The gap between a licence and a market
Most gaming licences are issued by the jurisdiction where the operator is based or where its systems are hosted. A Malta, Isle of Man, Curaçao or Kahnawake licence authorises the operator to run its business from that jurisdiction under that regulator's rules. It does not override the laws of the countries where players live.
Many countries now regulate online gambling on a point of consumption basis. They require any operator taking players in their territory to hold a local licence, or they restrict online gambling to a state monopoly, or they prohibit it entirely. Great Britain, Ontario, much of continental Europe and an increasing number of markets in Latin America and elsewhere fall into one of these groups.
An operator that holds a respected licence at home but takes players from a country that requires a local licence is operating without authorisation in that country. Some operators view this as a commercial risk to be managed. Payment providers view it as a reason to decline or exit the relationship.
Why payment providers care
A payment provider that moves funds for an operator is moving the proceeds of that operator's business. If part of the revenue comes from markets where the operator has no authorisation, the provider may be handling money from activity that is unlawful in that country. Depending on the legal systems involved, that can create exposure for the provider under AML and proceeds of crime rules.
There are practical concerns too. Regulators in some markets actively pursue unlicensed operators, including through instructions to banks and payment firms to block transactions. Card schemes and processors have their own rules on gambling merchants and the markets they serve. A provider whose customer is named in enforcement action in a major market may find its own banking relationships questioned.
For these reasons, most business-to-business providers require that every market an operator serves is covered by a licence, or is a market where the operator's licence is legally sufficient. Revenue from markets that fail that test is treated as a serious issue, regardless of how strong the operator's home licence is.
Thinking about markets in categories
A useful exercise is to sort every country into one of a few categories, with legal advice where the position is unclear.
- Licensed by the group. Markets where a group entity holds a local licence or registration, such as a UKGC licence for Great Britain or an AGCO registration for Ontario.
- Covered by an offshore licence. Markets that do not have their own licensing regime and where the operator's legal advice is that serving players under its existing licence is permissible.
- Locally licensed, not held. Markets with their own licensing system where the group has no licence. These should be blocked.
- Prohibited. Markets where online gambling is banned or reserved for a monopoly. These should be blocked.
- Sanctioned. Countries and regions subject to sanctions. These must be blocked for legal reasons unconnected with gambling law.
The list changes over time as countries introduce new regimes. Operators should review it at least every few months and whenever a market announces regulatory changes. A market that moved from the second category to the third last year is one of the most common sources of problems in payments reviews.
How geo-blocking controls work
Geo-blocking is the set of technical and procedural controls that stop players in excluded markets from using the service. No single control is enough on its own, so operators layer several.
- IP-based blocking. The website and apps check the visitor's IP address against geolocation data and refuse access, or refuse registration, from excluded countries.
- VPN and proxy detection. Tools identify connections from known VPNs, proxies and hosting networks, which are often used to disguise location.
- Registration checks. The registration form refuses addresses, phone numbers and identity documents from excluded countries.
- KYC verification. Identity and address verification confirms that the player's documents match a permitted country.
- Payment method checks. Cards, bank accounts and wallets issued in excluded countries are refused, using issuer country data.
- Device and behaviour analysis. Time zone, language settings and device data that suggest a player is somewhere other than their stated country trigger review.
- Geolocation for regulated markets. Some regulated markets, including Ontario, require stronger geolocation that confirms the player is physically inside the market at the time of play.
The combination matters. A player using a VPN may pass an IP check but fail at KYC or at payment method validation. Each layer catches some of what the others miss.
Marketing is part of geo-blocking
Technical controls stop players from registering. They do nothing to stop an operator's brand appearing in a market where it should not be. If affiliates or the operator's own campaigns target an excluded market, the operator is still exposed, even if the website blocks the resulting traffic.
Operators should make sure that paid advertising campaigns exclude blocked markets, that affiliate contracts prohibit marketing to them, and that the affiliate team monitors for breaches. Websites should avoid content aimed at excluded markets, such as local language versions, local currency displays or promotions tied to local events, unless the market is licensed.
Payment providers sometimes check this directly. A reviewer might search for the operator's brands in the language of a market the operator says it blocks, or look at which languages and currencies the website offers. Finding a localised landing page for a supposedly excluded market undermines the operator's other evidence. Our guide to affiliate payments compliance covers the affiliate side.
The evidence providers ask for
Statements in an application form carry limited weight. Providers want evidence. The following is commonly requested.
- A current list of blocked countries, signed off by the compliance function, with the date of the last review.
- Screenshots or exports of platform configuration showing the blocked countries at registration, login and payment stages.
- A description of VPN and proxy detection tools in use and how they are configured.
- Reports of blocked access and registration attempts over a recent period, showing that the controls are working.
- Revenue and active player reports by country for the last six to twelve months.
- Processor data showing settlement by card issuer country or payment method country, where available.
- Terms and conditions that list the excluded countries.
- For markets exited recently, the exit plan, the date play stopped and how remaining player balances were handled.
The revenue and processor data are especially important because they come closest to independent proof. If the operator says a market is blocked and the data shows a material amount of revenue from it, the provider will rely on the data.
Exiting a market properly
Operators sometimes need to leave a market, for instance when a country introduces a licensing regime and the operator decides not to apply. How the exit is handled matters to providers as much as the decision itself.
A clean exit usually involves notifying affected players in advance, stopping new registrations, blocking deposits and play from a set date, allowing players to withdraw their remaining balances, and closing accounts after a defined period. The operator should keep records of each step and of balances returned. It should also make sure affiliates stop promoting the brand in that market.
Providers reviewing an operator that has recently exited a market will want to see that revenue from the market actually stopped. A gradual decline over several months, with some revenue continuing long after the stated exit date, suggests the exit was incomplete. Clear before and after data is the best evidence.
Market allocation across group entities
Groups with several licences need one more layer of control. Blocking unlicensed markets at group level is only the first step. Each entity must serve only the markets its own licence covers, and players must be routed to the correct entity.
Take an illustrative group with a UKGC licence held by one company, an MGA licence held by a second, and a Curaçao licence held by a third. A British player should only ever be able to open an account with the UKGC entity. A player from a market that the Curaçao entity serves should not end up contracting with the Malta entity by accident, and the reverse is equally true.
Providers test this by comparing each entity's revenue by country with the markets its licence covers. They also look at the terms and conditions on each website, which should name the contracting entity, and at the platform's routing rules. Where one platform serves several entities, a short technical note from the platform supplier explaining how the routing works is valuable evidence. Mismatches here are a frequent source of follow-up questions, even in groups that block excluded markets well.
Ongoing monitoring and periodic reviews
Geo-blocking is not a one-off task. Players and affiliates find gaps, VPN services change, and new regulations appear. Operators should monitor country-level revenue monthly and investigate any unexpected movements. A sudden rise in players from a small, unexpected country can indicate that players from a nearby excluded market are using addresses or documents from that country.
Payment providers carry out periodic reviews of their customers, typically annually for higher-risk sectors and more frequently when something changes. They will ask for refreshed market data and evidence that controls still work. Operators who keep a geo-blocking file up to date, with monthly reports and notes of any incidents and how they were handled, can respond quickly.
As an illustrative example, an operator might hold a monthly compliance meeting that reviews the country revenue report, blocked attempt logs and affiliate monitoring results, and records actions taken. Sharing the minutes of those meetings with a provider during a review shows that monitoring is real and continuous.
General information, not legal advice
This article is general information about market licensing and geo-blocking from a payments perspective. It is not legal advice. Whether a market is open to a given licence is a legal question, and operators should take advice from qualified counsel in each relevant jurisdiction.
CCYFX requires a valid licence for every market an operator serves before onboarding. Our compliance page explains what we review and why.
