How to Verify a Canadian Online Casino's License

Why License Verification Matters for Canadian Players

I'll be blunt with you, because that's how I run my desk in Montreal: if you can't verify the license on an online casino in under three minutes, you shouldn't be depositing money there. Not because the casino is automatically a scam, but because you have no consumer recourse if something goes sideways. Canada has a fragmented regulatory landscape — Ontario operates a closed iGaming market through iGO and AGCO, while the rest of the country sits in a legal grey zone where Canadians can legally play at offshore operators licensed in Malta, Curaçao, Kahnawake, the Isle of Man, or Gibraltar. The license isn't decorative. It determines whether your funds are held in a segregated trust account, whether the operator must use audited RNGs, and crucially, who you can escalate to when a withdrawal sits "pending" for three weeks.

In my compliance work, I see the same pattern over and over: players land on a casino, scroll to the footer, see a regulator logo, and assume that logo is itself proof of licensure. It isn't. Logos are PNG files anyone can upload. The verification only counts when you've cross-referenced the license number against the regulator's public register — and that's exactly what this guide will walk you through. By the end, you'll be able to verify any casino license claim in three minutes flat. You'll also know which regulators actually enforce their rules, which ones rubber-stamp anyone with a check, and what to do when an operator refuses to give you a straight answer. If you want license-vetted recommendations to compare against your own checks, see Hudson Casino's offshore casino ranking with license-verified picks.

The Four License Authorities Canadians Encounter Most Often

Before I get into the click-by-click verification steps, you need to know which regulators you'll actually encounter. About 95% of the license claims I audit for Canadian-facing casinos fall into one of four buckets. The Malta Gaming Authority (MGA) is the gold standard for offshore licensing — it's an EU-based regulator with mandatory player fund segregation, dispute resolution through the Player Support Unit, and quarterly compliance reporting. License numbers follow the format MGA/CRP/XXX/YYYY or MGA/B2C/XXX/YYYY, where CRP means "Critical Gaming Supply" and B2C means business-to-consumer.

The Curaçao framework is where things get messy and where I spend most of my audit time. Until late 2023, Curaçao operated a sublicensing system under four master license holders (8048/JAZ, 1668/JAZ, 5536/JAZ, and 365/JAZ). These master licenses sublicensed to thousands of operators with minimal oversight. In December 2023, the Curaçao Gaming Authority (CGA) launched a new direct-licensing regime under the LOK framework, issuing licenses in the format OGL/2023/XXX/YYYY. Operators were given a transition window to migrate from master-sublicense status to direct CGA licensure. As of 2026, you should be seeing CGA-issued licenses on legitimate Curaçao casinos — anyone still hiding behind a master license number is a major red flag.

The Kahnawake Gaming Commission (KGC) is the Mohawk Council's regulatory body operating out of the Kahnawake Mohawk Territory in Quebec. It's been licensing online gambling since 1999 and has a respectable track record, though enforcement is lighter than MGA. License references look like the operator name followed by a registration confirmation on the KGC's website. Finally, AGCO (the Alcohol and Gaming Commission of Ontario) and iGaming Ontario (iGO) jointly regulate Ontario's regulated market — every operator legally serving Ontario residents must hold an AGCO Operator registration AND have a Commercial Agreement with iGO. Anything outside these four authorities (think Anjouan, Gaming Curaçao "self-regulated" claims, or vague references to "international licensing") gets my immediate skeptical eyebrow.

How to Verify a Malta Gaming Authority (MGA) License Number

MGA verification is the cleanest of the four because Malta runs a proper public register. Here's exactly what I do. Start at the official MGA authorisation portal: authorisation.mga.org.mt. Do not click MGA links from the casino itself — type the URL manually or use the regulator's main site at mga.org.mt. I've seen casinos link their MGA logo to a phishing clone before, complete with fabricated license records.

Once on the portal, you'll see a search interface. The casino's footer should display something like "Licensed and regulated by the Malta Gaming Authority under license MGA/CRP/543/2018." Copy that exact license number and paste it into the search field. The portal will return a record showing the licensee's legal company name (this matters — it should be the parent company, not the casino brand), the license type (B2C means consumer-facing operator), the effective date, the expiry date, and the approved URLs operating under that license.

Three things to check on the returned record. First, is the URL of the casino you're investigating actually listed under "Approved URLs"? Operators frequently run multiple brands under one license, so the brand name doesn't need to match, but the domain does. Second, is the license still active? Look for status "Active" or "In Force." If you see "Suspended," "Revoked," or "Surrendered," walk away immediately. Third, does the license cover the products the casino is offering? An MGA Type 1 license covers casino games; Type 2 covers fixed-odds betting; Type 3 covers peer-to-peer poker. If a casino claims MGA licensing but offers sportsbook on a Type 1 license, they're operating outside their authorisation scope. That's a compliance failure even before you've placed a bet.

How to Verify a Curaçao License (Old Master-Licence Format vs New CGA Framework)

Curaçao verification is the messiest because of the regulatory transition I mentioned. You'll encounter two distinct formats on Canadian-facing casinos in 2026, and they need to be verified differently. The old master-licence format references appear as "8048/JAZ" or "1668/JAZ" — these are the master license numbers of the four pre-CGA master licensees. Casinos using these numbers will typically display them alongside a sublicensee certificate (e.g., "License 8048/JAZ2024-001"). To verify the old format, you'd traditionally check validator.curacao-egaming.com for 1668/JAZ holdings, but that validator covers only one master license and is being progressively retired.

The new CGA framework is where Canadian players should focus attention. New-format license numbers follow OGL/2023/XXX/YYYY (where OGL means Online Gaming Licence, 2023 indicates issuance year, and the trailing digits are the licensee identifier). Verify these at the Curaçao Gaming Authority's official site: gamingauthority.cw. The CGA maintains a public licensee register accessible from the main navigation under "Licensees" or "Public Register." Search by license number or operator legal name. The returned record should show the licensee's company name, license issuance date, license category (B2C operator, B2B supplier, etc.), and current status.

Here's my hard rule for Curaçao licenses: if a casino is still presenting only an old master-license reference in 2026 without a new CGA license number, that operator hasn't successfully migrated to the new framework, which means either (a) they're operating in a grey period of regulatory limbo, or (b) they couldn't pass the CGA's enhanced due diligence requirements. Neither is encouraging. Legitimate Curaçao operators have completed migration by now. From a player-protection standpoint, Curaçao is the weakest of the four regulators I cover here — dispute resolution is limited, fund segregation requirements are softer than MGA, and enforcement capacity is constrained. A Curaçao license isn't a deal-breaker, but it should lower your deposit ceiling.

How to Verify a Kahnawake Gaming Commission License

KGC verification is straightforward but doesn't generate the cleanest paper trail of the four. Go directly to gamingcommission.ca — this is the official KGC site, not to be confused with similarly-named domains. From the main navigation, look for "Licensees" or "Authorized Gaming Sites." The KGC publishes a public list of currently-licensed operators with the operator's brand name, the parent company holding the license, the URL(s) authorised under the license, and the license status.

What you won't find as easily on the KGC site is a license-number-search interface like MGA's. The KGC operates more on a "is this brand on the authorized list?" model. So if a casino's footer says "Licensed and regulated by the Kahnawake Gaming Commission," your job is to confirm the casino's exact URL appears on the KGC's authorized list. If you find the URL listed, you're good. If you don't, that's a problem — either the casino is unlicensed, or the URL on the KGC list has changed (which itself is suspicious and worth a support-ticket query before depositing).

One nuance: KGC also licenses what they call "Interactive Gaming License" holders, which are essentially data-centre / hosting providers serving operators under master licensing. If a casino's footer references only the hosting provider's KGC license and not its own operator authorization, that's the same red flag as Curaçao sublicensing — the casino itself isn't directly regulated. Push past the marketing copy and confirm the operator brand specifically appears on the KGC's authorized operator list. KGC's strength relative to Curaçao is that it's a smaller, more accountable regulator with a 25+ year track record, an established dispute resolution process, and stricter standards around player fund handling. It's a respectable middle-tier license for offshore-facing Canadian play.

How to Verify an AGCO Ontario Operating Certificate (Dual-Check Required)

Ontario is the only Canadian jurisdiction with a fully regulated iGaming market, and verification requires checking two separate registers because authorization is split between AGCO and iGO. Start at agco.ca, navigate to "iGaming Ontario Registrants," and search the public register. Every legally operating Ontario casino must hold an AGCO Operator registration under the Gaming Control Act. The register will return the operator's legal entity name, registration number, registration date, and registration status (Active, Suspended, Surrendered, etc.).

That's only half the check. AGCO registration alone doesn't authorize an operator to actually offer iGaming products to Ontario residents — that requires a separate Commercial Agreement with iGaming Ontario, the Crown agency that acts as conducting and managing operator. Go to igamingontario.ca and check the "Operators" or "Registered Operators" page. The operator brand should appear on iGO's list. Both checks must pass. An operator with AGCO registration but no iGO agreement is in compliance limbo and shouldn't be accepting Ontario player accounts.

There's an important compliance angle here that ties into FINTRAC obligations. Ontario-regulated operators must comply with Canadian anti-money-laundering reporting requirements — they're considered reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and file suspicious transaction reports to FINTRAC. This is materially different from offshore-licensed operators, who have no FINTRAC reporting obligation. From a player-protection and dispute-recourse perspective, AGCO/iGO regulation is the strongest available to Canadians, with mandatory player fund segregation, a formal complaints process, and dispute escalation to the Ontario Ombudsman. If you live in Ontario, regulated operators should be your default unless you have a specific reason to play offshore. For the rest of Canada, see our master Canadian casino rankings for province-by-province context.

Red Flags That Indicate a Fake or Misrepresented License

After hundreds of audits, I've developed a quick visual scan that catches most license misrepresentation in seconds. Here are the patterns to watch for. First, regulator logos in the footer with no accompanying license number. A legitimate licensee always displays the license number alongside the regulator name — a logo alone is meaningless and frequently fabricated. If you see an MGA logo but no "MGA/CRP/XXX/YYYY" reference, treat it as unlicensed until proven otherwise.

Second, broken or non-functional regulator logo links. Many regulators (MGA, AGCO, Gibraltar Gambling Commission) provide operators with interactive seal logos that link to a real-time verification page hosted on the regulator's domain. If you click the seal and it goes nowhere, returns a 404, or links to the casino's own "About Us" page instead of the regulator's domain, the license is almost certainly fake. Third, URL mismatches between the casino domain and the regulator's authorized URL list. This is the single most common scam pattern: an operator obtains a real license for one domain, then runs mirror sites or new brands on unauthorized domains under the same logo. The license is real, but it doesn't cover the site you're depositing on.

Fourth, references to "international licensing," "registered offshore," or vague regulator names like "Gaming Curaçao" (which isn't a thing — Curaçao Gaming Authority is the actual regulator). Fifth, license numbers that don't match the format conventions I documented above. An MGA license that doesn't start with "MGA/" and follow the standard four-segment format is fabricated. An OGL license that doesn't follow OGL/YYYY/XXX/YYYY is fabricated. Sixth, expired or suspended status on the regulator's register, with the casino still operating as if licensed. This happens more than you'd expect — operators don't always pull the footer claim down after losing their license.

The 3-Minute License Verification Test (Step-by-Step HowTo)

Here's the verification flow I run on every casino I audit. Time it on your phone — three minutes is the target. Step one (30 seconds): Scroll to the casino's footer. Identify the regulator name and copy the full license number. Note the exact casino URL you're on. Step two (30 seconds): Open a new browser tab. Do NOT click any links from the casino footer. Type the regulator's official URL manually: authorisation.mga.org.mt for MGA, gamingauthority.cw for CGA Curaçao, gamingcommission.ca for KGC, agco.ca for Ontario.

Step three (60 seconds): Search the regulator's public register using the license number or operator legal name. Confirm three things: (a) the license is Active/In Force, (b) the licensee company name matches what the casino's Terms & Conditions list as the operating entity, and (c) the casino's exact URL appears on the approved-URLs list (where applicable — MGA and CGA show URLs; KGC and AGCO show brand names). Step four (30 seconds): Note the license expiry date. If renewal is within 90 days, that's a watchpoint — operators don't always renew, and you don't want funds in an account licensed by an entity whose authorisation lapses next month. Step five (30 seconds): For Ontario specifically, repeat the check on igamingontario.ca to confirm Commercial Agreement status. If all checks pass, the license is legitimately verified. If any check fails, walk away and find a casino where they pass.

What Each License Actually Protects (and Doesn't)

Licenses aren't equivalent and don't protect against the same risks. MGA licensing requires mandatory player fund segregation in protected trust accounts ring-fenced from operational capital — if the operator goes bankrupt, your balance is theoretically returned to you ahead of general creditors. MGA also mandates dispute escalation to the Player Support Unit, which can compel operator action, and requires GamStop-equivalent self-exclusion infrastructure plus annual responsible-gambling audits. What MGA doesn't do: provide guaranteed compensation if the operator simply refuses to pay. The PSU can find in your favour but enforcement still depends on the operator's cooperation.

AGCO/iGO Ontario regulation provides stronger protection: mandatory segregated trust accounts, FINTRAC reporting (so AML processes are real, not theatrical), formal complaint process with regulator intervention, and Ontario Ombudsman escalation. The regulated Ontario market also has a binding Standards document — operators can be fined or have their registration suspended for violations. KGC offers segregated funds requirements and a dispute resolution process, but enforcement capacity is smaller than MGA. CGA (new framework) is improving from the old master-licensee system but still has the weakest enforcement track record of the four. What no license protects against: bonus terms manipulation, withdrawal-friction delay tactics within the operator's stated processing window, or losses due to your own play. Licensing is about consumer recourse, not gambling outcomes.

License Tiers Ranked by Player Protection

Based on what I've audited and what FINTRAC reporting and regulatory enforcement records actually show, here's how I rank the four authorities by genuine player protection. Tier 1: AGCO/iGO Ontario. Mandatory FINTRAC reporting, Canadian consumer protection law applies, Ontario Ombudsman recourse, strict standards enforcement, segregated player funds. The trade-off is product selection — Ontario's regulated market has fewer operators than the offshore world, and bonus terms are more conservative.

Tier 2: Malta Gaming Authority (MGA). EU regulatory framework, mandatory segregated funds, Player Support Unit dispute resolution, mature enforcement record, transparent public register. Most major international operators hold MGA licenses, so product selection is broad. Tier 3: Kahnawake Gaming Commission (KGC). Solid 25-year track record, segregated funds requirement, dispute resolution available, but smaller regulator with less enforcement bandwidth. Good middle-tier option for Canadian-facing operators. Tier 4: Curaçao (new CGA framework). Improving from the old master-licensee disaster, but still the weakest enforcement, softest player-protection requirements, and least transparent of the four. Acceptable for low-stakes play; I'd cap a Curaçao-only deposit limit at $200 personally. Anything labelled with only old-format Curaçao master-license references in 2026 isn't even in my ranking — I treat it as effectively unlicensed.

What to Do If a Casino Refuses to Show Its License

This happens more than you'd think. A casino's footer references "fully licensed and regulated" without naming a specific authority, or names an authority but doesn't display the license number. Your first move is to open a live-chat session with support and ask directly: "What is your operator's full license number and which regulator issued it?" Legitimate operators answer this in under two minutes. Compliance teams train support staff to provide license details on request — it's basic Know-Your-Customer reciprocity, and the operator knows you're entitled to ask.

If support hedges, deflects, or claims the information is "confidential," that's your answer. Walk away. No legitimate regulator considers license numbers confidential — they're published on public registers specifically so consumers can verify them. If support provides a number but it doesn't verify on the regulator's site, that's also your answer. If support refuses to identify the regulator at all and just repeats "we are fully licensed," that's the strongest possible signal that the operator is unlicensed or hiding the truth. In either case, file a complaint with the consumer protection authority in the regulator the operator claims to hold a license from — wasting regulator time on fraudulent license claims is exactly what gets unlicensed operators flagged and blacklisted.

License Renewal and Lapse Checks (Don't Skip This One)

Licenses expire. I've audited operators whose license lapsed eighteen months ago and they're still displaying the original number in the footer. The regulator's public register will show the current status — that's why step four of the three-minute verification flow specifically checks renewal dates. MGA licenses are typically issued for five-year terms. Curaçao CGA licenses are issued for shorter terms (usually two years for the initial license, with renewals available). KGC licenses are issued annually. AGCO/iGO registrations are reviewed periodically and can be suspended at any time for non-compliance.

What I do on operators I'm using long-term: check the license register every six months, or set a calendar reminder for 30 days before the renewal date shown on the regulator's record. If the renewal date passes and the register doesn't update to show a new term, the license has lapsed and the operator is now unlicensed regardless of what the footer claims. This is especially important for Curaçao operators in 2026 — the regulatory transition means many operators are still working through CGA migration, and lapses are more common than during stable regulatory periods. A license you verified six months ago isn't necessarily still valid today.

Frequently Asked Questions

Is it legal for Canadians to play at offshore-licensed casinos? Yes, for residents outside Ontario. Canadian federal law prohibits Canadian-based operators from offering online gambling without provincial authorization, but doesn't prohibit Canadian residents from playing at offshore-licensed operators. Ontario residents should use AGCO/iGO-regulated operators for full consumer protection. The grey-market legal status outside Ontario means license verification is genuinely your only consumer recourse — there's no Canadian regulatory body that will help you recover funds from an unlicensed offshore operator.

Can a casino hold licenses from multiple regulators? Yes, and major operators frequently do. A single operator might hold an MGA license for European markets, a UKGC license for UK players, an AGCO/iGO registration for Ontario, and a Curaçao license for other jurisdictions. The license that matters for you is the one covering the URL you're playing on and the jurisdiction you're resident in. Check the footer for jurisdiction-specific licensing and confirm the license covers Canadian residents (most do; MGA explicitly does, KGC does, Curaçao does, AGCO/iGO covers Ontario only).

What's the difference between a master license and a sublicense in Curaçao? Under the old Curaçao framework (pre-2024), four master license holders sublicensed thousands of operators with minimal oversight. A sublicensed operator wasn't directly accountable to the Curaçao government — they were accountable to their master licensee, which had financial incentive to keep sublicensees operating regardless of compliance issues. The new CGA framework eliminates sublicensing — every operator now holds a direct license from the Curaçao Gaming Authority. If you see master-license references in 2026, the operator hasn't migrated.

How long does license verification actually take in practice? Three minutes is my target and I hit it consistently. The slowest part is reading the regulator's register interface, which varies in quality (MGA is excellent; KGC is functional but spartan). After verifying a few casinos you'll know each regulator's site layout and the process drops to ninety seconds. There's no excuse for skipping verification — if you can spend ten minutes comparing welcome bonuses, you can spend three minutes confirming the operator is real.

Why do some casinos display fake regulator logos? Because it works on most players. Visual regulator logos signal legitimacy to the 95% of users who never verify, and the cost of including a fake logo is zero. This is precisely why regulator-provided interactive seals exist — when you click an MGA seal on a legitimately-licensed site, it opens a real-time verification page on mga.org.mt confirming the casino's current license status. Static PNG logos with no interactive verification are the default for unlicensed operators because they can't fake the live regulator response.

What's FINTRAC and how does it relate to casino licensing? FINTRAC is the Financial Transactions and Reports Analysis Centre of Canada, the federal agency responsible for anti-money-laundering and counter-terrorist-financing oversight. Canadian-regulated operators (AGCO/iGO in Ontario) are FINTRAC reporting entities and must file suspicious transaction reports, large cash transaction reports, and electronic funds transfer reports. Offshore-licensed operators have no FINTRAC obligation. This affects players two ways: regulated operators conduct stricter identity verification (which means slower onboarding but stronger fraud protection), and your transactions at regulated operators are subject to Canadian AML reporting if they meet reporting thresholds. Most players never notice; high-volume players should.

Can I trust third-party "casino verified" badges from review sites? Generally no. Independent review sites often display their own "verified" or "trusted" badges that have no regulatory basis — they're marketing assets, not compliance certifications. The only verification that matters is the one you do yourself against the actual regulator's public register. Use review sites for context (player complaints, withdrawal speed, bonus terms analysis) but never substitute a review site's "trust score" for license verification. The two-minute regulator check is the only check that actually answers the question of whether you'll have consumer recourse if something goes wrong.