How do online casinos work? They run as linked systems under a licensed operator: an account and wallet hold identity, balance and limits; game servers, often reached through an aggregator, decide rounds with lab-tested random number generators; payment, identity and location checks gate money movements; a back office logs every transaction for regulators. Real-money play is legal only where licensed.
Planning the systems behind a licensed casino? Capermint builds these layers for licensed operators and suppliers: white-label builds from $35K with 6–10 weeks of software build before licensing and lab certification, and custom platforms from $60K. See what our online casino software work covers, or send your markets through the Request my project scope form.
What happens to a player’s money between deposit and payout?
A player’s money enters through the cashier, sits in a wallet balance the operator controls, is debited for each bet and credited with each win by calls from the game server, and leaves only through a withdrawal that passes identity, fraud and bonus-term checks. Every movement is logged so the regulator can rebuild it later.
The flow at a glance: login and location check → deposit → wallet → game round → settlement → withdrawal → reporting.
Here is the life of one bet in a licensed online casino. Supplier names and APIs differ, but regulated online gambling websites follow this order.
- Login and identity. The player signs in to the player account management system (PAM): the system of record for identity, verification status, balance, limits and self-exclusion flags. A self-excluded account stops here.
- Location check. In US states, the system confirms the player is inside the licensed state before it accepts bets. New Jersey requires a check at login and at set intervals. US play is intrastate because the federal Unlawful Internet Gambling Enforcement Act (UIGEA) exempts only bets placed and received within one authorizing state.
- Deposit. The cashier, the module that routes money in and out, sends the payment to a payment provider; the deposit is checked against limits and anti-money-laundering (AML) rules, then credited. Great Britain requires age verification before any deposit.
- Game launch. The lobby opens a game running on a remote game server (RGS), the studio’s own or one reached through an aggregator, with a session token tied to the player’s wallet.
- Bet debit. When the player stakes, the game server calls the operator’s wallet to debit the stake. Each bet gets a unique transaction ID that is reused on any retry, so a retried call cannot charge the player twice.
- Outcome. The game server’s random number generator (RNG) draws the result, independent of previous rounds, and the game’s certified math model maps it to a win or a loss. In live dealer games, the result comes from a physical table instead.
- Settlement. The game server calls the wallet again to credit any win and close the round. Bonus wagering counters and responsible gaming limits update on the same event.
- Withdrawal and reporting. A withdrawal is paid only after identity, fraud, AML and bonus-term checks, usually back to the deposit method. Every round, payment and balance change feeds the regulator’s reports.
For a single round inside the RGS, including where the RNG sits, read our explainer on how does a remote gaming server work.
Each game’s math model sets its return to player (RTP); the remainder is the house edge, so a game with a 96% RTP keeps about 4% of stakes over the long run. Across all games, that margin becomes the operator’s gross gaming revenue (GGR), before bonuses, gaming taxes and supplier fees.
How is player money held and protected?
Player balances are the operator’s liability, not the game studio’s, and regulators make operators segregate or disclose them. New Jersey requires a dedicated patron-funds bank account whose balance covers at least the daily total of cashable balances, funds on game and pending withdrawals. The bank must be FDIC-insured with a physical presence in New Jersey unless the Division allows otherwise.
New Jersey also requires a monthly schedule, filed with the Division’s Revenue Certification Unit, showing the account is sufficiently funded. Great Britain requires operators to tell each customer in writing, at first deposit, whether their funds are protected if the operator becomes insolvent; the customer must acknowledge this before the money can be used to gamble.
Build implication: the wallet ledger must report cashable balance, funds on game and pending withdrawals as separate daily totals, and a GB cashier must block play with first-deposit funds until the customer acknowledges the notice.
Who runs each layer of an online casino?
The licensed operator owns the player relationship, the money and the compliance duty. Suppliers run technology layers under contract: a platform supplier for accounts, wallet and back office, game studios for content and game servers, specialist vendors for payments, identity and location, and accredited test labs for certification. Regulators license and audit the chain.
| Layer | What it is | Usually run by | Independent check |
|---|---|---|---|
| Player account and wallet (PAM) | The system of record for identity, verification status, balances, limits, self-exclusion and the transaction ledger | Operator, on its own or a supplier’s software | Regulator audits and internal controls |
| Game server (RGS) and RNG | The server that runs game logic, draws outcomes and stores round history | Game studio or platform supplier | Accredited test lab, then the regulator |
| Aggregator | A hub that connects many studios through one integration and relays wallet calls and round reports | Aggregator or platform supplier | Supplier licensing or registration in each market |
| Cashier and payments | The module that routes deposits, withdrawals and chargebacks to payment providers | Operator with payment providers | Banks and card schemes; player-fund rules |
| Identity (KYC), AML and location | Know-your-customer (KYC) age and identity checks, sanctions and AML screening, geolocation | Operator with specialist vendors | Regulator; state location rules in the US |
| Bonus, CRM and risk | Offers, wagering counters, fraud and bonus-abuse rules, responsible gaming triggers | Operator | Regulator marketing and responsible gaming rules |
| Back office and reporting | Player management, finance, tax and regulatory reports, audit logs | Operator, on supplier tooling | Regulator and external auditors |
| Test lab | Tests RNG output, game math and platform controls against the market’s standard; see what being RNG certified means | Accredited labs such as GLI, iTech Labs or BMM | Regulator accepts the lab and its reports; Great Britain requires ISO/IEC 17025 accreditation |
| Regulator | Licenses operators and, in many markets, suppliers; sets technical standards; fees compared in our online casino license cost breakdown | For example UKGC, MGA, NJ DGE, AGCO and AGLC (iGaming Ontario and the Alberta iGaming Corporation manage those markets but do not regulate them) | Publishes standards and licensing decisions |
Most operators do not integrate every studio one by one. A game aggregator connects many studios through one integration and relays their wallet calls in a common format; the operator still decides which games each market may show.
For the full list of modules a launch needs, see our casino platform page. Contracts can move work to suppliers but not the license holder’s legal duty; our overview of the iGaming industry explains how B2C operators and B2B suppliers split the business.
Who owns each layer depends on the business model. A provider-hosted white label rents the whole stack, often under the provider’s license where a market still allows it, for a revenue share. A white label casino build or a turnkey online casino runs under your own license, and custom puts the wallet, back office and data fully under your control. Compare the models in our white label vs turnkey casino guide, and see budgets in online casino development cost.
How do online gambling websites work beyond casino games?
Online gambling websites beyond casino reuse the same account, wallet, payment, identity and reporting layers and swap the game server for a vertical engine. A sportsbook adds odds feeds, trading and bet settlement; a poker room adds a table server and shared player liquidity; a lottery adds a certified draw system. One player account can then span every vertical.
So the short answer to how online gambling works across verticals: shared player and money layers, with a different engine deciding each bet and a regulator-specific rulebook for each product.
What happens when a game server and the casino wallet disagree about a round?
When the game server and the wallet disagree, a well-built system never guesses. It retries the same transaction ID until the wallet answers, returns a stake if no outcome was generated, restores a multi-step game to its last state, and flags any remaining mismatch for a daily reconciliation that finance and compliance teams sign off.
The player-facing rules come from the UK Gambling Commission’s interrupted-gambling standard (RTS 10) and GLI-19, the GLI standard for interactive gaming systems that many regulators adopt. The table maps each case to the rule behind it.
| Mismatch | What the system should do | Rule it supports |
|---|---|---|
| Debit call times out; the game server cannot tell if the stake was taken | Retry with the same transaction ID; the wallet returns the original result instead of charging twice | Accurate balances; no double charge |
| Stake taken, but no outcome generated in a single-stage game | Void the round and return the stake to the balance | UKGC RTS 10 (single-stage, single-participant games) |
| Outcome generated, but the credit call failed | Keep retrying the credit until it succeeds; the result stands | UKGC RTS 10 (result stands once the bet is received) |
| Player disconnects mid-round in a multi-step game such as blackjack or a bonus round | Save the game state; on return, resume from the last step; hold the wagered funds and show them in the player’s account until the game completes | UKGC RTS 10; GLI-19 interrupted games (section 4.16) |
| Day-end totals differ between game server and wallet | Match round by round, investigate each gap, and record any manual adjustment with an approver | New Jersey: manual adjustments above $500 need supervisor approval before entry |
Worked example (illustrative numbers): the game server reports 48,210 rounds and $212,400 in stakes for the day; the wallet shows $212,425. Matching by transaction ID finds one $25 debit the wallet accepted after the game server timed out and voided the round. The fix is a logged refund, not a balancing entry, and the root cause goes into the timeout rules.
Records make every one of these fixes auditable. New Jersey requires a gaming system to keep everything needed to recreate each player’s game play and account activity, including identity and location checks, for at least 10 years. Design the round log for replay from day one.
How do live dealer games fit the same flow?
Live dealer games use the same wallet and settlement steps; only the outcome source changes. A studio dealer confirms each result at a physical table, and the game server settles bets against it. New Jersey requires a simulcast control server that records all wagering and results, so stream, result feed and wallet calls should share one round ID.
What does a regulator see from an online casino’s back office?
A regulator sees what the back office records: every account, deposit, bet, win, bonus, adjustment and withdrawal, plus self-exclusion and limit history, game certificates and software change logs. It receives scheduled reports for tax and oversight and can require raw data exports, so reports must reconcile to the wallet ledger to the cent.
- Data access: New Jersey requires a mechanism for the Division of Gaming Enforcement to query and export all gaming system data in the format it specifies.
- Player statements: New Jersey players can request at least six months of detailed activity and a yearly summary of deposits, withdrawals, wins and losses and limit history.
- Responsible gaming controls: deposit and spend limits by day, week and month, daily time limits, account suspension (at least 72 hours in New Jersey) and self-exclusion, with every change logged.
- Game approval: in Great Britain, test reports for new games and RNGs go to the Gambling Commission before release; in Ontario, a registered independent testing lab must certify games, RNGs and the parts of the system that handle player bets.
- Change control: a secure log of every software installation and removal, plus retesting when a change affects fairness.
- Security: New Jersey requires encrypted Social Security numbers, passwords and card or bank details, and an annual system integrity and security assessment by an independent professional.
- Federal reporting: New Jersey licensees must meet federal duties, including suspicious activity reports and W-2G reporting.
- Financial controls: segregated player funds, supervisor-approved adjustments and daily reconciliation of game servers, wallet and payments.
Fairness is proven before launch, not argued afterward. An accredited lab tests RNG output and game math against the market’s standard, the regulator accepts the report, and changes that affect fairness are retested. In Great Britain, RTS 7 requires outcomes to be acceptably random and bans adaptive, compensated games.
Capermint builds RNG and game math ready for independent testing by accredited labs such as GLI, iTech Labs or BMM; certification is obtained by the operator or game owner. In markets that register suppliers, such as Ontario, the registered operator or supplier submits the product and holds the certificate.
Where can real-money online casinos legally accept players?
Real-money online casinos are legal only where licensed: seven US states (Maine pending), Ontario and Alberta, Great Britain and other licensing markets; operators hold the license. Other Canadian provinces sell online play only through lottery corporations, while India (PROGA 2025) and Brazil (Provisional Measure 1.394/2026, still before the STF and Congress) prohibit online money games or betting.
| Market | Real-money online casino status | Who licenses | What the build must support |
|---|---|---|---|
| United States | Live in seven states: New Jersey, Pennsylvania, Michigan, West Virginia, Connecticut, Delaware and Rhode Island. Maine has legalized online casinos run by its tribal nations, but its rules and launch are still pending. | State regulators, such as the New Jersey Division of Gaming Enforcement, the Pennsylvania Gaming Control Board and the Michigan Gaming Control Board; platform and game suppliers need a state supplier license too | In-state geolocation, state limits and reports; in New Jersey, primary gaming equipment within Atlantic City |
| US sweepstakes and social casinos | Run under sweepstakes-promotion law rather than a gambling license, and contested: a growing list of states bans dual-currency models, including California from 1 January 2026, where the ban also reaches platform providers and content suppliers that knowingly support them | State law | Two currencies, a free alternative method of entry (AMOE), state exclusions and a state-by-state legal check for suppliers as well as operators; see our guide to dual currency sweepstakes rules |
| Ontario | Regulated market open to registered private operators | AGCO registers operators and suppliers; iGaming Ontario conducts and manages the market through operating agreements | Registrar’s Standards for Internet Gaming; lab certification of games, RNGs and bet-handling systems; suppliers of games and game systems need AGCO supplier registration |
| Alberta | Regulated market with registered private operators | AGLC registers operators and suppliers; the Alberta iGaming Corporation manages the market through commercial agreements | AGLC’s Standards and Requirements for Internet Gaming, including integration with Alberta’s centralized self-exclusion program |
| Other Canadian provinces | Online gaming run by provincial lottery corporations | Provincial lottery corporations | Supply through the provincial corporation |
| Great Britain | Licensed market | UK Gambling Commission; suppliers of gambling software need their own gambling software license | Remote technical standards (RTS), age verification before deposit, test reports before release |
| Malta (MGA) | Licensed market and licensing base | Malta Gaming Authority: B2C Gaming Service license; B2B Critical Gaming Supply license | MGA requirements for critical gaming supplies |
| Other licensing markets | Licensed markets with their own rules, for example Curaçao and the Philippines | Curaçao Gaming Authority under the National Ordinance on Games of Chance (LOK); PAGCOR in the Philippines, which also accredits B2B suppliers | Each regulator’s own standards; see Curacao casino software and iGaming software Philippines |
| India | Online money games prohibited under the Promotion and Regulation of Online Gaming Act 2025 | Not licensable for real money | Free-to-play, social and e-sports formats only; e-sports titles must be registered with the Online Gaming Authority of India |
| Brazil | Fixed-odds betting, including online games, prohibited nationwide since 25 September 2026 under Provisional Measure 1.394/2026; whether this stands depends on the Supreme Federal Court (STF) and a vote in Congress | No new authorizations | No real-money launch; check the measure’s status before planning any work |
Social casinos have no cash-out, so they skip the real-money wallet and payout flow; see social casino game development.
Suppliers are licensed too. Great Britain, Malta, New Jersey, Pennsylvania, Michigan, Ontario and Alberta license or register companies that make, supply or run real-money gaming software; New Jersey lets applicants trade before full licensure only under a transactional waiver.
Where Capermint fits: Capermint is a software development studio. We do not operate casinos, and we hold no gambling supplier licenses or registrations (UKGC, MGA, US states, AGCO or AGLC) and no lab certificates. We build for the licensed party, which supplies the product under its own name. Whether our role needs its own license is for the regulator to decide; we raise it at scoping, and if one is required, work cannot go ahead with us until it is in place.
General information, not legal advice. Operators are responsible for licensing; Capermint builds to the technical requirements of the target jurisdiction, and for India builds free-to-play, social and e-sports formats only. Brazil is not open to real-money launches while Provisional Measure 1.394/2026 stands, and its position depends on the STF and Congress. US sweepstakes rules differ by state. Confirm the current position with counsel in each market before you commit to a build.
What should a technical scope for an online casino cover?
A technical scope should fix the decisions that are expensive to change later: markets and license holders, the wallet model, transaction and reconciliation rules, the game content route, payment and identity vendors, reporting formats, the test-lab path and code ownership. Settle these ten points before comparing quotes, so every supplier prices the same system.
- Markets and license holders: which states, provinces or countries; who holds each operator license; and who holds each supplier license or registration.
- Technical standard per market: for example UKGC RTS, AGCO Registrar’s Standards, AGLC requirements, New Jersey’s N.J.A.C. 13:69O or GLI-19.
- Wallet model: seamless (the game server calls the operator’s wallet on every bet) or transfer (funds move into a game-side balance), plus currencies.
- Transaction and reconciliation rules: transaction IDs that make retries safe, rollback behavior, timeouts, the record of truth in a dispute, daily matching and adjustment approvals.
- Game content route: your own titles, direct studio integrations or an aggregator, and which games each market may show.
- Payments, identity and location vendors: chosen per market, with a fallback for each.
- Responsible gaming controls: deposit and spend limits, time limits, cooling-off, self-exclusion and links to any national or provincial self-exclusion scheme.
- Reporting, data, hosting and security: regulator report formats, audit exports, retention periods, where servers must sit, encryption and back-office access controls.
- Certification path: which accredited lab, what it tests (RNG, game math, platform) and which licensed party holds each certificate.
- Ownership and handover: who owns bespoke code, reusable components and player data, how code and documentation are handed over, and who runs and hosts the platform after launch.
What does a scope look like for common buyers?
Four common buyer situations show how the ten points play out. In each, the licensed party keeps the license and the player relationship; what changes is how many layers it owns, which drives cost and timeline more than the number of games does. Treat them as starting points for a scoping call, not quotes.
- A licensed US casino adding online play in a legal state: needs in-state geolocation, servers where the state requires them (Atlantic City for New Jersey), daily patron-funds totals and state reports. The software reaches the market through a party licensed in that state; lab testing and regulator approval follow their own timelines.
- An Ontario-registered operator or supplier adding a proprietary game: a game built to the Registrar’s Standards and documented for an AGCO-registered lab; the registered party supplies it, submits it and holds the certificate.
- A sportsbook adding casino on the same player account: if its account and wallet can take casino debit and credit calls, connecting a game aggregator is the smaller job; rebuilding account, wallet and back office for both verticals is a multi-vertical project.
- A US or Canadian founder without a gaming license: real money waits until a license or licensed partner is in place. A social casino with no cash-out needs no real-money wallet; sweepstakes models need a state-by-state check with counsel first.
After launch, new markets, regulator changes and lab retests need engineers: your own team, or ours on a dedicated-team (monthly) or co-development engagement. Each proposal sets out code ownership, third-party licenses and any recurring fees. Founded in 2014, Capermint has over 200 specialists across game design, art, engineering and QA (Capermint-reported); examples are in our iGaming portfolio. If you are earlier in the process, our guide on how to start an online casino covers licensing, model choice and launch order.
Answered some of these ten points? Send them, even half-finished, with your markets and license status. We schedule calls in US and Canadian business hours, and after a scoping call we tell you which layers to buy from a provider and which to have built, and quote the parts we would build against our published bands.
Questions operators ask about how online casinos work
Where are an online casino’s servers located?
It depends on the license. New Jersey requires primary gaming equipment for online play to sit in a restricted area or secure facility within Atlantic City, with the Division’s prior approval. Where a market allows it, third-party game servers can run in the studio’s or aggregator’s data centers, so server location belongs in the technical scope.
How do online casinos keep player data and payments secure?
Through encryption, access controls and independent audits that each regulator sets. New Jersey requires encrypted Social Security numbers, passwords and card or bank details, plus an annual system integrity and security assessment by an independent professional. Card data also falls under PCI DSS, so many platforms leave card numbers with the payment provider.
Can a real-money casino app be listed on the App Store and Google Play?
Yes, where the operator is licensed. Apple requires real-money gaming apps to hold licensing where they are used, be geo-restricted to those locations and be free to download, and bars in-app purchase of gambling credit. Google Play accepts only licensed operators that complete its application process, with age and location blocking.
What happens when a certified casino game is changed?
Any change that affects fairness, such as the math model, RNG or result mapping, goes back to an accredited lab. In Great Britain, those test reports reach the Gambling Commission before release; every other update is recorded under the licensee’s change control, which an approved test house audits each year.
Do online casinos make their own games?
Most license games from independent studios through an aggregator or direct integrations. Some operators also commission proprietary games to stand out; they own those titles but still certify them like any other. Either way, each game must pass testing by an accredited lab and be approved for every regulated market where it is offered.
Can one online casino operate in several states or countries?
Yes, but each market needs its own license or registration, and the system must keep players, games, bonuses, limits and reports separate by jurisdiction. Games approved in one state cannot simply be shown in another. Platforms handle this with per-market configuration, geolocation and separate reporting rather than separate codebases.
How does an online casino approve a withdrawal?
The request passes several checks before money leaves: identity and age verification, anti-money-laundering and fraud screening, bonus terms such as unmet wagering, and any limits or holds on the account. Approved requests are paid through a payment provider, usually back to the deposit method, and every step is logged for the regulator.
How we researched this guide
We wrote this from the system side, the way we scope casino builds for licensed operators, and left out player-facing advice: this guide does not recommend casinos or promote gambling. Legal and regulatory statements trace to the regulator, statute, standard or platform policy behind them, and prices are Capermint’s published bands. Primary sources:
- UK Gambling Commission: RTS 7, generation of random outcomes; RTS 10, interrupted gambling; what is gambling software; LCCP 3.2.11 age verification; LCCP 4.2.1 customer funds disclosure; games test reports; testing strategy, procedure for testing; test houses.
- United States: N.J.A.C. 13:69O, internet and mobile gaming (current text); New Jersey DGE internet gaming information; 31 U.S.C. 5362 (UIGEA definitions); Pennsylvania Gaming Control Board; Michigan Gaming Control Board; Office of the Governor of Maine on LD 1164; California AB 831. Industry report: American Gaming Association, State of the States.
- Canada: roles of the AGCO and iGaming Ontario; AGCO iGaming suppliers; Government of Alberta iGaming fact sheet.
- Other markets: Malta Gaming Authority license types; Curaçao Gaming Authority, online gaming; PAGCOR electronic gaming licensing; PIB, Promotion and Regulation of Online Gaming Rules; National Congress of Brazil, MPV 1.394/2026.
- Standards and platforms: GLI-19 standards for interactive gaming systems; PCI Security Standards Council; Apple App Review Guidelines 5.3; Google Play real-money gambling policy.
Plan the systems behind your casino
Tell us your markets, license status and launch window. We schedule calls in US and Canadian business hours, scope each layer from wallet and back office to game integrations and regulator reporting, confirm who holds each license, and quote our part against our published bands after a scoping call.