Why the footer badge proves nothing
Scroll to the bottom of almost any online casino and you will find a row of reassuring logos. A shield with a licence number. A seal that says "verified". Maybe a little padlock. They are designed to make you stop worrying, and most people do. That is the problem. A badge is a picture file. Anyone with a browser can right-click, save, and paste it into their own footer in about the time it takes to read this sentence.
We have opened rogue sites that displayed a UK Gambling Commission crest with a genuine-looking eight-digit number, and it was lifted wholesale from a legitimate operator that had never heard of them. The number was real. The site using it was not licensed at all. A badge tells you what a casino wants you to believe about itself, and nothing more.
The honest ones link the badge somewhere useful. Click it and it should carry you straight to that operator's entry on the regulator's site, not to an internal "about our licence" page and definitely not to nowhere. But even a working link can be faked to point at the wrong entry, so the click is a starting hint, never the proof. The proof always lives somewhere the casino cannot edit.
Where the real licence actually lives
Every serious gambling regulator keeps a public register. It is a searchable database, hosted on the regulator's own domain, that lists which companies hold which licences, what those licences permit, which trading names and websites they cover, and whether the whole thing is currently active. This register is the single source of truth. If a casino's licence is not on it, matching the details the casino claims, then for practical purposes that licence does not exist.
The key word is "public". You do not need an account, you do not pay, and you do not ask the casino for anything. You go to the regulator directly and look the operator up yourself. That independence is the entire point. The casino controls its own footer; it does not control the Gambling Commission's website or Malta's registry, which is exactly why those are worth checking and the footer is not.
One detail trips people up constantly. A licence is issued to a company, not to a brand. The casino you see might be called "LuckySpin" but the licence sits under a holding company with a name like "Aspire Global International Ltd". The register will show the company. Your job is to confirm that the company the casino names in its terms is the company on the register, and that your casino's exact web address is one of the domains that company is authorised to run under that licence.
The step-by-step method we run
Here is the routine, in the order we actually do it. It works the same whether the site claims a UK, Malta, or Curacao licence, and it takes roughly two minutes once you have done it a few times.
Step one, find the claim. Scroll to the footer and read the small print, not the badge. You are looking for two things: a company name, usually written as something like "operated by X Ltd, registered in Y", and a licence number. Both are normally in the last paragraph of legal text at the very bottom. Copy them.
Step two, go to the regulator directly. Do not click the badge and trust where it lands. Open a new tab and type the regulator's known address yourself, or search for the regulator's name plus "licence register" and pick the result on the regulator's official domain. For the UK that is gamblingcommission.gov.uk; for Malta it is mga.org.mt. Getting to the register under your own steam removes the casino from the loop entirely.
Step three, search the register. Enter the company name or the licence number in the register's search box. You want a live entry that comes back with a status of active, current, or the regulator's equivalent wording. A page that says the licence is suspended, surrendered, lapsed, or revoked is a hard stop.
Step four, match three things. This is the step people skip and the step that matters most. Confirm that the legal entity matches the company in the casino's terms, that the status is active, and, crucially, that the specific domain you are about to deposit money on is listed among that licence's approved URLs. A licensed company can run ten sites; a rogue clone can borrow the licence number of one of them and hope you never check whether your particular address is on the list. It usually is not.
The major regulators and their registers
Not all licences are equal, and knowing which regulator you are dealing with tells you a lot before you even search. A UK or Danish licence carries real consumer protection and a working complaints route. A Curacao or Anjouan licence tells you a company exists and paid a fee, and little more. The table below is the shortlist we keep to hand, with where to check each register and roughly what the licence is worth in practice.
| Regulator | Jurisdiction | Where to check the register | Consumer protection |
|---|---|---|---|
| UK Gambling Commission (UKGC) | United Kingdom | Public register on gamblingcommission.gov.uk, searchable by business or licence number | Strong: segregated funds, ADR route, strict advertising and safer-gambling rules |
| Malta Gaming Authority (MGA) | Malta / EU | Licensee register on mga.org.mt, searchable by company and URL | Solid: player funds rules, complaints mediation, widely respected in the EU |
| Gibraltar Gambling Division | Gibraltar | List of licensed operators on gibraltar.gov.gi | Good: selective, mostly large established brands |
| Isle of Man GSC | Isle of Man | Licence holders list on gov.im (Gambling Supervision Commission) | Good: segregation of player funds is a licence condition |
| Curacao Gaming Authority (CGA) | Curacao | New portal under the 2024 LOK regime; operator lookup on the CGA site | Improving but light: direct licences under LOK, weaker recourse than EU/UK |
| Anjouan (Comoros) | Comoros | Limited public lookup via the licensing agent's portal | Minimal: cheap, fast to obtain, little meaningful oversight |
| Kahnawake Gaming Commission | Kahnawake, Canada | Licensee list on gamingcommission.ca | Moderate: long-established, publishes holders, limited enforcement muscle |
Read that protection column as the real content of the licence. When we score a site for our UK or Irish lists, the regulator is a large part of the grade, because it decides what you can actually do if a withdrawal is refused. A UKGC or MGA entry means there is somebody above the casino you can escalate to. The offshore licences mostly mean there is not.
Curacao's new CGA regime versus the old sub-licences
Curacao deserves its own section because it changed, and a lot of the advice floating around online is now out of date. For roughly two decades Curacao ran a "master licence" system. A handful of master licence holders sub-licensed thousands of casinos underneath them. The upshot was that the licence number you saw in a footer often belonged to the master, not the operator, there was no real public register to check, and if the casino stiffed you, the master had no meaningful process to make it right. It was licensing in name and a rubber stamp in practice.
In 2024 Curacao brought in a new framework under its Landsverordening op de kansspelen, the LOK, administered by a proper Curacao Gaming Authority. Operators now apply for direct licences from the CGA rather than hiding under a master, and the authority maintains a lookup so you can, for the first time, check a Curacao operator against the source. This is a genuine step up. It is not the UKGC, and the recourse if something goes wrong is still thinner than in Europe, but it is a real regulator with a real register.
The catch during the transition is that both worlds coexist right now. Some sites carry shiny new CGA licence numbers; others still display an old master or sub-licence reference that points nowhere useful. When you see a Curacao claim, our rule is simple. Find out whether it is a direct CGA licence under the new regime, and if it is, check it on the CGA lookup. If it is still an old-style sub-licence number with no verifiable entry, treat it as unverified, because that is exactly what it is.
Green flags and red flags on a licence
Once you have run a few checks you start to recognise the shape of a good licence and the shape of a bad one on sight. The good ones are boring: everything matches, everything is where it should be. The bad ones almost always trip on the same handful of details. The table sorts what we look for into the two columns we score against.
| What you find | Green flag | Red flag |
|---|---|---|
| Company name | The entity in the footer matches the register exactly | Footer names one company, register shows another or nothing |
| Your exact domain | The site's URL is listed among approved domains | Licence exists but your specific web address is not on it |
| Licence status | Active, current, in good standing | Suspended, lapsed, surrendered, or revoked |
| The badge link | Clicks through to the operator's real register entry | Badge is a dead image, links to itself, or goes nowhere |
| Licence number | Unique to this operator and found on the register | Same number appears on unrelated sites, or returns no result |
| Regulator named | A named authority with a public register you can reach | Vague wording like "licensed and regulated" with no body named |
The one we weight most heavily is the domain match. A cloned casino will happily copy a legitimate operator's company name and licence number into its footer, because those check out on the register and most people stop there. What it cannot copy is the approved URL list, because it does not control the regulator's database. When the licence is real but your address is not on it, you are almost certainly on a clone, and the safest assumption is that the money you deposit will not be covered by anything.
A worked example, traced end to end
Let us trace one the way we would at the desk. Say we land on a site calling itself "Nordholm Casino". We scroll past the badge to the legal line at the bottom, which reads: "Nordholm Casino is operated by Northgate Entertainment Ltd, registered in Malta, under licence MGA/B2C/xxx issued by the Malta Gaming Authority." Good. We have a company, a jurisdiction, and a licence reference. We copy the company name.
We do not click the badge. We open a fresh tab and go to mga.org.mt ourselves, find the licensee register, and search "Northgate Entertainment Ltd". Suppose an entry comes back, status active, licence type B2C, which is the class that covers running a consumer-facing casino. So far the story holds. Now the step that decides it. We open that register entry and read its list of authorised URLs. If "nordholm.com", the exact address in our browser bar, appears on that list, the licence is verified and it genuinely covers the site we are looking at. We can deposit knowing the MGA sits above this operator.
Now the version that goes wrong. Same footer, same company, same licence number, but when we search the register the approved URLs are "nordholmcasino.com" and "nordholm.eu", and the site we are actually on is "nordholm-casino.io". Close, but not on the list. That gap is the whole ballgame. Either this is an unlicensed clone borrowing a real operator's details, or a domain the operator runs outside the licence's scope. We would not deposit, and in a review that finding alone drops the site off the list. The licence being real is not enough. It has to be real for the site in front of you.
What a licence does and does not protect
It is worth being clear about what you are actually buying with a verified licence, because it is easy to over-trust the word "licensed". A strong licence, UK or MGA say, buys you a few concrete things. Player funds are meant to be held separately from the company's operating money, so a decent regulator's rules make it harder for your balance to vanish if the operator hits trouble. There are enforced rules on fair advertising, on how bonuses are described, and on safer-gambling tools like deposit limits and self-exclusion. And there is a route when a dispute goes bad: with the UKGC you can escalate to an approved alternative dispute resolution (ADR) provider, and the MGA runs its own player complaints process. Somebody with power over the casino will read your case.
A licence does not turn gambling into a safe way to make money, and it never makes the house edge disappear. The games are still built for the operator to win over time, licensed or not. A licence also does not guarantee fast payouts or a pleasant experience; plenty of licensed sites are slow and stingy within the rules. And an offshore licence, Curacao's old sub-licences, Anjouan, and similar, offers almost none of the recourse above. If a site holding one of those refuses your withdrawal, there is usually no independent body that will force the issue, which is the practical reason we treat those licences as a weak signal rather than a green light.
So verify the licence, then keep your guard up anyway. Confirming the paperwork is real is the floor, not the ceiling. Deposit only what you would spend on any other evening out, use the limit tools the licensed sites are required to give you, and if playing stops feeling like a game, step away. In the UK, GamCare and BeGambleAware run free, confidential support, and any properly licensed operator will let you set limits or self-exclude from inside your account settings. 18+ only.
Frequently asked questions
Does a licence badge in the footer mean a casino is safe?
No. A badge is just an image, and it can be copied onto any site in seconds. We have seen unlicensed sites display a genuine-looking regulator crest lifted from a legitimate operator. The only proof is the regulator's own public register, checked directly, matching the company name, the active status, and your exact domain.
Where do I actually check whether a licence is real?
On the regulator's own website, which hosts a free, public register you can search yourself. For the UK it is gamblingcommission.gov.uk; for Malta it is mga.org.mt. Go there directly rather than clicking the casino's badge, then search the company name or licence number the site gives in its footer terms.
Why do I need to match the exact domain and not just the licence number?
Because a clone can borrow a real operator's company name and licence number, which will check out on the register, but it cannot add its own web address to that licence's approved URL list. If your specific domain is not listed, you are likely on a clone or an unlicensed site, whatever the number says.
Is a Curacao licence trustworthy now?
It depends which kind. The old master and sub-licence system had no real register and weak recourse. Curacao's 2024 LOK regime under the new Curacao Gaming Authority issues direct licences you can look up. A direct CGA licence is a genuine step up, though still lighter on protection than a UK or Malta licence. An old sub-licence number you cannot verify should be treated as unverified.
What does a licence protect me from?
A strong licence means player funds should be held separately, advertising and bonus terms are policed, safer-gambling tools are required, and there is a dispute route such as the UKGC's approved ADR providers or the MGA's complaints process. It does not remove the house edge, guarantee fast payouts, or make gambling a way to earn money.
What are the clearest red flags on a licence?
A company name in the footer that does not match the register, your exact domain missing from the licence's approved URLs, a status of suspended or revoked, a badge that links nowhere, a licence number that shows up on unrelated sites, and vague wording like "licensed and regulated" with no named authority. Any one of these is enough for us to stop and not deposit.
We run this exact check on every site before it earns a place on a list, and we publish the regulator and licence status up front. See the operators that cleared it on our top-rated casinos. 18+ only. Please gamble responsibly.
