Things to Consider When Buying a Turnkey Online Casino From a Legal Standpoint

Founders sign for a turnkey casino on a Friday and discover on Monday that they cannot legally take a bet. The platform, the brand, the games, and the player database all changed hands as promised. The one thing that lets a casino operate, a licence they could actually use, did not. Gambling authorisations do not travel with the software, the seller’s bank will not follow the buyer, and the previous operator’s liabilities stay attached. The distance between buying a turnkey online casino and running one is wider than any purchase agreement admits.

Statista puts the global gambling market revenue growth at US$655.31bn in 2026, growing 2.28% a year to US$717.06bn by 2030, with a user base nearing 1.1bn. Owning the licence allows for keeping that jackpot.

Turnkey vs. White-Label Online Casino

The choice is really about who holds three things: the licence, the money, and the liability.

White-label is a lease. The provider supplies the licence framework, payments, and platform; you run the brand and keep what remains after their share, which is often around 15–25% of gross gaming revenue. You never hold the licence or, as a rule, player funds. 

Turnkey is ownership. You own the brand, the player database, and the operation, and keep the full margin, which is why the model is proven at scale by owned crypto-casino brands like Thunderpick, BetWhale, and Bets.io, on the same crypto-native demand behind adjacent GameFi models. But you also inherit every obligation the provider used to absorb. And here is the line most acquisition agreements gloss over: the seller’s licence does not come with the business. Gambling authorisations are jurisdiction-specific and not freely transferable; a change of control needs the regulator’s prior approval, and an asset sale leaves the licence behind entirely. A casino taking bets the day before completion may not lawfully take one the day after. 

Founders’ question answered: How Does Bitcoin Casino Work?

How the Money Moves and the Three Licences Most Buyers Miss

Most compliance failures are a failure to read the flow of funds and ask, at each step, what the law attaches to. Follow the money through a crypto casino.

A player deposits crypto or fiat. The casino holds the funds. The player wagers against the house. The casino pays out winnings or keeps the losses.

Three obligations attach to that one flow at the same time:

(a) Gambling. Holding player funds and settling wagers is regulated gambling. It needs an authorisation valid for every market whose players you accept.

(b) Crypto. Taking custody of and exchanging crypto is a separate licensable activity alongside clean on-and off-ramp structuring for moving between crypto and fiat: for example, a Crypto-Asset Service Provider (“CASP”) authorisation in the EU under the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, or “MiCAR”), or a similar authorisation in the offshore jurisdictions such as the authorisation as a Virtual Asset Service Provider (“VASP”) in the Cayman Islands under the Virtual Asset (Service Providers) Act.

(c) Payments and e-money. Accepting and holding customer fiat in-house (not through a third party!) is a licensable payment-services and e-money activity under the frameworks such as the Second Payment Services Directive (“PSD2”) and Electronic Money Directive (“EMD”), which is why most operators route fiat through third-party licensed EMIs rather than hold it themselves. The same applies to e-money tokens (“EMTs”, as defined in Article 3(1)(7) of MiCAR): holding or transacting in them needs an electronic money institution (“EMI”) licence, not a CASP authorisation alone.

Most buyers budget for the gambling licence and meet the other two after completion. The turnkey package resolves none, it only delivers the platform on which all three must hold.

Crypto founders often ask whether KYC is really mandatory. On a pure, unlicensed flow you can talk yourself into “no”, but it becomes a “yes”  if you hold funds and settle wagers:

1. The Fifth Anti-Money Laundering Directive (Directive (EU) 2018/843 or “5AMLD”) Article 47(1) brought gambling providers into scope.
2. Under the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624, or “AMLR”) Article 19(5) customer due diligence is mandatory on the wagering of a stake, the collection of winnings, or both, at EUR 2,000 or more, in single or linked transactions.
3. If the casino’s crypto transaction flow involves operations in or through the EU at any point, the Travel Rule (Regulation (EU) 2023/1113) applies.

Thus, a real licence makes KYC a standing condition; or a transaction raises suspicion. If you are mapping which authorisations your build triggers, that is where LegalBison’s gambling licence and crypto licensing work begins.

Related: Are No-KYC Online Casinos Legal?

Structuring the Operation

The structure that carries those licences and still gets you banked is a dual-entity build: (a) a licensed operating company in your gambling jurisdiction, which holds the licence and runs the casino; and (b) an EU payment-processing agent  (often a Cyprus company) that contracts with acquirers and processes flows on the operating company’s behalf.

The agent does real work. Banks contract far more readily with an EU company with real substance than with an offshore licensee, so it is often what makes reliable payments attainable at all. It can also be efficient: under Article 5(1)(a) of the Cyprus Income Tax Law 118(I)/2002, Cyprus income tax is generally imposed on business profits. Accordingly, where an EU agent is remunerated on a commission basis, tax is generally levied on the agent’s profits derived from that commission rather than on total processed volumes. 

Depending on the fee structure, margins, deductions and applicable reliefs, this can result in a relatively low effective tax cost as a percentage of transaction volume. Two conditions come with it: the agent must meet economic substance requirements (real premises, management, and people) and its handling of player funds must be assessed against PSD2 and EMD. Form both entities correctly the first time; unwinding a structure after banking is in place is slow and expensive. LegalBison forms both as part of global company formation.

Which Jurisdiction, and Why?

There is no universally right jurisdiction, only the right one for your players, your bank, and your budget. The options worth weighing:

• Malta: a highly regarded EU gambling licence with strong regulatory credibility and broad acceptance among banks and service providers, albeit with higher compliance costs and substance requirements.
• Estonia: an EU remote-gambling licence offering EU regulatory status through a generally more streamlined framework than Malta.
• Curaçao: a comparatively fast and cost-effective offshore route, reformed under the National Ordinance on Games of Chance (LOK) and supervised by the Curaçao Gaming Authority.
• Isle of Man/Alderney: well-established offshore gambling jurisdictions with strong regulatory reputations and experience supervising operators using digital-asset business models.
• Costa Rica: not a gambling-licensing jurisdiction in the conventional sense; operators typically rely on ordinary business registration rather than a dedicated gaming licence. A claim that a casino is “Costa Rica licensed” should therefore be treated as a due-diligence consideration rather than a regulatory endorsement.

Choose on where your players and your bank sit, then optimise for cost (never the reverse!) and never license in one jurisdiction without a fallback.

Fintech and Payments: Securing High-Risk Merchant Accounts

Gambling is high-risk to every acquirer and bank, and that decides whether you can take a deposit at all. Securing processing is two jobs: the dual-entity structure above presents a bankable counterparty, and you pick specialist high-risk acquirers and EMIs that knowingly serve the sector rather than a mainstream bank that offboards you on sight. In practice, more launches stall on a closed account than on a refused licence. LegalBison introduces operators to vetted EMIs and EU acquirers through its high-risk business banking service.

M&A Due Diligence: What to Check Before You Buy

Buying a turnkey casino is a corporate acquisition, with the defining risk of one: you inherit what you do not inspect. At a minimum, diligence covers:

(a) Corporate structure and good standing: the ownership chain and any encumbrances over the assets sold;

(b) Change-of-control triggers in material contracts: game-supply, platform, and payment agreements often terminate or require consent on a change of control, and one such clause can switch off your games or your payment rail on completion day. This is the clause most often ignored;

(c) IP ownership and chain of title: whether the brand, domain, and software are owned or merely licensed, and whether the player database can lawfully transfer at all;

(d) Regulatory and licensing status: what the target holds, whether it survives the deal, and what you must do to operate lawfully from completion;

(e) Financial, tax, and liability history: player balances, chargeback exposure, tax positions, and any pending regulatory action; and

(f) Data protection: an EU player base brings GDPR obligations, and you inherit the seller’s prior handling.

The point is to make the price reflect the business you actually receive — not to produce a report for its own sake.

Technical Compliance: Escrow Agreements and Geofencing

It is also important to address two technical safeguards from the legal standpoint:

1. Source-code escrow: a turnkey casino runs on readymade gambling software you license, not own, so if the provider fails you can lose the platform itself. A tri-party escrow with compile testing releases it on defined triggers, confirming the code is buildable.
2. Geolocation: operating lawfully means serving only the markets your licence permits. Regulated jurisdictions require multi-layered geolocation (IP, Wi-Fi, GPS) with VPN detection; in licensed markets this is a licence condition, and failing to enforce it is a breach regardless of intent.

What LegalBison Delivers

When an operator comes to us to buy or build a turnkey casino, we produce concrete outputs:

1. Licensing & Structuring

• A jurisdiction-selection and support for the operating-company-plus-EU-agent build
• Formation of all required corporate entities;
• End-to-end management of the gambling licence application
• Drafting of material contracts (software licence, source-code escrow, payment-processing agreements)
• M&A legal due diligence preparation (only for company acquisition)

2. Local Substance & Operational Presence

• Provision of registered office and local physical premises to meet economic substance requirements
• Appointment of local management, resident directors, and authorized representatives for regulatory interaction

3. Ongoing Compliance & Annual Maintenance

• Ongoing regulatory liaison and submission of mandatory periodic (monthly/quarterly) reports;
• Corporate secretarial support, including annual filings and maintenance of statutory registers;
• Annual licence renewal management and supervisory fee administration
• EMI and acquirer introductions, with ongoing file maintenance

4. Compliance Personnel & Governance

• Identification, vetting, and appointment of key compliance personnel, including MLRO, Compliance Officer, and Data Protection Officer (DPO)
• AML framework development ready for implementation 
• Responsible-gambling and geolocation setup

Conclusion

Buying a turnkey online casino buys you ownership, full margin, and control (and, in the same breath, responsibility for three licences, your own banking, and every liability you did not diligence away). Crossed deliberately, the gap between a delivered platform and an operating casino is bridgeable; crossed carelessly, it is where launches stall. Talk to us about the gambling licence and crypto casino licensing behind a compliant launch before you sign, not after.

FAQ

How much does it cost to build an online casino?

There is no single buy online casino turnkey price; the platform fee is the smallest line. The real cost sits in licensing (more modest in Curaçao, more substantial in Malta), dual-entity formation, payment setup and reserves, game-content licensing, and ongoing compliance. Budget for the structure and the licences, not just the software.

What is a turnkey casino?

A turnkey casino is a complete, ready-to-brand operation sold as a corporate asset: the buyer owns the platform, brand, player database, and operation outright. It contrasts with white-label, where the operator leases the provider’s infrastructure and licence framework, takes a revenue share, and does not hold the licence or player funds directly.

What is the difference between turnkey and white-label casinos?

Ownership and obligation. White-label is a lease: the provider supplies the licence framework, payments, and platform for a share of revenue, often 15–25% of gross gaming revenue. Turnkey is ownership: the operator keeps the full margin but must procure its own licences, secure its own banking, and carry its own compliance and liability.

How do you get a crypto gambling licence for an online casino?

There is rarely a single “crypto gambling licence”. A crypto casino typically needs a gambling authorisation valid for its target markets and a separate crypto authorisation, such as a Crypto-Asset Service Provider (CASP) authorisation in the EU under MiCAR, or a Virtual Asset Service Provider (VASP) authorisation offshore (for example under the Cayman Islands Virtual Asset (Service Providers) Act). Additionally, where it holds fiat or e-money, it requires an electronic money institution (EMI) licence or a licensed third party. Crypto should be processed through an authorised provider, never an unlicensed in-house flow.

What legal due diligence is required when buying an existing online casino?

At a minimum: corporate structure and good standing; change-of-control triggers in material contracts; intellectual-property ownership and chain of title, including the player database; regulatory and licensing status and transferability; and financial, tax, and liability history. The aim is to confirm the price reflects the business actually being acquired, and that no liability, IP dispute, or terminated vendor contract surfaces after completion.

How do online casinos get high-risk merchant accounts and payment gateways?

Gambling is treated as high-risk, so mainstream banking is rarely available. Operators secure processing through specialist high-risk acquirers and EMIs that knowingly serve the sector, typically presented through an EU payment-processing agent with genuine economic substance. The structure is what makes reliable processing attainable, so it is worth getting right before launch rather than after an account closes.