How to Start an Online Casino in 2026: Stack Selection, Licensing and the Vendor Decisions That Actually Matter

What is the actual difference between white-label, turnkey and custom-build casino platforms?

White-label gives you a branded front-end on a shared back-end infrastructure — fastest to market (4–12 weeks) but you share revenue and inherit the provider's limitations. Turnkey hands you a licensable, configurable platform you operate yourself. Custom build means owning every layer of the stack. Each model has a completely different cost profile, timeline and ceiling.

The white-label route, offered by providers like SoftSwiss (now SOFTSWISS), Turnkey Sports and EveryMatrix's WhiteLabelCasino product, typically costs $15k–$50k upfront plus a revenue share of 15–30% of GGR. You're live in weeks, but you're permanently renting your infrastructure. Every feature request goes through a vendor roadmap you don't control, and your player data often lives in their database, not yours. For operators testing a new market or launching a second brand cheaply, it's defensible. For anyone building a primary business, the long-term economics are brutal.

Turnkey platforms — think SOFTSWISS Casino Platform, EveryMatrix's full stack, or Playtech's IMS — are a different animal. You license the software, integrate it under your own gaming license, and operate it yourself. Upfront costs run $80k–$250k depending on the provider and contract scope, plus monthly fees or a smaller rev-share. The critical advantage is data ownership and configurability. You can negotiate your own game supplier deals, plug in your preferred PSPs and build CRM logic that actually reflects your player base. Timeline is typically 3–6 months to launch.

Custom builds are for operators who've already run a platform and know exactly what they need that the market doesn't offer. You're talking $400k–$1M+ in development, 12–18 months minimum, and an ongoing engineering team. The companies that do this well — and there aren't many — usually have a technical co-founder who's shipped iGaming products before. Everyone else who tries it ends up back at a turnkey provider 18 months later, poorer and wiser. I've watched this cycle repeat enough times that I now push first-time operators hard toward turnkey unless they have a very specific technical moat to build.

Which gambling license should you get first — Curaçao, MGA or something else?

For most offshore launches in 2026, the Curaçao Gaming Authority (CGA) license under the new 2024 framework is still the pragmatic starting point — roughly $20–35k all-in, 3–6 months to obtain. MGA (Malta) costs $25k+ in fees alone, takes 6–12 months and demands far more compliance infrastructure, but it's the credibility signal that unlocks better PSP relationships and EU-facing marketing.

Curaçao restructured its licensing regime in 2024, replacing the old master-license sublicense model with direct CGA licenses. The new framework requires a local representative, AML/KYC policies that meet international standards and a technical audit of your platform. Costs have risen slightly from the old sublicense days — budget $20k–$35k for government fees, registered agent and setup, plus $10k–$15k/year ongoing. The license still carries a reputational discount in Tier-1 markets, and major card networks remain skeptical, but for crypto-heavy or LATAM-focused operations it remains the fastest path to legal operation.

The MGA license (Malta Gaming Authority) is the gold standard for European-facing operators. The application fee is €25k for a B2C gaming service license, and you'll spend another $50k–$150k on compliance setup, legal fees and the technical audit before you're approved. Timelines of 6–12 months are realistic; I've seen operators wait 14 months. What you get in return is genuine PSP access — Worldpay, Nuvei and most Tier-1 acquiring banks will talk to you with an MGA license in a way they simply won't with Curaçao. If your business model depends on card payments from European players, the MGA math often works out despite the higher cost.

Other options worth knowing: Anjouan (Comoros) has emerged as a budget offshore alternative at roughly $15k–$20k, though its regulatory credibility is even lower than old-Curaçao. Isle of Man and Gibraltar licenses are premium, expensive and slow but respected. For US operators, the picture is entirely state-by-state — New Jersey (DGE), Pennsylvania (PGCB), Michigan (MGCB) and a growing list of states each require separate applications, local partnerships and compliance infrastructure that makes offshore licensing look simple. Don't conflate US regulated markets with offshore operations; they're fundamentally different businesses.

How do game aggregators work and which one should you integrate first?

A game aggregator connects your platform to hundreds of game studios through a single API and revenue-share contract, replacing dozens of individual integrations. For a new operator, this is non-negotiable — you cannot negotiate direct deals with NetEnt or Pragmatic Play without volume. The aggregator takes a cut (typically 2–5% of GGR on top of the studio's share), but the operational simplicity is worth it at launch.

The major aggregators in 2026 are SOFTSWISS Game Aggregator (7,000+ titles, strong in crypto and offshore markets), EveryMatrix's CasinoEngine (broad EU coverage, clean API), Relax Gaming (premium content focus, strong in Nordics and UK), and Slotegrator (popular for emerging markets and lower-volume operators). Each has a different content mix, different minimum revenue guarantees and different technical integration quality. Slotegrator tends to be more accessible for first-time operators with lower volume commitments; SOFTSWISS Game Aggregator is the default choice if you're building on their casino platform anyway.

The aggregator contract is where operators get surprised. You're typically looking at a 3–5% aggregator fee on top of the studio's 15–20% GGR share, which means the house is paying out 18–25% of gross revenue before any platform fees. Read the minimum monthly guarantee clauses carefully — some aggregators require $5k–$15k/month in minimum fees regardless of your actual revenue. If you're in a soft launch phase, that's a real cash drain. Negotiate hard on the ramp-up period.

My standard recommendation: integrate one tier-1 aggregator (SOFTSWISS or EveryMatrix depending on your platform) for the bulk of your content, then add a second aggregator for live casino if your primary doesn't carry Evolution Gaming directly. Evolution is effectively a monopoly in live dealer and they negotiate directly with operators at meaningful volume, but most new operators access them through an aggregator first. Don't try to build a 10-aggregator spider web on day one — the technical overhead and reconciliation complexity will break your ops team.

What payment stack do you actually need to launch — and how do you avoid the PSP failure trap?

You need a minimum of three live payment integrations before you go public: one card acquirer, one alternative payment method (APM) and one crypto processor. Launching with a single PSP is the most common and most costly mistake in new casino operations. When that single relationship gets terminated — and it will, at least once — you have zero revenue until you find a replacement.

Card acquiring for gambling is hard. Most mainstream acquirers (Stripe, Square, Braintree) won't touch it. The specialist gambling acquirers — Nuvei, Payvision, Paymentwall, Praxis Cashier, Trustly — will, but they charge for the privilege: expect 3–6% processing fees plus rolling reserves of 5–10% held for 90–180 days. The reserve requirement alone can lock up significant working capital in your first year. Model this into your cash flow projections from day one, not as an afterthought.

Crypto payment processing has shifted from 'nice to have' to 'core infrastructure' for offshore operators. CoinsPaid processes a significant share of iGaming crypto volume and integrates cleanly with SOFTSWISS-stack operators. BitPay and B2BinPay are alternatives worth evaluating. Crypto rails give you a payment channel that doesn't depend on a banking relationship, which is invaluable when your card acquirer is having a bad quarter and starts holding reserves aggressively. For LATAM markets specifically, local APMs — PIX in Brazil, SPEI in Mexico, PSE in Colombia — often outperform cards on conversion rate.

Praxis Cashier and Cleo (formerly Payneteasy) operate as payment orchestration layers that sit above individual PSPs and let you route transactions, manage failover and add new payment methods without re-integrating at the platform level. For operators on custom or turnkey builds, this layer is worth the additional cost — it dramatically reduces the engineering overhead of managing a multi-PSP stack. On a white-label, your provider usually handles this, which is one of the few genuine advantages of that model.

One more thing the vendor sales decks don't mention: PCI DSS compliance. If you're handling card data at all, you need either a SAQ-D certified environment (expensive) or a fully outsourced tokenization solution that keeps raw card data off your infrastructure entirely. Most modern PSP integrations handle this, but audit your integration carefully. A PCI breach on a new gambling license is effectively a business-ending event.

What does it actually cost to start an online casino — full budget breakdown?

Realistic all-in launch budgets range from $50k–$80k for a lean white-label operation to $300k–$600k for a properly resourced turnkey launch with an MGA license. Anyone quoting under $30k for a 'complete' solution is selling a reskin. Budget for 12 months of operating capital on top of setup costs — most new casinos don't reach breakeven until month 8–14.

Here's how the money actually flows on a mid-range turnkey launch targeting offshore markets with a Curaçao license. Platform license and setup: $80k–$150k. Gambling license (CGA): $25–35k. Game aggregator integration and initial content fees: $10k–$20k setup plus ongoing rev-share. Payment integrations and PSP setup fees: $5k–$15k. KYC/AML tooling (Sumsub, Veriff or similar): $1k–$3k/month. Responsible gambling and compliance software: $1k–$2k/month. Customer support setup (in-house or BPO): $5k–$15k/month depending on coverage. Marketing and affiliate program launch: $20k–$50k for a credible initial push. Legal and corporate structure: $10k–$30k. Total first-year all-in: $250k–$450k is a realistic range, and that assumes nothing goes wrong.

The costs operators consistently underestimate are the ongoing ones. Platform fees, aggregator minimums, PSP reserves, compliance tooling, support staff and affiliate commissions compound quickly. A casino doing $100k/month in GGR might have $60k–$75k in operational costs before any marketing spend — margins are tighter than the industry's reputation suggests, especially in the first two years. Build a 12-month operating runway into your capital raise before you launch.

On the high end, an MGA-licensed turnkey operation with a proper tech stack, compliance team and marketing budget can easily run $600k–$1M in year one. This is the realistic cost of building something that can actually scale in competitive European markets. The operators who try to do it for $100k end up with a product that can't compete on bonus structures, can't pass PSP due diligence and can't afford the affiliate commissions that drive player acquisition in mature markets.

How does KYC, AML and responsible gambling compliance fit into the tech stack?

Compliance tooling is not optional and it's not a checkbox — it's an integrated layer of your platform that touches onboarding, payments and player management. Regulators from the CGA to the MGA now require documented AML programs, automated KYC at defined thresholds and responsible gambling controls baked into the product. Budget for this from day one, not after your first audit.

KYC automation is handled by vendors like Sumsub, Veriff, Onfido and Jumio. These integrate via API into your registration and deposit flows, running document verification and liveness checks in seconds. Pricing is typically per-verification — expect $1–$4 per check depending on volume and verification depth. For a new casino doing 500 verifications a month, this is manageable; at 10,000/month you'll want to negotiate a volume tier. Sumsub is the most common choice in iGaming for its pre-built integrations with major casino platforms and its ability to handle multi-jurisdictional ID requirements.

AML transaction monitoring is a separate layer. Tools like ComplyAdvantage, Napier and ACAMS-certified screening solutions watch for suspicious transaction patterns, PEP (politically exposed persons) matches and sanctions list hits. Most casino platforms have basic rule-based monitoring built in, but for MGA compliance or any serious operation, you'll want a dedicated AML solution that generates the audit trail regulators actually want to see. This is one area where cutting corners has a very specific downside: license suspension.

Responsible gambling tools — deposit limits, session limits, self-exclusion, reality checks and cooling-off periods — are required by virtually every regulated jurisdiction and increasingly expected even in offshore markets. SOFTSWISS, EveryMatrix and most turnkey platforms include these natively. The technical implementation is straightforward; the harder part is integrating with national self-exclusion registers like GAMSTOP (UK), OASIS (Germany) or state-level systems in the US. If you're targeting regulated markets, map out these integrations early — they're not fast to implement and regulators will test them.

What does the technical integration process actually look like — APIs, back-office and third-party connections?

A modern casino platform integration involves four primary API layers: the game aggregator wallet API, the payment gateway API, the KYC/identity API and the CRM/bonus engine API. Each has its own authentication model, error-handling requirements and testing environment. Operators who underestimate integration complexity are the ones who blow their launch timelines.

The game aggregator wallet API is the most critical integration in your stack. When a player spins a slot, the game server calls your wallet to debit the bet and credit the win in real time. Latency matters — anything over 200ms round-trip starts affecting player experience. SOFTSWISS Game Aggregator and EveryMatrix both use well-documented REST APIs with sandbox environments, but you'll still spend 2–4 weeks in testing before you're comfortable with edge cases like network timeouts, duplicate transaction handling and currency conversion rounding. Get this wrong and you'll have player balance disputes on day one.

Payment gateway integrations vary wildly in API quality. Nuvei has a clean, well-documented API. Some smaller gambling-specialist acquirers have documentation that looks like it was written in 2009 and last updated in 2015. Always run a technical evaluation of the API docs before signing a contract — I've seen operators locked into 12-month PSP agreements with integrations that took 3x the estimated development time because the documentation was incomplete. Ask for a sandbox environment access before you sign anything.

The back-office is where operators spend most of their day-to-day time: player management, bonus configuration, reporting, fraud tools and affiliate tracking. Turnkey platforms like SOFTSWISS Casino Platform include a back-office as part of the package. On a custom build, you're either building this yourself or integrating a third-party casino management system. Affiliate tracking is typically handled by a separate platform — Income Access, MyAffiliates and Affilka (SOFTSWISS's affiliate tool) are the common choices. Budget for this integration separately; it's not trivial.

How do you approach player acquisition and affiliate programs as a new operator?

Affiliate marketing is the dominant acquisition channel for online casinos, accounting for 40–60% of new depositing players for most operators. You need an affiliate program live at launch, not three months later. The economics are straightforward — revenue share (25–40% of net gaming revenue) or CPA ($100–$300 per depositing player) — but managing affiliate quality and fraud requires active oversight from day one.

Setting up an affiliate program requires an affiliate tracking platform (Affilka, Income Access, MyAffiliates or Cellxpert are the main options in iGaming), a commission structure and marketing materials. Most new operators start with a revenue share model because it aligns incentives — you only pay when affiliates generate real revenue. CPA deals are more attractive to high-volume affiliates but require confidence in your player LTV calculations, which you don't have in month one. Offer both, but push rev-share for new affiliate relationships until you have LTV data.

Affiliate fraud is a real operational cost that new operators consistently underestimate. Bonus abuse, self-referrals and traffic from prohibited jurisdictions all show up in affiliate reports. Your affiliate platform needs IP tracking, device fingerprinting and manual review workflows. Build these into your operational processes before you start signing affiliate deals, not after you've paid out $50k in commissions on fraudulent traffic. This is one area where the white-label model actually helps — the provider's platform often has fraud detection baked in.

SEO and content marketing are slower but build durable acquisition infrastructure. An authority site targeting 'how to start an online casino' or jurisdiction-specific casino review content can drive organic traffic for years. Paid social and search advertising for gambling is heavily restricted on major platforms (Google, Meta) and requires pre-approval processes that can take weeks. Factor this into your launch timeline — you won't be running Google Ads on day one.

What are the specific regulatory requirements for launching in LATAM markets like Colombia, Mexico and Brazil?

LATAM is not one market — it's five distinct regulatory environments. Colombia (Coljuegos) has a functioning online gambling license with clear requirements. Mexico (SEGOB) has a federal gaming law but enforcement is inconsistent. Brazil's regulated sports betting market launched in 2025 under LOTERJ/SPA oversight. Each requires local entity structures, local payment methods and different compliance approaches.

Colombia is the most mature regulated online gambling market in LATAM. Coljuegos issues online casino licenses to local entities — you need a Colombian SAS or SA, a local technical infrastructure requirement and a revenue-sharing arrangement with the state. License fees and taxes are significant (roughly 15% of net gaming revenue goes to the state), and the application process takes 6–12 months. The upside is a regulated market with a functioning legal framework, growing middle class and strong mobile penetration. PIX-equivalent local payment methods (PSE, Efecty) are essential — card penetration is lower than in Europe.

Mexico operates under a federal gaming law administered by SEGOB, but online-specific regulation has been inconsistent. Many operators serve Mexican players under Curaçao or MGA licenses without a local license, in a legal gray zone that has persisted for years. SEGOB has issued some online gaming permits, but enforcement against unlicensed operators is rare. This is a market where legal risk tolerance varies significantly by operator — get current local legal advice before launching, because the regulatory posture can shift with political cycles. SPEI and OXXO cash payments are critical for Mexican player conversion.

Brazil's regulated market is the most significant development in LATAM in years. The sports betting and online gaming regulatory framework, overseen by SPA (Secretaria de Prêmios e Apostas) under the Ministry of Finance, went live in 2025. Licensing requires a Brazilian entity, substantial capital requirements and local data residency. It's a large, high-growth market with enormous potential, but the compliance and operational costs of a proper Brazilian license are comparable to an MGA application. PIX is the dominant payment method and non-negotiable for conversion.

What vendor selection mistakes do first-time operators consistently make?

The three most expensive mistakes I see repeatedly: choosing a platform based on the demo rather than the contract terms, signing with a single PSP before testing their approval rate on your target market, and underestimating the time and cost of going live with a game aggregator. Vendor sales cycles are designed to obscure these risks — your due diligence process needs to actively surface them.

Platform contracts deserve more scrutiny than most operators give them. The demo looks great; the contract is where you discover the 30% rev-share that persists forever, the 24-month lock-in with a $50k break fee, and the clause that gives the provider rights to your player data if you exit. Have a lawyer who has actually read iGaming platform contracts review it — not a general commercial lawyer who's never seen one. The difference in negotiating outcomes is significant. Key clauses to push back on: revenue share rate and duration, data ownership and portability on exit, SLA commitments with financial penalties, and exclusivity restrictions on game content or payment providers.

PSP due diligence is routinely rushed. Operators sign with a payment provider based on a sales call, complete the integration, and then discover that the acquirer's approval rate for their specific player geography is 40% — meaning 60% of deposit attempts fail. Always ask for approval rate data by country before signing. Ask for references from operators in your target market. Ask what the reserve policy looks like 90 days in, not just at launch. A PSP that looks competitive at 3.5% processing fee becomes very expensive when you factor in a 10% rolling reserve and a 45% approval rate.

Game aggregator go-live timelines are almost always longer than the sales deck suggests. The technical integration is one thing; the content certification process is another. Some jurisdictions require individual game certifications by an approved testing laboratory (BMM, GLI, eCOGRA) before titles can go live. This can add weeks or months to your content availability, especially for live casino. Map out the certification requirements for your target jurisdiction before you sign the aggregator contract, and build realistic content availability timelines into your launch plan.