How online casinos work
A licensed site connects an operator, platform, game provider, payment provider and regulator. The casino takes bets, records results, settles wins and handles withdrawals under licence rules.
An online casino is five companies, not one
The brand on the screen is only the front of a wider stack: operator, platform, game provider, payment provider and regulator. Gambling apps work the same way, just inside a phone interface.
A UK remote casino operating licence covers casino games offered through a website, mobile phone, TV or another online service, according to the Gambling Commission. That tells you the first lesson: the licence attaches to the remote gambling business, not to the slot animation or payment button alone.
Key term | Plain meaning |
|---|---|
Operator | The licensed business that runs the account, terms, wallet and complaints process. |
Platform | The account, wallet, bonus, reporting and game-integration system behind the site. |
Game provider | The company that supplies the slot, table game or live game software. |
PSP | The payment service provider that moves deposits and withdrawals. |
RNG | The random number generator used by digital games to produce outcomes. |
RTP | Return to player, a long-run game percentage, not a session promise. |
GGR | Gross gaming revenue: stakes minus prizes. |
NGR | Net gaming revenue after agreed deductions such as bonus cost. |
The five parties in every online casino
The Gambling Commission treats software that accepts and records gambling transactions, determines results, and calculates and allocates wins as core gambling software. That is why a casino is not just a website. It is a chain of regulated and commercial systems.
The operator (brand)
The operator owns the customer relationship. It opens accounts, applies terms, runs KYC, keeps wallet records, approves or rejects withdrawals, and answers complaints. In an own-licence model, the visible brand and licensee are closely connected. In a white label casino, the brand may be the commercial face while another licensed business supplies the regulated account and platform setup.
The platform or aggregator
The casino platform connects the player account to games, bonuses, reporting tools and wallet balances. Aggregators also connect many game providers through one technical layer. If a game fails to load, a bonus does not attach, or a round record is missing, the platform record often matters.
The game providers
Game providers build the games and run the game servers. The Gambling Commission has a casino game host licence category for software businesses that host remote casino games through operators’ platforms. For a digital slot, the provider’s system normally returns the outcome and win amount to the operator’s wallet system.
The payment providers
Payment service providers handle card, bank and wallet rails. They do not decide whether a spin wins. They can, however, affect payment availability, settlement, rejected transfers and withdrawal routing.
The regulator
The regulator licenses operators and sets market rules. It is not the casino’s customer-service desk. In many disputes you complain to the operator first, then use the approved dispute route for that market.
Party | What they control | Who you complain to first |
|---|---|---|
Operator | Account, terms, KYC, wallet, withdrawals, complaints | Operator or licensee |
Platform | Account tools, bonus engine, game integration, round records | Operator, which then checks platform records |
Game provider | Game code, paytable, RNG calls, result messages | Operator, which can escalate to the provider |
Payment provider | Deposit authorisation, withdrawal settlement, rejected transfers | Operator, then your payment provider if needed |
Regulator | Licence conditions, technical standards, enforcement | Regulator or ADR only after the required complaint route |
What actually happens when you press spin
For an online slot, the animation is not the source of the result. The game round is a transaction between your device, the operator wallet and the game provider’s server. The Gambling Commission’s remote technical standards require UK remote game results to be acceptably random, ban compensated games, and do not permit false near-miss substitutions.
-
You choose a stake and press the play button.
-
The client sends a round request to the operator or platform.
-
The wallet checks that the account has enough balance and that the round is allowed.
-
The game provider’s server executes the RNG and maps the result to the game rules.
-
The provider returns the outcome and win amount to the platform or operator.
-
The wallet debits the stake, credits any win and stores the round record.
-
Your screen plays an animation that presents the already-returned result.
Latency affects when you see the result, not what the result is. If your connection pauses after the round request, the completed round can still exist in the game log.
The realistic manipulation points are source code, RNG implementation, paytable mapping, wallet settlement and client presentation. Certification focuses on game behaviour and randomness. It does not prove that an operator will handle a later withdrawal correctly. For the technical detail, read the RNG guide for online casino games.
The money path: from deposit to payout
Deposits and withdrawals use a different path from game results. A deposit is mainly payment authorisation and wallet crediting. A withdrawal adds operator review, identity checks where needed, payment routing and settlement by the PSP.
- You request a deposit through the cashier.
- The PSP authorises the payment and reports the result to the operator.
- The operator credits the casino wallet.
- Game rounds debit stakes and credit prizes inside the wallet ledger.
- You request a withdrawal.
- The operator reviews the account, bonus position, KYC and AML status.
- The PSP sends the approved withdrawal through the selected payment rail.
For UK remote operators that hold customer funds, the Gambling Commission requires separate client bank accounts, says segregation without insolvency protection is the minimum standard, states that segregated but not protected funds still have no protection if the operator becomes insolvent, recognises a high-protection category using a formal trust account, and requires not protected operators to remind customers once every six months.
Licence or rating | Player funds protection level | What happens on insolvency |
|---|---|---|
Great Britain remote operator, minimum standard | Separate client bank account or accounts, without insolvency protection | No protection in the event of insolvency |
Great Britain remote operator, high protection | Formal trust account with independent verification or controls | Protection depends on the trust structure and controls |
A pending withdrawal exists because the operator has not yet released the payment instruction. Common checks include identity status, AML flags, bonus rule position, payment ownership and game-round reconciliation. The Gambling Commission also says UK licensees must not make a withdrawal conditional on extra information if they could reasonably have asked for it earlier.
Who holds the licence, and what it covers
The licence holder is the legal business behind the gambling service. The brand name can be different from the licensee name, and one licensee can run several brands. A lawful cash-gambling site should let you connect the brand, licensee and licence record.
The Gambling Commission requires remote operators to display licensed status information on gambling screens, including a statement, account number and link. Its public register can show a remote casino entry as Casino Remote, Active, from 1 Nov 2014 for one licensee, without you needing to rely on the brand’s own wording.
-
Open the site footer or account area and find the legal entity, licence statement and account details.
-
Open the regulator’s public register.
-
Search the licensee name or account number, not just the brand.
-
Check that the licence type matches the product being offered.
-
Check whether the status is active before you deposit.
A casino licence can support basic legitimacy, but it does not guarantee a good bonus term, fast support, profit for players, or full customer-funds protection. For country differences, use the gambling regulation guide by market.
- What a licence can show: the licensed legal entity, product type, status and regulator.
- What a licence can require: identity checks, technical controls, complaints handling and displayed licence details.
- What a licence does not promise: that every term is player-friendly, that every payment is instant, or that gambling will be profitable.
- What to do next: keep records, use the operator complaint route, then escalate through the approved dispute route where available. The Gambling Commission requires ADR services for UK gambling disputes to be free to the customer.
How the business actually makes money
Online gambling makes money because casino games are priced with an expected margin over a large number of rounds. A player can win a session. That does not change the mathematical structure: casino games are not designed to give the player positive expected value.
The Malta Gaming Authority requires Malta-licensed specified casino-type remote games to meet a minimum average RTP of 92%. That percentage is a useful way to understand revenue accounting, not a prediction for one account.
Line | How it works | Example using the RTP rule |
|---|---|---|
Turnover | Total stakes accepted by the casino. | Every stake counts, whatever the result |
Prize return | Amounts paid back as game prizes under the game model. | A specified Malta-licensed casino-type remote game must meet at least 92% average RTP. |
GGR | Stakes minus prizes, before promotional deductions. | The GGR is the gap between stakes and prizes. It is not a session forecast. |
NGR | GGR after bonus costs and agreed revenue adjustments. | Bonus cost reduces the revenue line, which is why bonus terms are tightly written. |
Marketing costs, affiliate costs and bonus costs sit below the headline game margin. This site does not take bets or hold money: it explains how the industry is put together, and these English pages carry no operator links.
The fairness controls that exist (and their limits)
Fairness controls sit in several places. They check the game, the rules shown to the player and some product-design features. They do not turn gambling into a reliable way to make money, and they do not settle every customer-service dispute.
The Gambling Commission requires UK gambling software made available through an online casino to be tested before launch, requires chance information such as house edge, RTP or probability to be shown before the player commits to gamble, bans auto-play because the customer must commit to each game cycle individually, and sets a 2.5 seconds minimum before the next UK remote slots game cycle can start, with turbo, quick spin and slam stop not permitted.
Control | Who performs it | How often | What it does not cover |
|---|---|---|---|
RNG and game maths testing | Testing body named in the certificate or approval record | Before the game is made available to customers | Withdrawal behaviour by the operator |
Chance information disclosure | Operator and game supplier | Before the player commits to gamble | Whether a session will return the stated percentage |
Product-design controls | Operator and game supplier | Each game cycle individually | The underlying house edge |
Wallet and payout records | Operator and platform | Continuously | RNG certification alone does not prove payout handling |
Regulatory enforcement | Regulator | When a case arises | It may not replace a customer complaint or ADR file |
- Match the certificate or approval record to the exact game name and version.
- Check what was certified: RNG, game maths, platform component or a wider software module.
- Do not treat a certificate as proof that the operator will pay quickly.
- Keep round IDs and cashier records if a result or withdrawal is disputed.
Player protection built into the stack
Player protection is not a favour from the casino. In licensed markets it is built into account opening, payments, game design and complaint routes. The operator carries most of that obligation because it controls the customer account.
The Gambling Commission requires UK remote licensees to verify a customer’s name, address and date of birth before allowing gambling, and UK licensees must not accept gambling payment by credit card. The Malta Gaming Authority rule on specified casino-type remote games is the RTP obligation shown below.
Licence area | Built-in obligation | Practical effect for the player |
|---|---|---|
Great Britain remote casino | Identity verification before gambling | You may need to prove who you are before play starts. |
Great Britain payments | Credit card gambling payments prohibited | The cashier should not accept credit card gambling payments. |
Great Britain remote games | No auto-play, each cycle needs a separate player commitment | The game should not keep playing automatically. |
Malta specified casino-type remote games | Minimum average RTP of 92% | The game category has a regulatory RTP floor. |
Self-exclusion, limits and safer-gambling tools also sit in the account layer, not in the slot reels. If gambling urges, losses or time spent are becoming hard to control, stop play and use formal support rather than trying to recover losses through larger stakes.
Where it goes wrong: the five failure points
Most casino problems are not mystery RNG problems. They are account, terms, payment and licence problems. That matters because the evidence you need is different for each type of dispute.
Failure point | Typical trigger | Where to go next |
|---|---|---|
Verification stalls | Name, address, age, payment ownership or source-of-funds checks are incomplete or disputed. | KYC evidence guide in the cluster navigation below. |
Bonus term breach | The operator says play broke a wagering, game, stake or timing rule. | Terms guide and unfair-terms guide below. |
Withdrawal limit or delay | The operator applies review, AML checks, payment limits or pending status. | Complaint guide below if the reason is unclear or changes. |
Account closure with balance held | The operator cites breach, duplicate account, self-exclusion, verification failure or risk controls. | Complaint route, then ADR or regulator route where available. |
Unlicensed operator | No matching licence record, false footer claim or offshore-only entity serving the wrong market. | Rogue-casino checks below before any deposit. |
Do not rely on chat transcripts alone. Save the terms, cashier status, emails, round IDs and licence details before you escalate.
What to read next
This hub gives the full stack. The pages below handle the parts where players usually need a checklist, evidence template or deeper explanation.
Question you are trying to answer | Read next | What you get |
|---|---|---|
Is this site set up properly before I deposit? | A practical check of licence, ownership, terms, payments and support before you risk money. | |
Why is the casino asking for documents? | What identity checks are for, what evidence is usually requested and how verification affects withdrawals. | |
Which clauses matter most? | The clauses that affect bonuses, accounts, payment limits, inactive balances and disputes. | |
Which terms are red flags? | Examples of clauses that can create unfair forfeits, vague discretion or impossible withdrawal conditions. | |
How do I escalate a payout problem? | How to build a complaint file, what evidence to attach and when escalation makes sense. | |
How can I spot a bad operator early? | Warning signs around fake licences, copied terms, payment traps and missing accountability. |
What this means for you
Check the licensee, not just the brand. Expect withdrawals to pass through a review queue, especially if verification or AML checks are unfinished. If something goes wrong, complain to the operator first, keep evidence, then escalate through the regulator or ADR route that applies to that licence.
Frequently asked questions
Are online casinos rigged?
Game outcomes are normally generated on the game provider’s server, then returned to the operator for wallet settlement. The Gambling Commission requires random outcomes to be acceptably random and UK games must be tested before launch. Certification checks the game maths and RNG behaviour. It does not prove the operator will handle withdrawals fairly.
Who actually owns an online casino?
A brand is the name on the site. The licensee is the company authorised by the regulator. A white label can mean a brand runs on another company’s licence and platform. Check the legal footer against the public register, then use the licence section above to match the displayed account details.
Where is my money while it is in my casino account?
Under Gambling Commission rules, UK remote operators that hold customer funds must keep them in separate client bank accounts. That is segregation, not automatic insolvency protection. The minimum rating still gives no protection if the operator fails. Higher protection can use a formal trust account with independent verification or controls.
Why does a withdrawal take longer than a deposit?
Deposits are mainly authorisation and wallet crediting. Withdrawals add a review queue, KYC checks, AML checks, payment-method matching and PSP settlement. If the operator could reasonably have asked for identity information earlier, the Gambling Commission says it must not add that condition at withdrawal. Timings vary by operator and payment route.