Themes ›
Technical Standards

Technical Standards

Technical standards, certification, hosting and server rules, platform and equipment requirements.

Flags
243
Jurisdictions
108
Read order
Theme-major

Cross-jurisdiction posture cluster

243 flags across 108 jurisdictions. Posture mass: Rules 82 · Risks 52 · Reality 109.

Colorado — State 3 ⚠ Indiana — State 3 ⚠🇮🇩 Indonesia 2 ⚠🇨🇳 China (Mainland) 15🇮🇲 Isle of Man 9🇫🇷 France 6

Worked examples

Each links back to the full jurisdiction page — the theme view is a projection of those country ledgers.

Colorado — State →
Accepting wagers from outside Colorado

Geolocation is mandatory; out-of-state wagers breach federal and state law.

3 technical standards flags on this jurisdiction · see full country page
Indiana — State →
Accepting wagers from outside Indiana

Geolocation is mandatory; out-of-state bets are unlawful.

3 technical standards flags on this jurisdiction · see full country page
🇮🇩 Indonesia →
ITE Law Art. 27(2) criminalises gambling content

Marketing/affiliate distribution is a criminal offence.

2 technical standards flags on this jurisdiction · see full country page

Rules · Risks · Reality across the cohort

Lens · which facet of each jurisdiction’s flags:
Showing all facets.
Colorado — StateCritical
Accepting wagers from outside Colorado

Geolocation is mandatory; out-of-state wagers breach federal and state law.

SRC-US-CO-009
Indiana — StateCritical
Accepting wagers from outside Indiana

Geolocation is mandatory; out-of-state bets are unlawful.

SRC-US-IN-006
🇮🇩 IndonesiaCritical
ITE Law Art. 27(2) criminalises gambling content

Marketing/affiliate distribution is a criminal offence.

SRC-ID-002
Alberta — Canada (province)High
Failure to integrate CSE via API

Mandatory precondition; non-integration blocks go-live.

SRC-CA-AB-009
Alberta — Canada (province)High
Inadequate Alberta-only geolocation / VPN controls

SRIG requires enforcement of Alberta-only play with evasion controls.

SRC-CA-AB-003
🇦🇷 ArgentinaHigh
Operating without a .bet.ar domain

The .bet.ar domain is mandatory and the key public marker of legality.

SRC-AR-005
🇦🇷 ArgentinaHigh
No RENAPER biometric verification at login/withdrawal

Federal mandate requires biometric verification at each login and before withdrawals.

SRC-AR-007
🇦🇷 ArgentinaHigh
No GLI-accredited RNG certification

CABA technical regulations require GLI-accredited RNG certification.

SRC-AR-005
🇦🇷 ArgentinaHigh
Missing geolocation controls

Geolocation is mandatory to confine the offering to province boundaries.

SRC-AR-005
Arizona — StateHigh
Geolocation failure

Accepting out-of-state wagers breaches the geolocation requirement.

SRC-US-AZ-005
Arizona — StateHigh
Unapproved platform supplier

Platform/technology suppliers require ADG approval.

SRC-US-AZ-002
🇧🇩 BangladeshHigh
BTRC blocks 4,600+ sites, 447 apps, 16,000 social links

Extensive access interdiction; constant domain rotation required.

SRC-BD-005
🇧🇷 BrazilHigh
Strict data localisation

Requires Brazil-based infrastructure.

SRC-BR-011
🇧🇬 BulgariaHigh
Storing data outside Bulgaria

Online betting data localisation mandate.

SRC-BG-010
🇧🇬 BulgariaHigh
No NRA replication server

Required for real-time NRA reporting.

SRC-BG-007
🇧🇬 BulgariaHigh
Uncertified RNG

Approved laboratory certification required.

SRC-BG-008
🇨🇦 Canada (Federal Overview)High
Ignoring Quebec Law 25

Data-residency obligations in force since Sept 2023 for Quebec-facing operations.

SRC-CA-006
🇨🇦 Canada (Federal Overview)High
Skipping geolocation

Mandatory to confine play to provincial boundaries.

SRC-CA-006
Canada — OntarioHigh
Serving non-Ontario players

Geolocation to Ontario required; liquidity ring-fenced.

SRC-CA-ON-003
Canada — OntarioHigh
Uncertified games at launch

Technical certification required pre-go-live.

SRC-CA-ON-003
🇨🇳 China (Mainland)High
Relying on claimed geo-exclusion as a defence

Great Firewall makes circumvention detectable; not a defence to Art. 303

SRC-CN-001
🇨🇳 China (Mainland)High
Relying on claimed geo-exclusion as a defence

Great Firewall makes circumvention detectable; not a defence to Art. 303

SRC-CN-001
🇨🇳 China (Mainland)High
Relying on claimed geo-exclusion as a defence

Great Firewall makes circumvention detectable; not a defence to Art. 303

SRC-CN-001
🇨🇳 China (Mainland)High
Relying on claimed geo-exclusion as a defence

Great Firewall makes circumvention detectable; not a defence to Art. 303

SRC-CN-001
🇨🇳 China (Mainland)High
Relying on claimed geo-exclusion as a defence

Great Firewall makes circumvention detectable; not a defence to Art. 303

SRC-CN-001
🇨🇼 CuraçaoHigh
Player data not stored in certified Curaçao data centre

Breach of LOK technical/data-localisation conditions.

SRC-CW-009
🇨🇼 CuraçaoHigh
Uncertified game platform / no RNG certification

Technical-standards breach.

SRC-CW-009
🇨🇾 CyprusHigh
No Cyprus backup server connected to NBA systems

Mandatory for Class B real-time monitoring.

SRC-CY-008
🇨🇿 Czech RepublicHigh
Uncertified games at launch

Accredited lab certification of software/equipment is mandatory pre-launch.

SRC-CZ-013
🇩🇰 DenmarkHigh
Launching uncertified games

DGA certification programme mandatory.

SRC-DK-006
🇩🇴 Dominican RepublicHigh
Failure to host servers domestically

Breaches a core Res. 136-2024 licence condition.

SRC-DO-003
🇫🇷 FranceHigh
No geolocation

Geolocation mandatory for FR-licensed operators.

SRC-FR-010
🇫🇷 FranceHigh
Uncertified gaming systems

Pre-launch ANJ approval required.

SRC-FR-001
🇫🇷 FranceHigh
No geolocation

Geolocation mandatory for FR-licensed operators.

SRC-FR-010
🇫🇷 FranceHigh
Uncertified gaming systems

Pre-launch ANJ approval required.

SRC-FR-001
🇫🇷 FranceHigh
No geolocation

Geolocation mandatory for FR-licensed operators.

SRC-FR-010
🇫🇷 FranceHigh
Uncertified gaming systems

Pre-launch ANJ approval required.

SRC-FR-001
🇩🇪 GermanyHigh
€1 max stake per spin on slots

Severely caps slot revenue per session vs offshore competitors.

SRC-DE-005
🇬🇧 Great BritainHigh
Unlicensed software supply

B2B software must be UKGC-licensed.

SRC-GB-001
🇬🇧 Great BritainHigh
Uncertified RNG

GLI-19 / RTS certification required.

SRC-GB-003
Indiana — StateHigh
Uncertified wagering system

Systems must pass independent testing-lab certification.

SRC-US-IN-008
🇮🇩 IndonesiaHigh
Systematic IP/DNS blocking

Player access is actively interdicted.

SRC-ID-004
🇵🇰 Islamic Republic of PakistanHigh
Listing a gambling app for PK users

Apps are blocked and store availability is restricted.

SRC-PK-004
🇮🇲 Isle of ManHigh
Uncertified RNG/game deployment

Mandatory certification by approved testing house.

SRC-IM-011
🇮🇲 Isle of ManHigh
B2C player registration off-Island

Breach of OGRA server-hosting requirement.

SRC-IM-007
🇮🇲 Isle of ManHigh
Uncertified RNG/game deployment

Mandatory certification by approved testing house.

SRC-IM-011
🇮🇲 Isle of ManHigh
B2C player registration off-Island

Breach of OGRA server-hosting requirement.

SRC-IM-007
🇮🇲 Isle of ManHigh
Uncertified RNG/game deployment

Mandatory certification by approved testing house.

SRC-IM-011
🇮🇲 Isle of ManHigh
B2C player registration off-Island

Breach of OGRA server-hosting requirement.

SRC-IM-007
🇮🇹 ItalyHigh
Failing anti-Mafia clearance

D.Lgs. 159/2011 controls can block concession execution.

SRC-IT-005
🇰🇿 KazakhstanHigh
Hosting betting servers outside Kazakhstan

Breaches the server-localisation licence condition.

SRC-KZ-005
Macao SARHigh
Supplying gaming equipment without DICJ authorisation

All gaming equipment requires DICJ authorisation, sealing and registration.

SRC-CN-MO-001
🇲🇾 MalaysiaHigh
Systematic ISP-level DNS blocking; ~3,200 active domain blocks

Access to offshore sites is actively and increasingly suppressed.

SRC-MY-011 SRC-MY-007
Massachusetts — StateHigh
Failure to geolocate players within Massachusetts

Wagering must occur within state boundaries.

SRC-US-MA-001
Michigan — StateHigh
Servers outside Michigan/approved locations

Breaches MGCB technical standards and hosting requirements.

SRC-US-MI-008
🇲🇲 MyanmarHigh
Funnull-type IP/hosting suppliers

OFAC sanctioned bulk IP supplier to scam sites.

SRC-MM-004
🇲🇲 MyanmarHigh
Any local entity formation

No safe corporate vehicle; sanctions screening failure risk.

SRC-MM-005
🇳🇵 NepalHigh
VPN/proxy access to circumvent blocks

Treated as illegal access in itself.

SRC-NP-005
Nevada — StateHigh
Inadequate geolocation controls

Play must be confined to in-state players.

SRC-US-NV-003
Ohio — StateHigh
Inadequate geolocation allowing out-of-state wagers

Players must be physically in Ohio; geofencing alone may not suffice per OCCC.

SRC-US-OH-001
🇵🇦 PanamaHigh
Uncertified RNG/software deployed

JCJ mandates third-party certification; deployment without it breaches registration.

SRC-PA-006
Pennsylvania — StateHigh
On-premise server residency

Servers must sit at casino premises, raising infrastructure cost and complexity.

SRC-US-PA-002
🇵🇪 PeruHigh
Non-certified games/platform

MINCETUR-authorised lab certification (Peruvian norms) is mandatory.

SRC-PE-010
🇵🇭 PhilippinesHigh
No geolocation gating

Player must be physically in PH.

SRC-PH-013
🇵🇱 PolandHigh
Hosting/archiving data outside EU/EEA

Art. 15d requires EU/EEA processing/archiving

SRC-PL-001
🇵🇱 PolandHigh
Launching without MoF game T&C/technical approval

Pre-launch approval required

SRC-PL-009
🇰🇷 Republic of Korea (South Korea)High
Content/credit supply to overseas KR-facing platforms

Captured in cross-border crackdowns.

SRC-KR-009
🇸🇦 Saudi ArabiaHigh
Reliance on Saudi user access via VPN

VPN circumvention is illegal and monitored; CST blocks at the gateway.

SRC-SA-009
🇷🇸 SerbiaHigh
Failing near-real-time data streaming

Operators must stream operational data and file monthly returns by the 5th.

SRC-RS-008
🇸🇬 SingaporeHigh
Systematic site blocking

Hundreds of sites blocked; product unreachable legally.

SRC-SG-010
🇸🇬 SingaporeHigh
Payment processors face indefensible risk

PSP support for offshore gambling is unlawful.

SRC-SG-012
🇸🇬 SingaporeHigh
Singapore-based services caught regardless of customer location

Hosting in SG triggers liability.

SRC-SG-001
🇸🇰 SlovakiaHigh
Mandatory Slovak server localisation

Capex and infrastructure burden distinct from EU norms.

SRC-SK-010
🇪🇸 SpainHigh
No real-time DGOJ data integration

RD 1613/2011 requires real-time monitoring integration.

SRC-ES-011
🇪🇸 SpainHigh
Uncertified platform launch

Platform must be certified for functionality and security pre-launch.

SRC-ES-011
🇱🇰 Sri LankaHigh
Supplying gambling software without s.33 licence

Illegal to develop, distribute or operate gambling software without GRA licence.

SRC-LK-006
🇨🇭 SwitzerlandHigh
Outsourcing central tasks

Casinos must perform central activities themselves; outsourcing prohibited.

SRC-CH-011
🇹🇼 TaiwanHigh
Relying on member-only access to evade prohibition

2022 amendment closed the restricted-access loophole.

SRC-TW-002
🇹🇼 TaiwanHigh
Lottery game manipulation

Integrity amendments criminalise interference severely.

SRC-TW-011
Tennessee — StateHigh
Inadequate geolocation

Mandatory player-location verification before wager acceptance.

SRC-US-TN-001
🇺🇦 UkraineHigh
Data must reside on Ukrainian servers in a war zone

Infrastructure resilience and hosting continuity risk.

SRC-UA-004
🇺🇸 United States (Federal Layer)High
Inadequate geolocation

Geolocation is mandatory to enforce intrastate operation.

SRC-US-002
Virginia — StateHigh
Failing geolocation enforcement

Out-of-state wagers breach § 58.1-4036.

SRC-US-VA-001
Virginia — StateHigh
Supplying platform without supplier licence

Vendor/supplier functions require Lottery approval.

SRC-US-VA-003
Virginia — StateHigh
No suspicious-activity detection

Operators must detect/report suspicious betting.

SRC-US-VA-001
Virginia — StateHigh
Uncertified betting system

Systems must be certified by Lottery-approved labs.

SRC-US-VA-006
Alberta — Canada (province)Medium
Notification Matrix obligations ignored

AGLC Notification Matrix sets mandatory information, frequency and format.

SRC-CA-AB-004
🇦🇺 AustraliaMedium
Weak geolocation / customer-location verification

Required for POC tax and IGA targeting.

SRC-AU-005
🇧🇩 BangladeshMedium
5,179 SIM cards suspended for gambling use

Telecom-layer enforcement against agents and users.

SRC-BD-005
🇧🇪 BelgiumMedium
Domestic server localisation

Servers must be located in Belgium.

SRC-BE-012
🇧🇷 BrazilMedium
Mandatory accredited-lab certification

Certification bottleneck/cost.

SRC-BR-008
British Columbia — Canada (province)Medium
Assuming no geolocation requirement

PlayNow geolocates to BC; private access without authorisation is unlawful.

SRC-CA-BC-006
🇧🇬 BulgariaMedium
Unapproved software updates

NRA approval required for new versions.

SRC-BG-007
🇧🇬 BulgariaMedium
Software not registered with Metrology Institute

Registration mandatory.

SRC-BG-008
🇰🇭 CambodiaMedium
Unregistered gaming equipment/software

Equipment and software must be certified/registered with CGMC.

SRC-KH-004
🇨🇦 Canada (Federal Overview)Medium
Hosting personal data outside Quebec for QC players

Law 25 residency obligations apply to certain personal data.

SRC-CA-006
Canada — OntarioMedium
Crypto gambling without guidance

No AGCO crypto specification yet; self-certification carries reassessment risk.

SRC-CA-ON-015
🇨🇳 China (Mainland)Medium
VPN reliance to reach Chinese users

Active VPN crackdown; reachability still engages liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
Hosting/CDN/DNS infrastructure China-facing

Domain takedown powers (CAC/MPS) and accomplice liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
VPN reliance to reach Chinese users

Active VPN crackdown; reachability still engages liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
Hosting/CDN/DNS infrastructure China-facing

Domain takedown powers (CAC/MPS) and accomplice liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
VPN reliance to reach Chinese users

Active VPN crackdown; reachability still engages liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
Hosting/CDN/DNS infrastructure China-facing

Domain takedown powers (CAC/MPS) and accomplice liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
VPN reliance to reach Chinese users

Active VPN crackdown; reachability still engages liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
Hosting/CDN/DNS infrastructure China-facing

Domain takedown powers (CAC/MPS) and accomplice liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
VPN reliance to reach Chinese users

Active VPN crackdown; reachability still engages liability

SRC-CN-011
🇨🇳 China (Mainland)Medium
Hosting/CDN/DNS infrastructure China-facing

Domain takedown powers (CAC/MPS) and accomplice liability

SRC-CN-011
🇨🇴 ColombiaMedium
Strict data localisation (in-country mirror server)

Infrastructure cost and compliance burden.

SRC-CO-003
🇨🇴 ColombiaMedium
Pre-launch lab certification required

Adds time-to-market and cost.

SRC-CO-003
Colorado — StateMedium
Weak KYC at onboarding

KYC confirming age and identity is required before wagering.

SRC-US-CO-009
Connecticut — StateMedium
Server-residency requirement unconfirmed

Hosting obligations not fully verified against Technical Standards.

SRC-US-CT-009
🇭🇷 CroatiaMedium
Domestic server localisation

Infrastructure cost and operational constraint.

SRC-HR-005
🇨🇾 CyprusMedium
Not using .com.cy domain

Regulatory requirement for Class B operations.

SRC-CY-008
🇨🇾 CyprusMedium
Offering horse-race or virtual betting

Horse racing and virtual games excluded from Class A/B.

SRC-CY-010
🇨🇿 Czech RepublicMedium
Ignoring server localisation

Server localisation within CZ reported as a requirement.

SRC-CZ-007
Delaware — StateMedium
Geolocation mandatory for in-state play

Out-of-state play is blocked; technical failures risk compliance.

SRC-US-DE-001
Delaware — StateMedium
Hosting tied to approved locations

Server flexibility constrained by Lottery specifications.

SRC-US-DE-003
🇩🇰 DenmarkMedium
Website not available in Danish

Danish-language requirement.

SRC-DK-002
🇩🇰 DenmarkMedium
Ignoring 2025 certification programme update

New seven-type certification in force.

SRC-DK-006
🇪🇬 EgyptMedium
Distributing gambling app via stores

App stores restrict gambling for Egypt; NTRA can order removals.

SRC-EG-014
🇪🇬 EgyptMedium
Reliance on VPN tolerance

VPN use tolerated generally but gambling-specific use carries legal risk.

SRC-EG-013
🇫🇮 FinlandMedium
Technical decrees unpublished

Certification and hosting requirements not yet fixed.

SRC-FI-001
🇫🇮 FinlandMedium
OCSS cryptographic reporting

Operators must build to a binding national reporting standard.

SRC-FI-009
🇩🇪 GermanyMedium
5-second minimum spin duration

Reduces play velocity and revenue.

SRC-DE-004
🇩🇪 GermanyMedium
No autoplay / no jackpots on slots

Product feature restrictions reduce competitiveness.

SRC-DE-007
🇩🇪 GermanyMedium
LUGAS integration friction

Integration is a technical bottleneck for new entrants; operators not connected cannot operate.

SRC-DE-008
🇬🇮 GibraltarMedium
Launching games without approved test-house certification

Pre-launch approval required.

SRC-GI-012
🇬🇮 GibraltarMedium
Launching games without approved test-house certification

Pre-launch approval required.

SRC-GI-012
🇬🇮 GibraltarMedium
Launching games without approved test-house certification

Pre-launch approval required.

SRC-GI-012
🇬🇧 Great BritainMedium
Sub-2.5s slot spin

RTS 14D minimum spin time breach.

SRC-GB-003
🇬🇷 GreeceMedium
Server localisation in Greece

Mandatory data-localisation increases infra cost.

SRC-GR-006
🇬🇷 GreeceMedium
Pre-launch game certification

Time-to-market delay.

SRC-GR-010
🇬🇷 GreeceMedium
Ad-platform restrictions

Google/Meta limit gambling ads to licensed.

SRC-GR-012
Hong Kong SARMedium
No third-party game certification regime

B2B suppliers have no certification route into the HK market.

SRC-CN-HK-006
🇭🇺 HungaryMedium
Server placement requirement

Local hosting mandate adds cost and is under EU-law challenge.

SRC-HU-008
🇮🇳 IndiaMedium
DNS/ISP blocking of offshore URLs

Active access interdiction.

SRC-IN-007
Indiana — StateMedium
Failure to report suspicious wagering to integrity tip line

IGC requires integrity reporting.

SRC-US-IN-005
🇵🇰 Islamic Republic of PakistanMedium
Encouraging VPN circumvention of blocks

Circumvention does not legalise activity and adds exposure.

SRC-PK-004
🇮🇲 Isle of ManMedium
Deploying uncertified software updates

Re-certification required before live deployment.

SRC-IM-011
🇮🇲 Isle of ManMedium
Deploying uncertified software updates

Re-certification required before live deployment.

SRC-IM-011
🇮🇲 Isle of ManMedium
Deploying uncertified software updates

Re-certification required before live deployment.

SRC-IM-011
🇮🇹 ItalyMedium
Non-EEA/Italy infrastructure

Server-location requirement embedded in concession agreement.

SRC-IT-001
🇮🇹 ItalyMedium
Failure to adopt Sports Betting Protocol 5.0 by March 2026

Mandatory standard for new licence holders.

SRC-IT-005
🇯🇵 JapanMedium
Assuming no IR technical certification

CMC requires equipment inspection and self-examination/reporting; non-compliance risks licence action.

SRC-JP-004
🇰🇪 KenyaMedium
GRA technical standards unpublished

RNG/data requirements not yet assessable.

SRC-KE-008
🇱🇹 LithuaniaMedium
Operator-funded independent platform accreditation

Adds cost and lead time to launch.

SRC-LT-012
Macao SARMedium
Failing Article 34 external audit

Continuous external audits are mandatory under the gaming law.

SRC-CN-MO-009
🇲🇾 MalaysiaMedium
Transparent DNS proxying defeats alternative-resolver bypass

Standard DNS-change workarounds are being neutralised.

SRC-MY-007
Michigan — StateMedium
Weak software authentication

Digest must be at least 128-bit complexity.

SRC-US-MI-008
Michigan — StateMedium
Using unregistered vendors

Operators must use Board-registered vendors.

SRC-US-MI-009
🇲🇦 MoroccoMedium
ANRT DPI capacity

Sophisticated interdiction infrastructure available.

SRC-MA-009
🇲🇿 MozambiqueMedium
Local hosting / .mz domain expectation

Data-localisation increases infrastructure cost.

SRC-MZ-010
🇲🇲 MyanmarMedium
VPN-routed access

VPN use technically criminal under Cybersecurity Law.

SRC-MM-001
🇳🇵 NepalMedium
Missing biometric KYC/CCTV at land-based casino

Mandatory under Casino Regulations 2082.

SRC-NP-007
🇳🇱 NetherlandsMedium
Control Database data-quality breaches risk enforcement

Failure to maintain CDB to latest spec constitutes a breach.

SRC-NL-009
Nevada — StateMedium
Hosting interactive systems outside approved locations

Approved-location hosting required under Reg 14.

SRC-US-NV-001
New Jersey — StateMedium
Server-residency requirement

Primary gaming servers must be in NJ at approved locations.

SRC-NJ-004
New Jersey — StateMedium
College-NJ-team wagering ban

Prohibited markets must be geo/event-filtered.

SRC-NJ-010
New York — StateMedium
Server-at-facility requirement

Restricts hosting flexibility (statutory).

SRC-NY-001
🇳🇬 NigeriaMedium
Lack of GLI/iTech certification

Game fairness certification required

SRC-NG-004
🇳🇴 NorwayMedium
Targeting test applied by regulator

Norwegian language/currency/support trigger 'aimed at Norway' findings.

SRC-NO-006
🇵🇦 PanamaMedium
Failing JCJ technical audit

Equipment/software subject to regulatory review.

SRC-PA-006
Pennsylvania — StateMedium
Geolocation border-edge errors

Proximity to NJ/OH/NY/WV/DE borders creates geolocation compliance risk.

SRC-US-PA-007
🇵🇪 PeruMedium
No .bet.pe domain

Mandatory domain notified to MINCETUR before operation.

SRC-PE-008
🇵🇭 PhilippinesMedium
Hosting servers offshore

Domestic hosting historically required.

SRC-PH-014
🇵🇹 PortugalMedium
Pre-launch homologation requirement

Gaming system must be certified before launch, adding lead time.

SRC-PT-003
🇵🇹 PortugalMedium
Live online casino restrictions

Some sources indicate live online casino constraints; verify product scope.

SRC-PT-003
🇰🇷 Republic of Korea (South Korea)Medium
Facilitating VPN circumvention

Access-interdiction risk.

SRC-KR-010
🇰🇷 Republic of Korea (South Korea)Medium
App-store distribution of KR gambling app

Restricted availability.

SRC-KR-010
🇷🇴 RomaniaMedium
Mandatory real-time/mirror-server reporting

ONJN accesses mirror servers to detect under-reporting.

SRC-RO-008
🇷🇺 RussiaMedium
Strict data localisation

Mandatory domestic data storage

SRC-RU-001
🇷🇺 RussiaMedium
VPN active crackdown

Circumvention tools targeted

SRC-RU-008
🇷🇺 RussiaMedium
Domain takedown power present

Rapid site removal capability

SRC-RU-008
🇷🇼 RwandaMedium
Mandatory CMS connectivity

Operators must integrate with RDB monitoring; non-compliance risks licence action.

SRC-RW-002
🇸🇦 Saudi ArabiaMedium
Hosting gambling content reachable from Saudi Arabia

CST blocks and authorities may pursue facilitation charges.

SRC-SA-009
🇷🇸 SerbiaMedium
Non-compliant transaction equipment

2024 standards mandate compliant deposit/withdrawal devices.

SRC-RS-004
🇸🇬 SingaporeMedium
App stores do not distribute unlicensed gambling apps

No distribution channel for private operators.

SRC-SG-012
🇻🇳 Socialist Republic of VietnamMedium
Reliance on VPN access to offshore sites

Access interdiction is systematic; legal protection absent.

SRC-VN-007
🇸🇪 SwedenMedium
Uncertified games or unconnected control systems

SIFS technical standards require certification and control-system connection.

SRC-SE-001
🇹🇼 TaiwanMedium
VPN-based access circumvention

Does not cure criminality of the underlying activity.

SRC-TW-001
🇹🇿 TanzaniaMedium
Sports Betting Management System remote access

Mandatory operational data feed to GBT/TRA.

SRC-TZ-007
Tennessee — StateMedium
Missing multi-factor authentication

MFA required on all player accounts from 30 June 2025.

SRC-US-TN-002
🇹🇭 ThailandMedium
App-store/ad-platform unavailability

No distribution route for gambling apps/ads in Thailand.

SRC-TH-006
🇹🇳 TunisiaMedium
Foreign-group dependency for Promosport tech (Sisal/Flutter)

Single-supplier concentration; entry only via that contract

SRC-TN-009
🇺🇦 UkraineMedium
Google/Meta require regulator ad certification

Acquisition channels gated by certification.

SRC-UA-004
🇦🇪 United Arab Emirates — federal jurisdiction (nascent GCGRA framework)Medium
VPN use to mask location

VPN use voids winnings and breaches eligibility rules; geolocation strictly enforced.

SRC-AE-004
🇦🇪 United Arab Emirates — federal jurisdiction (nascent GCGRA framework)Medium
Register discrepancy vs Play971 launch

Public licensee register completeness unverified — diligence cannot rely solely on it.

SRC-AE-005
🇻🇪 VenezuelaMedium
Severely degraded internet infrastructure

Service reliability and geolocation impossible to guarantee.

SRC-VE-004
🇻🇪 VenezuelaMedium
No enforced geolocation/RNG/RG standards

No technical safe harbour; compliance must be self-imposed.

SRC-VE-004
West Virginia — StateMedium
Five bordering states

Geolocation accuracy near borders is critical; failure exposes out-of-state wagering liability.

SRC-US-WV-008
🇦🇹 AustriaLow
Reform-regime technical standards not yet published

Cannot pre-build to unknown specifications.

SRC-AT-004
British Columbia — Canada (province)Low
Assuming IGCO technical standards are finalised

Standards still being published post-commencement.

SRC-CA-BC-002
🇨🇲 CameroonLow
No published RNG/geolocation standard

Technical certification expectations are unclear pending ARJ specs.

SRC-CM-003
🇨🇱 ChileLow
No online technical standards

Compliance roadmap undefined until reform standards publish.

SRC-CL-006
🇨🇱 ChileLow
No online technical standards

Compliance roadmap undefined until reform standards publish.

SRC-CL-006
🇨🇱 ChileLow
No online technical standards

Compliance roadmap undefined until reform standards publish.

SRC-CL-006
🇨🇴 ColombiaLow
83% minimum RTP

Constrains margin and product configuration.

SRC-CO-004
Colorado — StateLow
Assuming server-residency requirement absent permanently

Data-localisation module is not-yet-assessed; confirm Division standards.

SRC-US-CO-009
🇭🇷 CroatiaLow
Incident-reporting SLA unverified

Compliance scope unclear.

SRC-HR-005
Delaware — StateLow
Single platform vendor dependency

Concentration risk on RSI/Scientific Games supply.

SRC-US-DE-008
🇪🇨 EcuadorLow
LOPDP data obligations

Personal-data processing rules apply even absent gambling-specific tech rules.

SRC-EC-013
🇪🇪 EstoniaLow
Mandatory EMTA reporting connection

System integration is a permit precondition.

SRC-EE-008
🇬🇮 GibraltarLow
Assuming strict data localisation

Cloud permitted; localisation soft.

SRC-GI-012
🇬🇮 GibraltarLow
Assuming strict data localisation

Cloud permitted; localisation soft.

SRC-GI-012
🇬🇮 GibraltarLow
Assuming strict data localisation

Cloud permitted; localisation soft.

SRC-GI-012
🇮🇸 IcelandLow
No published certification regime for private operators

Compliance requirements undefined for any future entrants.

SRC-IS-002
Illinois — StateLow
New reporting obligations

Annual audit + quarterly compliance reports under P.A. 103-0592.

SRC-US-IL-003
🇮🇪 IrelandLow
Assuming no future technical standards

Software-system conditions to be set; not_yet_assessed.

SRC-IE-006
🇮🇹 ItalyLow
Records retained under seven years

Seven-year retention required under concession agreement.

SRC-IT-001
🇱🇻 LatviaLow
Minimum RTP 92%; pre-launch certification

Game design and certification overhead.

SRC-LV-011
🇱🇹 LithuaniaLow
Centralised player-data controls

Integration and data-governance obligations.

SRC-LT-012
🇲🇴 Macau SAR (Macau Special Administrative Region, China)Low
Pre-launch DICJ game approval

Land-based equipment must be approved

SRC-MO-005
🇲🇹 MaltaLow
Mandatory system review and compliance audit

Recurring auditor cost and compliance burden.

SRC-MT-006
🇲🇹 MaltaLow
App-store gambling-app authorisation gating

Distribution restricted on iOS/Android.

SRC-MT-008
Maryland — StateLow
Server-residency requirement unconfirmed

Hosting obligations may exist in COMAR Title 36; verify.

SRC-US-MD-011
🇲🇽 MexicoLow
No codified RNG/RTP standard

Certification expectations unclear.

SRC-MX-004
🇲🇦 MoroccoLow
No player-protection standards

No RG framework; reputational/social risk.

SRC-MA-010
🇲🇿 MozambiqueLow
Online RG technical standards thin

Compliance uncertainty for online platforms.

SRC-MZ-003
🇳🇱 NetherlandsLow
Pre-launch system inspection by accredited body

Adds time and cost to launch.

SRC-NL-014
New Jersey — StateLow
Pre-launch game approval

Lead time for content certification.

SRC-NJ-004
New York — StateLow
Multi-factor geo-gating mandatory

Strict location-verification compliance burden.

SRC-NY-001
🇳🇿 New ZealandLow
Assuming current online technical standards are final

Standards are not yet published; requirements are forthcoming.

SRC-NZ-008
North Carolina — StateLow
Server-residency requirement not confirmed

Hosting obligations unverified against full NCSLC technical standards.

SRC-US-NC-003
North Carolina — StateLow
Geolocation single-point dependency

Geolocation failures can halt wagering and trigger compliance issues.

SRC-US-NC-012
Pennsylvania — StateLow
Pre-launch game approval

Bureau of Gaming Laboratory Operations testing before launch.

SRC-US-PA-003
🇵🇪 PeruLow
Server resilience non-compliance

Art. 20.1–2 resilience requirements apply regardless of host location.

SRC-PE-008
🇵🇹 PortugalLow
Shared-liquidity technical requirements

Shared-liquidity poker has distinct technical regulation (Reg. 115/2018).

SRC-PT-008
Rhode Island — StateLow
Android via direct download only

Google Play distribution restricted at launch.

SRC-US-RI-003
Rhode Island — StateLow
Hosting tied to Lottery-approved locations

Server residency constraints for vendors.

SRC-US-RI-003
🇷🇴 RomaniaLow
ONJN-accredited lab certification required

Pre-launch certification gating and cost.

SRC-RO-003
🇷🇼 RwandaLow
Unpublished technical standards

RNG/data-localisation specs not finalised; reassessment needed at commencement.

SRC-RW-002
🇷🇼 RwandaLow
1.5% digital services tax (forthcoming)

Future DST may add cost to digital-service providers with national presence.

SRC-RW-008
🇸🇳 SenegalLow
No technical compliance framework

No game certification or hosting rules for private operators.

SRC-SN-001
🇸🇰 SlovakiaLow
URHH-authorised laboratory certification requirement

Pre-launch certification adds time and cost.

SRC-SK-001
🇿🇦 South AfricaLow
Assuming national online tech standards exist

None published; pending Remote Gambling Bill

SRC-ZA-002
🇹🇿 TanzaniaLow
Undeveloped RNG/cert regime

Self-certification creates audit risk.

SRC-TZ-010
Tennessee — StateLow
Assuming server-residency requirement absent without verification

Server-residency status not_yet_assessed; confirm against SWC technical standards.

SRC-US-TN-003
🇺🇬 UgandaLow
RNG/game-fairness certification unspecified

Self-certification regime may shift to mandatory standards.

SRC-UG-002
🇺🇾 UruguayLow
No online technical-standards regime yet

Any future private online standards depend on reform enactment.

SRC-UY-003
West Virginia — StateLow
Annual independent security assessment

Recurring certification cost and failure-to-comply licence risk.

SRC-US-WV-012
West Virginia — StateLow
Independent testing lab approval required

Game/equipment must be lab-certified before deployment.

SRC-US-WV-004
West Virginia — StateLow
House rules require prior WVLC approval

Product changes need regulator sign-off before launch.

SRC-US-WV-005
🇿🇲 ZambiaLow
No mandated RNG / fairness audit body

Standards may be retrofitted under modernised framework, requiring re-certification.

SRC-ZM-004