How to Build a Casino Platform That Complies With a UAE iGaming License

For the first time in its history, the United Arab Emirates has a working federal framework for commercial gaming — and the technology requirements attached to it are among the most demanding in any new jurisdiction. The General Commercial Gaming Regulatory Authority (GCGRA), established by federal decree in September 2023 and headquartered in Abu Dhabi, holds exclusive jurisdiction over lottery, internet gaming, sports wagering and land-based gaming facilities across all seven emirates. There is no emirate-level alternative and no free-zone workaround. Every route into this market runs through the GCGRA.

The commercial prize is substantial. Wynn Resorts projects a total addressable UAE gaming market of $3 billion to $5 billion; CBRE has cited projections as high as $8.5 billion in annual gross gaming revenue if three to four integrated resorts are built. Bloomberg Intelligence has modelled $6.6 billion. Play971, operated by Coin Technology Projects LLC, went fully live in December 2025 as the country's first authorised real-money online sportsbook and iGaming platform. The window for second and third movers is open right now.

But the barrier is deliberately high, and it is largely a technology barrier. The GCGRA has adopted the full Gaming Laboratories International standard series as its technical framework. It expects a demonstrably robust AML and KYC framework to exist before a licence is granted, not after. It requires emirate-level geolocation enforcement, immutable audit trails, certified RNG and a responsible gaming control stack. This guide walks through every one of those requirements and what each means for the platform you actually have to build.

The Legal Status of iGaming in the UAE (2026)

Understanding the legal architecture matters because it determines your risk posture as a technology provider as well as an operator. Four developments sit on the timeline:

Date	Development	What it changed
September 2023	GCGRA established by Federal Law by Decree	Created the UAE's first federal gaming regulator with exclusive jurisdiction over commercial gaming across all seven emirates. Headquartered in Abu Dhabi.
2024	First lottery licence issued to The Game LLC	Proved the licensing machinery worked. Mahzooz and Emirates Draw lost their bids in the same round, establishing that the process is genuinely competitive and exclusionary.
Late 2024	Wynn Al Marjan receives first land-based licence	Island 3 AMI FZ-LLC licensed for the UAE's first integrated resort casino in Ras Al Khaimah. $5.1 billion project, 225,000 sq ft gaming floor, opening 2027.
28 Nov 2025	First internet gaming and sports wagering licence	Coin Technology Projects LLC licensed as the 19th GCGRA licensee. Play971 soft-launched within a week and went fully operational on 15 December 2025.
1 June 2026	Federal Decree-Law No. 25 of 2025 in force	Removed the civil-code gambling prohibition chapter, eliminating the legal tension where licensed operators held valid authorisation under a civil code that declared gaming contracts void.

Market Size and the Commercial Opportunity

The structural case for the UAE is not just market size — it is market quality. JP Morgan noted that the project's core target markets represent roughly 25 percent of the world's population, 20 percent of global GDP and nearly 20 percent of global high-net-worth wealth. The UAE has 99 percent internet penetration, top-five global smartphone penetration, no personal income tax on player winnings, and a resident and tourist population with among the highest disposable incomes in the region.

The scarcity is the other half of the thesis. The number of licences is deliberately limited and the suitability bar is deliberately high. A licensed platform in this market is not competing against a hundred grey-market operators — it is competing in a closed, supervised environment where regulatory standing is itself the moat.

The Five GCGRA License Categories

Entity Licenses

Individual Licenses

The GCGRA Licensing Process, Step by Step

What the Suitability Investigation Examines

• Corporate structure and beneficial ownership: a UAE-registered legal entity or a credible plan to establish one, with a fully traced ownership chain to ultimate beneficial owners. Opaque structures are the fastest route to rejection.
• Integrity and probity of key persons: criminal record checks, regulatory history in other jurisdictions, litigation history, and personal financial standing for every director, executive officer and controller.
• Source of funds and source of wealth: documented provenance of the capital funding the venture. This is bank-grade scrutiny, not a formality.
• Financial capacity: audited financials, capital adequacy to cover player liabilities and operating runway, and evidence that player funds can be segregated and protected.
• Business plan: product scope, target market, revenue model, marketing plan and growth projections, all of which must be internally consistent with the technology you propose to deploy.
• Compliance framework: written AML/CFT policy, KYC procedures, responsible gaming policy, complaints handling, data protection and incident response — each supported by the systems that actually enforce them.
• Technology and operational capability: platform architecture, certification status, security posture, hosting arrangements, disaster recovery and the reporting capability the regulator will rely on for supervision.

Who Is Already Licensed — The Current GCGRA Register

The public licensee register is the single most useful strategic document in this market. It tells you exactly which categories are being granted, which suppliers have already cleared suitability, and where the gaps are. Here is the register as published by the GCGRA:

GLI Technical Standards: The Actual Engineering Specification

This is the section most operators underestimate. A GLI standard is not a policy document — it is a detailed engineering specification covering RNG behaviour, game fairness, account management, transaction integrity, reporting, security and recovery. Building to it after the fact means rewriting the core. Here is the full set the GCGRA publishes, mapped to what each governs:

What GLI-19 Actually Requires From Your Platform

• Certified RNG with demonstrable statistical integrity: the random number generator must be independently tested and certified. Seeding must be cryptographically sound, the period must be sufficient, and the output must pass statistical randomness testing. Client-side RNG is not acceptable — game outcomes must be determined server-side.
• Server-authoritative game logic: the client is a rendering layer only. Every outcome, balance change and state transition is determined and recorded on the server. Any architecture where the client can influence outcomes fails immediately.
• Complete and immutable transaction logging: every wager, win, deposit, withdrawal, bonus award, adjustment and session event must be logged with sufficient detail to reconstruct any player's full history. Logs must be tamper-evident.
• Player account management integrity: account creation, verification status, balance handling, limits and self-exclusion states must be enforced consistently across every entry point — web, mobile web, native app and any API.
• Game recovery and interrupted-session handling: if a session drops mid-game, the platform must be able to restore or correctly settle the game state. This is a common certification failure point in platforms not built for regulated markets.
• Published and enforced RTP: return-to-player values must be certified, accurate and not silently variable. Any RTP configuration capability must be controlled, logged and within certified bounds.
• Reporting capability: the platform must be able to generate the operational, financial and regulatory reports the authority requires, on demand and for arbitrary historical periods.

The Compliance-First Platform Architecture

The PAM and Wallet Layer

The Player Account Management system is the regulatory heart of the platform. It is what the regulator supervises, what the auditor examines and what determines whether you can evidence compliance. It must handle:

• Single player identity across all products: one verified identity, one wallet, one set of limits and one self-exclusion state spanning casino, live casino and sportsbook. Separate silos per vertical are a compliance failure — a self-excluded player must be excluded everywhere, instantly.
• Segregated player funds with a double-entry ledger: player balances must be accounted separately from operating funds, with every movement recorded as a balanced double-entry transaction. This is what makes financial reporting and player-liability reporting possible.
• Verification state machine: accounts move through explicit states (registered, pending verification, verified, restricted, suspended, self-excluded, closed) with strictly defined permitted actions in each state. Un-verified accounts must be prevented from withdrawing.
• Full limit framework: deposit limits (daily, weekly, monthly), loss limits, wager limits, session time limits and reality-check intervals — each player-settable, with decreases taking effect immediately and increases subject to a cooling-off period.
• Complete activity history: every player must be able to retrieve their own transaction and gameplay history, and the operator must be able to produce it for the regulator for any period.
• Bonus and promotion ledger: bonus funds tracked separately from cash, with wagering requirement progress, expiry and conversion fully auditable. Bonus abuse detection sits here.

AML and KYC Engineering

The KYC Orchestration Layer

• Document authentication: automated verification of government-issued identity documents including Emirates ID and passports, with tampering detection, MRZ and chip reading where available rather than OCR alone. OCR-only pipelines produce the false-accept rates that fail audit.
• Biometric liveness detection: selfie capture matched against the document photo with active or passive liveness checks to defeat presentation attacks. This is now standard expectation in any serious regulated market.
• Age verification enforcing 21+: the minimum age for gaming in the UAE is 21. Date of birth must be read from the document rather than self-declared, and the enforcement must be evidenced in logs. Underage access is the single fastest route to licence loss in any jurisdiction.
• Address and residency verification: proof-of-address handling with document validity rules and expiry management.
• Sanctions, PEP and adverse media screening: screening at onboarding and on an ongoing basis against updated lists, with match resolution workflow, false-positive handling and full decision audit.
• Risk-based tiering: not every player needs the same depth of verification. Build tiered thresholds where enhanced due diligence triggers on deposit volume, withdrawal patterns, jurisdiction risk or behavioural flags.
• Re-verification triggers: document expiry, material change of circumstances, dormancy reactivation and threshold breaches must all trigger re-verification automatically.

The AML Transaction Monitoring Engine

• Rules-based detection: configurable thresholds for deposit velocity, deposit-to-wager ratio (a classic laundering signature), rapid deposit-withdraw cycling with minimal play, structuring below thresholds, and unusual payment method patterns.
• Behavioural risk scoring: a running risk score per player combining transaction patterns, KYC risk tier, geographic signals and gameplay behaviour, with automatic escalation when the score crosses thresholds.
• Source of funds and source of wealth escalation: automated requests for documentary evidence when cumulative deposits cross defined thresholds, with account restriction until satisfied.
• Case management workflow: alerts route to a compliance queue with investigation notes, evidence attachment, decision recording and four-eyes approval on material outcomes. Every decision, including decisions not to escalate, must be recorded with rationale.
• Suspicious activity reporting: structured workflow for preparing and filing reports to the relevant UAE authority, with the underlying evidence preserved immutably.
• Immutable audit trail: tamper-evident logging of every AML decision, alert, override and escalation. If a regulator asks why a specific account was not escalated in March, you must be able to answer with evidence.

Geolocation and Geofencing

• Continuous verification, not login-only: location must be re-verified periodically during a session and re-checked before any wager or withdrawal. A player who crosses a border mid-session must be blocked mid-session.
• Multi-signal triangulation: GPS, IP geolocation, WiFi access point mapping, mobile network data and device signals combined into a confidence score, rather than reliance on any single signal.
• VPN, proxy and spoofing detection: detection of commercial VPNs, proxies, Tor, DNS manipulation, GPS spoofing applications and emulators. This is an arms race and it is why operators use specialist providers rather than building it in-house.
• Emirate-level granularity: Play971's rollout was reported as accessible in Abu Dhabi and Ras Al Khaimah before wider availability. Your geofencing engine must support per-emirate rules that can be reconfigured without a code deployment.
• Fail-closed behaviour: if location cannot be established with sufficient confidence, the correct behaviour is to block play — not to allow it and log a warning.
• Full decision audit: every location check, its inputs, its confidence score and its outcome must be logged for regulator inspection.

Responsible Gaming Controls

The GCGRA describes responsible gaming as pivotal to its mandate, with a mission centred on player safety and socially responsible gaming practices. These are not optional features to be added in a later release — they are licence conditions.

• Self-exclusion: immediate, irreversible-for-the-chosen-period exclusion applying across every product and every access channel. Must survive account closure and re-registration attempts, which means exclusion is keyed to verified identity, not to the account record.
• Time-outs and cooling-off: shorter voluntary breaks (24 hours, 7 days, 30 days) as a lighter-touch step before full self-exclusion.
• Player-set limits: deposit, loss, wager and session-duration limits. Decreases apply immediately; increases require a cooling-off delay and explicit reconfirmation.
• Reality checks: periodic in-session notifications showing elapsed time and net position, with the option to end the session.
• Behavioural risk detection: automated identification of markers of harm — escalating deposits, loss-chasing patterns, extended session lengths, play at unusual hours, cancelled withdrawals followed by immediate play — with defined intervention workflows.
• Prominent help resources: accessible information on problem gaming and support pathways, in both English and Arabic.
• Advertising and bonus restrictions for at-risk players: players displaying harm markers, on a time-out or self-excluded must be suppressed from all marketing and promotional communication automatically. CRM suppression must be wired to the responsible gaming state, not managed manually.

Permitted Games and Content Supply

The content supply rule is the one to internalise: your platform may only serve content from GCGRA-licensed suppliers. The vendor register already includes Endorphina, Games Global, Playtech (via VSTechnology), Hub 88, Live Online Gaming Services (OneTouch and Live88), Aristocrat, Novomatic, IGT, Konami, LNW Gaming and Scientific Games. Your aggregator integration layer should therefore be built with a jurisdictional content gating capability — the ability to enable or disable individual titles and suppliers per jurisdiction from configuration, without a code release. Operators running multi-market platforms without this capability end up maintaining separate builds per market.

Payments and the Crypto Question

• AED as base currency with correct rounding, display and reconciliation. Multi-currency support is useful for a multi-market roadmap but the UAE deployment should settle in AED.
• Local payment rails: UAE debit and credit cards, local bank transfer, and licensed local payment technology providers. PayBy Technology has been reported among approved vendors in the GCGRA's licensing rounds.
• PCI DSS compliant handling: tokenised card storage, no raw PAN in your systems, scoped cardholder data environment. This is explicitly cited among GCGRA cybersecurity expectations.
• Source-of-funds capture at deposit level: payment method provenance recorded and linked to the AML risk engine, with card-holder-name matching against verified identity.
• Withdrawal approval workflow: automated approval within defined risk parameters, manual review queue above thresholds, mandatory verification completion before first withdrawal, and closed-loop payout to the original deposit method where possible.
• Payment abstraction layer: providers behind a common interface so adding, removing or swapping a PSP is a configuration change. This is what makes a platform genuinely multi-jurisdictional.

Regulator Reporting and Supervision

Approved licensees are subject to periodic regulatory reporting and ongoing supervision. In practice this means your platform must be able to produce, on demand and for arbitrary historical periods:

• Financial reporting: gross gaming revenue by vertical and period, player liability position, deposits, withdrawals, bonus cost, and reconciliation to your accounting system.
• Player activity reporting: registrations, verification completion rates, active players, self-exclusions and time-outs granted, limit changes, and complaint volumes.
• AML reporting: alerts raised, cases opened, escalations, suspicious activity reports filed, and enhanced due diligence outcomes.
• Responsible gaming reporting: harm markers detected, interventions made, self-exclusion register state and marketing suppression compliance.
• Technical and incident reporting: uptime, security incidents, game malfunctions, recovery events and certification status of all deployed components.
• Game-level reporting: per-title wagers, wins, actual versus theoretical RTP variance, and jackpot movements.

Security, Certification and Testing

GCGRA cybersecurity expectations for licensed operators cover platform security testing, RNG certification, player account protection, PCI DSS compliance for payments, AML and KYC system security, data protection, third-party vendor assessment, incident response capability and responsible gaming controls — aligned to the GLI-19 and GLI-33 standards.

UAE iGaming Taxation Explained

Advertising and Marketing Rules

The platform implications of the advertising regime are frequently overlooked at architecture stage, but they are real engineering requirements:

• Geo-targeted campaigns: campaigns must be restricted to the UAE or to the specific emirates covered by your authorisation. Your attribution and tracking layer must be able to evidence this.
• Age-gated ad delivery: ads must not be served to users below the applicable minimum age, which requires age signal handling in your marketing stack.
• Landing page compliance: destination URLs must display GCGRA licence details, responsible gaming statements, self-exclusion links and Arabic-language content where required. This means your CMS and front end must render compliant footers and disclosures on every acquisition landing page, not just the main site.
• Marketing suppression wired to RG state: self-excluded players, players on a time-out and players flagged with harm markers must be automatically suppressed across every channel — email, SMS, push, on-site and paid retargeting audiences. This suppression must be an automated data flow from the responsible gaming service to the CRM and ad platforms, not a manual list export.
• Affiliate compliance controls: if you run an affiliate programme, affiliate creatives and landing pages fall within your compliance perimeter. Your affiliate platform needs creative approval workflow and compliance monitoring.

White-Label vs Turnkey vs Custom for the UAE

Full Platform Cost Breakdown

Below is a component-level breakdown for a turnkey GCGRA-ready casino and sportsbook platform, at Capermint's India development rates of $20 to $50 per hour. These figures cover platform software and integration only — they exclude GCGRA licence fees, legal and corporate formation, third-party certification laboratory fees, staffing and marketing.

Costs Outside the Platform Budget

Realistic Build Timeline

Seven Costly Mistakes Operators Make Entering the UAE

• 1. Treating compliance as a feature instead of the foundation. Building the lobby and games first, then bolting on AML and KYC, produces a platform that cannot be certified without substantial rework. Build the compliance core first, always.
• 2. Applying for a licence before the technology exists. The GCGRA expects a demonstrably robust AML and KYC framework before granting a licence. Sequential planning — licence first, build second — stalls at the suitability investigation. Run them in parallel.
• 3. Assuming country-level geofencing is sufficient. Licensed rollouts have been restricted to specific emirates. Build emirate-level geofencing with runtime reconfiguration, or you will be re-engineering under time pressure.
• 4. Inheriting an opaque compliance architecture via white-label. The licence and the enforcement exposure sit with the operator, not the platform vendor. If you cannot inspect and evidence how your AML engine makes decisions, you cannot defend them to a regulator.
• 5. Planning for crypto deposits. Crypto sits outside both VARA and ADGM authorisations and outside the GCGRA internet gaming licence. Architect fiat-first for the UAE; keep the payment abstraction so crypto can be enabled in permitted jurisdictions.
• 6. Hard-coding a single tax model. The VAT treatment of gaming supplies is a live question and a dedicated GGR levy is a realistic future development. Your ledger and reporting must support both bases with configurable rates.
• 7. Sourcing content from unlicensed suppliers. Every content supplier serving your UAE players must appear on the GCGRA vendor register. Build jurisdictional content gating so titles and suppliers can be enabled or disabled per market from configuration.

Why Capermint for Your UAE iGaming Platform

Engagement Models

Capermint iGaming Development Services

Key Terms in UAE iGaming Compliance

GCGRA

The General Commercial Gaming Regulatory Authority. Established by Federal Law by Decree in September 2023 and headquartered in Abu Dhabi, it is the exclusive federal authority regulating, licensing and supervising all commercial gaming across all seven emirates. There is no alternative licensing route.

Federal Decree-Law No. 25 of 2025

The legislation, effective 1 June 2026, that removed Articles 1012 to 1019 (the gambling and betting chapter) from the UAE Civil Transactions Law, creating the legal architecture for enforceable licensed gaming contracts. It did not legalise unregulated gambling.

GLI-19

Gaming Laboratories International Standards for Interactive Gaming Systems. The core technical specification for an online gaming platform: RNG, game integrity, player account management, transaction logging, reporting and recovery. Adopted by the GCGRA.

GLI-33

GLI Standards for Event Wagering Systems. The governing specification for sportsbook operations: bet placement, odds handling, settlement, void and cancellation logic, and in-play integrity.

PAM (Player Account Management)

The back-office system that manages player identity, verification state, wallet balances, limits, self-exclusion and activity history. The regulatory heart of an iGaming platform and the primary object of regulatory supervision.

Suitability investigation

The GCGRA's rigorous assessment of an applicant's eligibility, integrity and operational capability. Covers corporate structure, beneficial ownership, source of funds, key person probity, financial capacity, compliance framework and technology readiness.

Gaming-Related Vendor licence

The GCGRA entity licence category for suppliers of gaming equipment or related goods and services. The entry route for platform providers, game studios, aggregators and compliance technology vendors, requiring no player-facing operations.

Geofencing

Technical enforcement of the rule that players must be physically located within a permitted area. In the UAE this must operate at emirate level, using multi-signal triangulation with VPN and spoofing detection, verified continuously rather than only at login.

Segregated player funds

The requirement that player balances be held and accounted separately from operating funds, evidenced through a double-entry ledger, so player liability is always demonstrable.

GGR (Gross Gaming Revenue)

Total wagers less winnings paid to players. The standard base for gaming taxation and for platform revenue-share arrangements. Wynn has disclosed a blended UAE gaming tax of 10 to 12 percent of GGR for its land-based resort.

RTP (Return to Player)

The certified theoretical percentage of wagers a game returns to players over time. Must be certified, accurate and not silently variable, with any configuration capability controlled and logged.

Pillar Two / Global Minimum Tax

The OECD framework under which large multinational enterprise groups face a minimum effective tax rate of 15 percent, potentially topping up the UAE's 9 percent headline corporate rate for in-scope groups.

Frequently Asked Questions

---