How to Start an Online Casino in the US: 7 Legal States vs. 39 That Will Get You Shut Down in 2026

Which US states have legalized online casino gambling as of 2026?

Seven states have fully legalized real-money online casino games as of 2026: New Jersey, Pennsylvania, Michigan, Connecticut, Delaware, West Virginia, and Rhode Island. Every other state either prohibits online casino play outright or has only authorized sports betting, which is a completely different regulatory category operators frequently conflate.

New Jersey remains the benchmark market. It launched in 2013 under the Division of Gaming Enforcement (DGE) and generated roughly $2.4 billion in gross gaming revenue in 2023, according to DGE reports. Pennsylvania followed in 2019 under the Pennsylvania Gaming Control Board (PGCB) and has closed the gap quickly, with Michigan (launched 2021, regulated by the Michigan Gaming Control Board) now running a close third. These three states account for the overwhelming majority of US online casino revenue and attract the most serious operator investment.

Connecticut, Delaware, West Virginia, and Rhode Island round out the legal map, but with important caveats. Delaware's market is tiny, it operates through a state lottery monopoly model with three licensed skins, leaving no room for independent operators. Rhode Island similarly launched in late 2023 as a state-run monopoly under IGT and Bally's. Connecticut operates a duopoly tied to the Mashantucket Pequot and Mohegan tribes. West Virginia has open licensing but a small addressable population. The practical entry points for a new operator are New Jersey, Pennsylvania, and Michigan.

Sports betting is live in roughly 38 states as of 2026, and this causes genuine confusion among founders who read a headline about a state 'legalizing gambling' and assume casino games are included. They are not. Online poker occupies its own separate legal category as well. If your product includes slots, blackjack, roulette, or live dealer tables, you need an explicit online casino license, not a sports betting skin.

What does it actually cost to get licensed and launch in a legal US state?

Realistically, plan for $1 million to $5 million in pre-revenue spend before you take your first real-money bet in a state like New Jersey or Pennsylvania. That range covers license fees, legal and compliance infrastructure, platform certification, responsible gambling systems, and the inevitable delays. Operators who budget $300K based on offshore launch experience almost always run out of money mid-process.

License fees alone are significant but not the dominant cost. New Jersey charges a $400,000 Internet Gaming Permit fee for a five-year term. Pennsylvania's Interactive Gaming Certificate costs $10 million for a standalone online casino operator license, which is why most new entrants pursue a 'skin' arrangement under an existing land-based licensee rather than a direct certificate. Michigan's operator license fee is lower (roughly $100,000 plus a $50,000 annual fee), making it a more accessible entry point for well-capitalized but not massive operators.

The real spend is in compliance infrastructure. Every platform, game, RNG, and payment method must be independently certified by a state-approved testing laboratory, GLI (Gaming Laboratories International) and BMM Testlabs are the two most common. Certification per game can run $1,500 to $5,000, and if you're launching with 300+ titles, the math adds up fast. You also need a state-approved responsible gambling program, geolocation technology (GeoComply is the de facto standard in the US), and AML/KYC systems that meet state-specific requirements, not just generic offshore standards.

Legal fees are routinely underestimated. US gaming law is hyper-local. A firm that handles Curaçao licensing will not have the right expertise for a New Jersey DGE submission. Expect to retain a specialist gaming attorney in each target state, plus federal counsel familiar with UIGEA compliance. Retainers and submission work across a single-state launch typically run $150,000 to $400,000 in legal fees alone, and that assumes no regulatory back-and-forth.

Ongoing compliance is a recurring cost, not a one-time hurdle. Annual audits, responsible gambling reporting, advertising pre-approval requirements (New Jersey requires DGE review of marketing materials), and the cost of maintaining a compliance officer with state-specific knowledge are all line items that offshore operators are simply not accustomed to carrying.

How does the market-access model work, and is it the right path for new operators?

A market-access deal means partnering with an existing licensed land-based casino to operate as a 'skin' under their license, rather than obtaining your own standalone certificate. In New Jersey and Michigan especially, this is the dominant entry model for new operators. It cuts licensing timeline and cost substantially, but you are permanently dependent on a partner whose priorities may not align with yours.

In New Jersey, the law requires that every online casino operation be tethered to an Atlantic City land-based licensee. You cannot operate independently. The tethering requirement means you negotiate a revenue-share or flat-fee arrangement with a casino like Caesars, Golden Nugget, or Resorts. The tethered partner holds the master license; you hold a transactional waiver as an operator. Resorts Digital Gaming, for example, has historically been the most accessible partner for smaller operators looking to enter the NJ market under this structure.

Michigan's model is slightly different but similarly partner-dependent. The MGCB issues both operator and supplier licenses, and online casino is tied to one of the three Detroit commercial casinos (MGM Grand Detroit, MotorCity Casino, or Greektown) or one of the tribal gaming compacts. The tribal path has opened up meaningfully since 2021, with several tribes now actively seeking technology partners rather than just white-labeling a single product.

The trade-off is real. A market-access deal gets you live in 12 to 18 months versus 3 or more years for a standalone license. But your partner takes a cut of GGR, typically 5% to 25% depending on the deal structure and how much leverage you have, and retains ultimate regulatory responsibility. If your partner's license is suspended for any reason, your operation goes dark too. Operators who've been through this process recommend negotiating hard on the exit clause and ensuring the agreement specifies what happens to your player database if the partnership dissolves.

What platform and technology stack do US-licensed operators actually use?

US-regulated operators cannot simply reuse an offshore platform. Every technology layer, the casino platform, game aggregator, payment processor, and geolocation system, must be certified by a state-approved testing lab and, in some cases, specifically approved by the regulator. This eliminates most offshore-focused vendors and significantly narrows the certified supplier pool.

On the platform side, SG Digital (now part of Light & Wonder), Kambi's casino arm, and GAN (now Sightline Payments' B2B division) have historically been the most common certified back-office providers in New Jersey and Pennsylvania. SoftSwiss, which dominates the offshore and European market, does not hold US state certifications as of 2026 and cannot be used in a licensed US operation without going through the full certification process, which takes 12 to 24 months per state. EveryMatrix is pursuing US certifications but is not yet widely deployed across all legal states.

For game content, the certified aggregator path matters enormously. IGT, Scientific Games, and Everi have deep US roots and extensive certified game libraries. On the digital-native side, Evolution Gaming holds certifications across all seven legal states and is the dominant live dealer provider. Pragmatic Play and NetEnt have certified content in New Jersey and Michigan. The practical reality is that your game library in a US-regulated environment will be smaller than what you'd offer offshore, at least initially, because certification per title per state is a real cost and time barrier.

Geolocation is non-negotiable and non-substitutable. GeoComply holds a near-monopoly on US iGaming geolocation and is explicitly required or de facto required by most state regulators. Budget approximately $0.05 to $0.15 per geolocation check, which adds up at scale. Payments are a separate and significant challenge covered in a dedicated section below.

How do US online casino payments work, and why do operators consistently underestimate this?

Payments in US-regulated online casino markets are genuinely harder than in any other jurisdiction. UIGEA compliance requirements mean most major card networks restrict gambling transactions, ACH has high failure rates, and players are accustomed to fast payouts that the US banking infrastructure struggles to deliver. Operators who treat payments as an afterthought launch with broken funnels.

The Unlawful Internet Gambling Enforcement Act of 2006 does not make online gambling illegal, it restricts financial institutions from processing payments to unlicensed gambling sites. In legal states, licensed operators can process payments, but individual banks still flag and decline gambling transactions at high rates. Visa and Mastercard credit card acceptance rates for online casino deposits in New Jersey typically run 60% to 75%, compared to 90%+ in most European markets. This is not a technical problem you can engineer away; it is a function of bank-level MCC code policies.

The practical payment stack for a US online casino operator typically includes: PayNearMe for cash-at-retail deposits (a genuinely popular method in the US), ACH/eCheck through a processor like Sightline or Paysafe, PayPal where the operator has a specific PayPal agreement (NJ and MI are the primary markets where this is available), online banking via Trustly or VIP Preferred, and Play+ prepaid cards, which are Discover-network prepaid accounts that bypass bank-level declines. Venmo integration is available for operators with a PayPal relationship.

Payouts are where player friction peaks. Wire transfers, paper checks, and ACH are the dominant payout methods. Same-day or next-day payouts are technically possible via Play+ or PayPal but require specific integrations and agreements. Operators launching with only ACH payouts on a 3-5 business day cycle will see elevated churn among players who've been conditioned by competitors offering faster options. Build your payment roadmap before you build your game lobby.

What is the legal risk for offshore operators targeting US players without a state license?

The federal risk for offshore operators taking US players is real, not theoretical. The Wire Act, UIGEA, and state-level statutes create overlapping exposure. While enforcement against individual players is essentially nonexistent, operators, payment processors, and affiliates have faced federal indictments, asset seizures, and domain seizures. The 'gray market' framing that works in other jurisdictions does not translate cleanly to US federal law.

The most instructive case remains the 2011 'Black Friday' indictments of PokerStars, Full Tilt Poker, and Absolute Poker, where the DOJ charged operators with bank fraud and money laundering in addition to Wire Act violations. More recently, the DOJ has pursued payment processors and affiliate networks rather than chasing individual players. If your payment processor is routing US player deposits, they are a target regardless of where your casino is incorporated.

A Curaçao or Anjouan license provides zero protection against US federal prosecution. These licenses are issued by offshore authorities with no jurisdiction over US federal law. The license is relevant for operating in jurisdictions that recognize it, it is not a shield against the Wire Act. Operators who've been told otherwise by their licensing agent received bad advice.

Geoblocking is the standard risk-mitigation approach for offshore operators who want to avoid US exposure entirely. IP-based blocking, combined with terms-of-service prohibitions on US residents, is the minimum. Operators running aggressive affiliate programs with US-facing traffic sources are taking on meaningful exposure even if the casino itself is technically geoblocked, because the affiliate marketing activity itself can be characterized as soliciting US players.

The practical enforcement picture in 2026 is that the DOJ focuses on large-scale operations and payment infrastructure rather than small offshore casinos. But 'unlikely to be targeted today' is a very different risk profile from 'legally protected,' and operators building a serious business should understand the distinction clearly before deciding to serve US-adjacent traffic.

Which states are most likely to legalize online casino gambling next, and when?

New York, Illinois, and Indiana are the most-watched potential additions to the legal map, but none has a clear 2026 passage timeline. New York has had active bills for several years with strong revenue arguments, the state loses significant GGR to New Jersey's border proximity, but faces opposition from the land-based casino lobby and legislative inertia. Treat any 'imminent legalization' prediction with skepticism until a bill clears committee.

New York is the most consequential potential market. The state's population and the number of New York residents who already play on New Jersey-licensed sites make the revenue case compelling, estimates from various industry analysts put potential NY iGaming GGR at $1.5 billion to $3 billion annually at maturity. Governor Hochul has been publicly supportive of studying the issue, but the state legislature has not moved a bill to a floor vote as of early 2026. The three downstate commercial casino licenses (currently being awarded) will need to be operational before any online expansion is politically viable, which pushes a realistic launch to 2027 at the earliest.

Illinois is a different story. The state has a large land-based casino footprint and already runs one of the largest legal sports betting markets in the country. An iGaming bill has been introduced in multiple legislative sessions but faces opposition from tribal interests and some casino operators who fear cannibalization of their land-based revenue. The cannibalization argument has been empirically weak in states like Michigan and New Jersey, where land-based and online revenues have grown simultaneously, but it remains politically effective.

Indiana, Maryland, and Massachusetts are secondary candidates with active or recently lapsed bills. Maryland has a particularly interesting dynamic given its proximity to Washington, D.C. and its existing sophisticated sports betting infrastructure. For operators building a US market-entry strategy, the right approach is to model your business on the seven existing states and treat additional states as upside optionality, not a core revenue assumption.

How does US online casino taxation compare across legal states, and what should operators model?

Gross gaming revenue tax rates vary significantly across legal states, from Delaware's effectively monopoly structure to Pennsylvania's 54% slots tax rate, which is the highest in any legal US iGaming jurisdiction. The tax rate is a direct input into your unit economics model and can make or break the profitability of a market-entry decision. Pennsylvania's rate in particular surprises operators who assume US states follow a European-style 15-25% framework.

Pennsylvania's tax structure deserves special attention because it is genuinely punishing for operators. Online slots are taxed at 54% of GGR. Online table games are taxed at 16%, and online poker at 16%. The blended effective rate for a typical operator with a slot-heavy product mix will be in the 40-50% range. Compare this to New Jersey, where the effective tax rate is 15% of GGR (with an additional 2.5% investment alternative tax), and Michigan, where the rate is 20-28% of GGR depending on revenue tiers. Pennsylvania's high rate is why several operators have chosen to prioritize New Jersey and Michigan despite Pennsylvania's larger population.

Delaware's structure is essentially irrelevant for independent operators since the market is a state lottery monopoly. West Virginia taxes at 15% of GGR, which is favorable, but the small market size limits the absolute revenue opportunity. Rhode Island's monopoly structure means the state captures most of the economics directly.

Beyond the GGR tax, operators need to model federal corporate income tax (21% for C-corps), state corporate tax in the state of incorporation and operation, and the cost of the financial reporting infrastructure required to comply with state gaming tax filings. US gaming tax compliance is more granular and more frequently audited than offshore equivalents. Budget for a dedicated gaming tax accountant or a specialized firm like Deloitte's gaming practice from day one.

What responsible gambling and KYC requirements do US states impose that offshore operators are not prepared for?

US state responsible gambling requirements are substantially more prescriptive than offshore equivalents and are actively enforced. Self-exclusion integration with state-run databases is mandatory, not optional. KYC is required at account creation in most states, not at withdrawal, this alone changes your funnel conversion economics compared to offshore operations that allow anonymous play until a cash-out trigger.

Every legal US state operates or participates in a self-exclusion database. In New Jersey, this is the Casino Self-Exclusion Program maintained by the DGE. In Michigan, the MGCB runs its own list. Operators must check every new registrant against the state self-exclusion list before activating the account, and must recheck periodically. Failure to exclude a self-excluded player who subsequently loses money is a regulatory violation that has resulted in fines against multiple licensed operators. The integration is technically straightforward but requires a live API connection to the state database, which needs to be certified and tested before launch.

KYC at registration is the norm in US regulated markets, not at withdrawal. This means you are asking players to verify identity, age, and address before they can make their first deposit. Conversion rates from registration to verified depositor are typically 30-50% lower than offshore equivalents where verification is deferred. Build this into your player acquisition cost models. Identity verification vendors like Jumio, Onfido, and Socure have US-specific document verification capabilities and are commonly used in the space.

Advertising restrictions are another area where operators face unexpected friction. New Jersey requires DGE pre-approval for marketing materials. Most states prohibit advertising that targets self-excluded players or that could appeal to minors. The American Gaming Association's Responsible Marketing Code for Sports Wagering has influenced online casino marketing standards in several states. Budget for compliance review of every creative asset and expect a 5-10 business day approval cycle in states that require pre-clearance.

What is the realistic timeline to launch a licensed US online casino from scratch?

From the decision to pursue a US license to taking your first real-money bet, plan for 18 to 36 months in a best-case scenario for New Jersey or Michigan via the market-access model. A standalone license in Pennsylvania adds another 12 to 18 months on top of that. Operators who've done it describe the timeline as consistently longer than their legal counsel initially projected.

The market-access path in New Jersey breaks down roughly as follows: 3 to 6 months to identify and negotiate a tethering agreement with an Atlantic City licensee; 6 to 12 months for the DGE application, background investigation, and transactional waiver approval; 3 to 6 months for platform and game certification by GLI or BMM; 1 to 2 months for soft launch, testing, and regulatory sign-off. Total: 13 to 26 months from start to live. Michigan runs slightly faster because the MGCB has streamlined its review process since the initial 2021 launch wave, but 12 to 18 months is still realistic.

The background investigation is the wildcard. US gaming regulators conduct thorough investigations of all principals, key employees, and significant investors. Anyone with a criminal record, unresolved litigation, or complex offshore corporate structures will slow the process significantly. Investors who've funded offshore gambling operations without proper licensing disclosures have caused application denials. Get a gaming attorney to do a pre-application suitability assessment of your entire cap table before you submit anything.

Platform and game certification is the other major timeline driver. If you're building on a platform that is not already certified in your target state, add 12 to 24 months to the clock for that work alone. This is why most new entrants in 2026 are using already-certified platforms like GAN, Kambi's casino product, or Everi's iGaming suite rather than trying to certify a novel technology stack. The certification cost and timeline for a new platform is a genuine barrier to entry that protects existing certified vendors.

How should operators evaluate white-label versus turnkey versus custom build for a US market entry?

For US market entry specifically, the white-label versus turnkey debate is largely resolved by the certification requirement. You need a platform that is already certified in your target state, which means your technology options are constrained before the build-versus-buy question even arises. Custom builds are effectively off the table for a first-time US entrant unless you have 3+ years and $5M+ to spend on certification alone.

A white-label arrangement from a US-certified provider like GAN or Everi gets you a pre-certified technology stack with existing regulatory approvals in place. You're renting the infrastructure and operating under a sub-license of their certifications. The trade-off is limited differentiation, your product will look and behave similarly to other operators on the same white-label stack, and you're dependent on the vendor's certification maintenance and upgrade cycle. For a first US launch, this is usually the right call. You can differentiate on marketing, bonusing, and customer service without needing to own the underlying platform.

A turnkey solution sits between white-label and custom. You own more of the product roadmap but still rely on a certified vendor's core engine. In the US context, this typically means a platform like Scientific Games' OpenBet or Light & Wonder's iGaming platform, where you have more configuration flexibility but the core RNG and game engine are pre-certified. The cost premium over pure white-label is real, expect to pay 20-40% more in platform fees for the additional control, but for operators with a clear product differentiation strategy, it can be worth it.

Custom builds are a post-scale decision, not a launch decision. DraftKings built its own technology stack after proving the market with acquired infrastructure. FanDuel operates on a mix of proprietary and licensed technology that evolved over years of operation. If you're entering the US market for the first time, competing with those operators on technology investment before you have revenue is a losing strategy. Get live, build your player base, prove unit economics, then invest in proprietary infrastructure if the business justifies it.