cooling-off period is typically short — a day up to a few weeks — and often ends automatically or can be adjusted more easily. Self-exclusion runs much longer, from several months up to a lifetime depending on the jurisdiction, and getting reinstated afterward, where that’s even offered, usually requires actively opting back in rather than the period simply lapsing.
Regulatory requirements and protection tools change over time and vary by operator even within the same jurisdiction — this page explains the general landscape as of the review date above, not the specific terms of any one casino. Always check an operator’s own terms and its regulator’s current guidance directly for the tools actually available on a given account.