US Online Casino Legal States 2026: The Operator's Stack & Market-Entry Comparison
Which US states have legal online casinos in 2026?
Six states have fully operational, licensed online casino markets in 2026: New Jersey, Pennsylvania, Michigan, Connecticut, Delaware, and West Virginia. Rhode Island has a limited iCasino framework tied to state-controlled infrastructure. No federal framework exists — every state regulates independently, with its own licensing body, technical requirements, and approved vendor lists.
New Jersey remains the largest and most competitive market, regulated by the Division of Gaming Enforcement (DGE). It has been live since 2013 and generates north of $2 billion in annual gross gaming revenue. Pennsylvania, regulated by the Pennsylvania Gaming Control Board (PGCB), is the second-largest and arguably the most operator-friendly for new entrants willing to absorb its steep upfront costs. Michigan, overseen by the Michigan Gaming Control Board (MGCB), opened in January 2021 and has grown rapidly — it's the market I'd prioritize for a mid-tier operator with a strong slots portfolio.
Connecticut launched in 2021 under a unique duopoly structure: only DraftKings (partnered with Mashantucket Pequot) and FanDuel (partnered with Mohegan Tribe) hold licenses. That effectively closes Connecticut to independent operators unless you're acquiring or partnering with one of those two entities. Delaware runs a state-controlled model through the Delaware Lottery — again, not a realistic independent entry point. West Virginia, regulated by the West Virginia Lottery Commission, is live but the market is thin; it's worth monitoring rather than prioritizing for launch.
Rhode Island passed legislation in 2023 allowing online casino gaming, but the rollout has been slow and is tied to the state lottery's existing infrastructure contracts. As of mid-2025 the market is functionally limited. Several other states — New York, Illinois, Maryland, Indiana — have active legislative efforts, but none had passed iCasino bills as of the time of writing. New York is the one to watch: the addressable market is enormous, and the political dynamics shifted meaningfully after sports betting revenue figures landed.
| State | Regulator | Market Open | License Type | Est. Annual GGR (2024) | New Operator Entry? |
|---|---|---|---|---|---|
| New Jersey | NJ DGE | 2013 | Casino partner/skin | ~$2.1B | Yes — via Atlantic City casino partner |
| Pennsylvania | PGCB | 2019 | Interactive Gaming Certificate | ~$1.9B | Yes — standalone iGaming license |
| Michigan | MGCB | 2021 | Internet Gaming Supplier + Operator | ~$1.6B | Yes — via Detroit casino partner |
| Connecticut | CTDCP | 2021 | Tribal compact only | ~$300M | No — duopoly structure |
| Delaware | Delaware Lottery | 2013 | State-run only | ~$10M | No — state-controlled |
| West Virginia | WV Lottery | 2020 | Interactive Wagering License | ~$100M | Yes — limited operators |
What does a US online casino license actually cost and how long does it take?
Licensing costs in the US dwarf offshore jurisdictions. Pennsylvania charges a $10 million interactive gaming certificate fee alone — before you touch legal, compliance, or platform costs. New Jersey and Michigan are cheaper to enter but require an Atlantic City casino or Detroit casino partner respectively, which adds its own commercial cost. Realistically, budget $15M–$30M+ for a full PA launch; NJ or MI can be done for less with the right partner structure.
Pennsylvania is the most expensive regulated market in the world for online casino entry. The $10M certificate fee is non-negotiable and non-refundable — it's a revenue line for the state. On top of that, operators pay a 54% tax on slots GGR and 16% on table games GGR. Those margins force operators to run very efficiently. If your platform costs, payment processing fees, and game royalties aren't tightly controlled, you'll be cash-flow negative for years. I've seen operators underestimate the operational burn and run out of runway before they hit scale.
New Jersey requires a transactional waiver or full casino license from the DGE. The practical path for most operators is a skin arrangement with one of the nine Atlantic City casino licensees (Borgata, Caesars, Resorts, etc.). The host casino takes a revenue share — typically 15–25% of GGR depending on the deal — plus you pay platform, game, and payment costs on top. The DGE technical review of your platform is rigorous: expect 6–12 months from submission to approval if you're using a platform that hasn't been previously certified in NJ.
Michigan is structurally similar to NJ in that you need a Detroit casino partner (MGM Grand Detroit, MotorCity, or Greektown). The MGCB licensing process is somewhat faster than NJ's DGE — operators have gone live in 9–14 months from application. The tax rate is more palatable: 20–28% on GGR depending on revenue tier. For a mid-sized operator, Michigan is often the best first market because the compliance infrastructure you build there — certified platform, approved game library, compliant payment stack — transfers more easily to other states than NJ's highly specific technical standards do.
| State | License / Certificate Fee | GGR Tax Rate (Casino) | Approx. Time to Launch | Key Requirement |
|---|---|---|---|---|
| Pennsylvania | $10,000,000 | 54% slots / 16% tables | 18–30 months | Standalone iGaming certificate |
| New Jersey | $400K–$600K (waiver/fees) | 15% GGR | 12–24 months | Atlantic City casino partner |
| Michigan | $100K–$200K (supplier + operator) | 20–28% GGR | 9–18 months | Detroit casino partner |
| West Virginia | $50K–$100K | 15% GGR | 9–15 months | WV land-based casino partner |
| Connecticut | Tribal compact — not open | N/A | N/A | Tribal partnership only |
Which platform and software stack works for regulated US markets?
Most offshore-certified casino platforms — including popular white-label solutions — are not ready for US regulated markets out of the box. US states require platform certification by an approved testing lab (GLI, BMM, or iTech Labs), geolocation compliance via approved vendors like GeoComply, and strict responsible gambling tooling baked into the back office. Plan for significant re-engineering if your platform was built for Curaçao or MGA.
The platform decision is the most consequential technical choice you'll make for a US launch. I've reviewed contracts from SoftSwiss, EveryMatrix, Kambi (for sports), and several proprietary builds — and the honest answer is that no single offshore platform ships US-ready out of the box. EveryMatrix has done the most visible work on US market compliance, and their platform has been used in regulated US sports betting contexts. SoftSwiss is strong for offshore and crypto operations but has limited US regulatory footprint as of 2025. If you're building for NJ or PA specifically, you're more likely to end up with a proprietary build or a platform vendor that has already gone through DGE or PGCB certification — which narrows the field considerably.
GeoComply is non-negotiable. Every regulated US state requires real-time geolocation verification to confirm a player is physically inside state borders. GeoComply holds the dominant position here — it's effectively a mandated vendor in NJ, PA, and MI. Budget around $0.10–$0.20 per session check; at scale that's material. Your platform needs a clean API integration with GeoComply, and your QA process needs to test geolocation edge cases (VPNs, border areas, device switching) before you go live or you'll fail the state's technical audit.
Responsible gambling tooling is not optional and not cosmetic. NJ, PA, and MI all require deposit limits, session limits, self-exclusion integration (NJ's Self-Exclusion list, PA's iExclusion, MI's MISLOT), and cooling-off periods. These need to be enforced at the platform level, not bolted on as a UI layer. When I review platform RFPs for US launches, I specifically ask vendors to walk me through how self-exclusion matching works at account creation and login — it's a common failure point that regulators audit hard. If your vendor can't answer that question precisely, that's a red flag before you sign anything.
How do game aggregators and studio certifications work in US regulated states?
Every game you offer in a regulated US state must be individually certified by a state-approved testing lab. You cannot simply plug in a game aggregator's full catalog and go live — each title needs a separate certification. This dramatically affects your go-to-market timeline and your choice of aggregator. Studios with existing US-certified game libraries (IGT, Scientific Games, Everi, Evolution, Playtech) are worth paying a premium for at launch.
The game certification requirement is the detail that surprises operators most when they first engage with US regulated markets. In New Jersey, every game must be certified by a lab on the DGE's approved list — GLI (Gaming Laboratories International) and BMM Testlabs are the most commonly used. A single game certification typically costs $3,000–$8,000 and takes 4–12 weeks depending on game complexity and lab queue times. If you're planning to launch with 200 titles, that's a six-figure certification budget before you've acquired a single player.
The practical implication is that you should anchor your launch library around studios that already have large certified catalogs in your target state. IGT, Scientific Games (now Light & Wonder), and Everi have deep roots in US land-based and online markets and maintain large certified game inventories. Evolution Gaming dominates live dealer across all regulated US states — their NJ and MI live dealer studios are state-of-the-art and their certification pipeline is mature. For slots, NetEnt (now part of Evolution) and Playtech have meaningful US-certified portfolios.
Game aggregators like Pariplay, Relax Gaming, or Caleta are increasingly pursuing US certifications, but their catalogs in regulated states are still thinner than their offshore offerings. If you're using an aggregator as your primary content layer, get a precise list of which titles are certified in your specific target state — not a general 'US-friendly' claim, but a state-by-state breakdown. I've seen operators sign aggregator deals based on headline catalog numbers only to discover 60% of the portfolio wasn't certified in their launch state. That's a painful discovery three months before go-live.
What payment stack do US regulated online casinos actually use?
Payment processing in US regulated iGaming is harder than any other market I've worked in. Most major card networks still flag iGaming MIDs, approval rates on Visa/Mastercard are inconsistent, and players have strong preferences for ACH and digital wallets. Your payment stack needs to be built around ACH rails, PayNearMe for cash, Trustly for instant bank, and VIP Preferred for loyalty — with cards as a secondary channel, not the primary one.
The Unlawful Internet Gambling Enforcement Act (UIGEA) of 2006 still shapes the payment landscape. Banks and card networks are permitted to block gambling transactions, and many do — even in states where online casino gaming is fully legal. The result is that card approval rates in US iGaming typically run 40–65%, compared to 85–95% in European markets. You'll lose a meaningful percentage of deposit attempts at the payment step, and that directly hits your conversion funnel. Don't let a platform vendor or PSP show you offshore approval rate benchmarks and apply them to your US projections.
The workhorses of the US iGaming payment stack are: Trustly (instant bank-to-bank, strong in NJ and MI), VIP Preferred (ACH with a loyalty layer, widely used by US operators), PayNearMe (cash at retail locations — critical for unbanked or underbanked segments), and Play+ (prepaid card model, used by operators like BetMGM and FanDuel). PayPal has expanded its iGaming presence in regulated US states and is a high-trust option for players, but it's selective about which operators it onboards. Skrill and Neteller, dominant in European markets, have minimal US iGaming presence.
On the withdrawal side, ACH is the dominant rail but settlement times (1–3 business days) create player friction. Operators who invest in faster payout infrastructure — same-day ACH, PayPal withdrawals, Play+ card cashouts — see measurably better retention metrics. This isn't a nice-to-have; in a competitive market like NJ where BetMGM, Caesars, and DraftKings are all advertising fast payouts, slow withdrawals are a churn driver. When you're evaluating platform vendors, ask specifically how they handle withdrawal orchestration and whether they support multiple payout rails with fallback logic.
| Method | Type | Typical Approval Rate | States Available | Settlement Speed | Operator Notes |
|---|---|---|---|---|---|
| Trustly | Instant bank transfer | 75–85% | NJ, PA, MI, WV | Instant deposit / 1–2 days withdrawal | Strong conversion; requires bank connectivity |
| VIP Preferred | ACH / e-check | 70–80% | NJ, PA, MI, CT, WV | 1–3 business days | Loyalty layer; widely trusted by US players |
| PayNearMe | Cash at retail | Near 100% | NJ, PA, MI, WV | Instant deposit / N/A withdrawal | Critical for unbanked segment |
| PayPal | Digital wallet | 80–90% | NJ, PA, MI (selective) | Instant deposit / 1–2 days withdrawal | High trust; selective operator onboarding |
| Play+ | Prepaid card | 85–90% | NJ, PA, MI, WV | Instant / same day | Operator-branded; good for withdrawals |
| Visa/Mastercard | Credit/debit card | 40–65% | All states (inconsistent) | Instant deposit | High decline rates; secondary channel only |
How does New Jersey online casino regulation compare to Pennsylvania and Michigan?
New Jersey has the most mature regulatory framework and the most competitive market — it's the toughest place to make money but the best proof-of-concept for US iGaming. Pennsylvania has the highest entry cost but a less saturated operator landscape and a more favorable player demographic for premium products. Michigan is the fastest-growing market with the most accessible entry path for operators who don't have existing US land-based relationships.
New Jersey's DGE runs the most rigorous technical review process of any US state. The DGE has been regulating online gaming since 2013 and has seen every trick in the book — their auditors know what good platform compliance looks like, and they'll push back on anything that looks like a workaround. The upside is that NJ certification is the most transferable credential in US iGaming: if your platform passes DGE review, you're in a strong position for PA and MI certifications. The downside is the market is crowded. BetMGM, Caesars, DraftKings, FanDuel, Borgata, and a dozen more operators are all fighting for the same NJ players. Customer acquisition costs are high and rising.
Pennsylvania's PGCB has developed a detailed set of technical standards (PGCB Technical Standards for iGaming) that are publicly available and worth reading before you engage any platform vendor. The $10M certificate fee is the obvious barrier, but the ongoing 54% slots tax is the one that kills long-term unit economics for operators who aren't running a tight ship. PA does allow operators to hold an iGaming certificate independently (unlike NJ and MI which require a land-based partner), which is attractive for operators who want full control over their brand and product roadmap.
Michigan's MGCB has been pragmatic and operator-friendly in its regulatory approach — they've been willing to work through technical issues with operators during the certification process rather than issuing hard rejections. The Detroit casino partner requirement is a commercial constraint, but the revenue share terms are often more negotiable than NJ's Atlantic City partner arrangements. Michigan also has a relatively young and digitally engaged player base, which translates to strong mobile conversion rates. If I were advising a well-capitalized operator entering the US for the first time with no existing land-based relationships, Michigan would be my recommended first market.
What are the technical certification requirements operators miss most often?
The three most commonly missed technical requirements in US state certifications are: geolocation integration depth (GeoComply configuration, not just API connection), self-exclusion matching at every player touchpoint (not just registration), and RNG certification per game rather than per platform. These aren't obscure requirements — they're in every state's technical standards document — but vendors routinely underscope them in project timelines.
Geolocation is the area where I see the most project delays. Operators integrate GeoComply's API, test it in a few scenarios, and declare it done. What they miss is the state-specific configuration requirements: NJ requires geolocation checks at session start and at configurable intervals during play; PA has specific requirements around geolocation failure handling (you must suspend the session, not just flag it); MI requires logging of geolocation data in a specific format for audit purposes. These are not difficult requirements to meet, but they require your platform vendor to have implemented them before — not to be figuring them out during your certification submission.
Self-exclusion matching is the other common failure point. Every regulated US state maintains a self-exclusion database, and operators are required to match against it at account creation, at login, and in some states at deposit. The matching logic needs to handle name variations, partial matches, and address changes — it's not a simple string comparison. In NJ, the DGE has issued enforcement actions against operators for self-exclusion failures. The reputational and financial risk of getting this wrong is significant. When I evaluate platforms for US launches, I ask for a technical walkthrough of the self-exclusion matching implementation specifically — not a feature checklist, a live demonstration.
RNG certification is misunderstood by operators coming from offshore markets. In offshore jurisdictions, a platform-level RNG certification often covers all games running on that platform. In US regulated states, each game's RNG implementation must be certified individually. This is why your game library decisions and your certification budget are directly linked. A platform that runs 500 games from 20 studios requires 500 individual game certifications — or you launch with a subset and expand the library post-launch, which is the more practical approach. Plan your launch library around games that already have state-specific certifications, and build your library expansion roadmap around the certification pipeline, not the other way around.
Which new US states are most likely to legalize online casino gaming by 2027?
New York, Illinois, and Maryland are the three states with the strongest legislative momentum for online casino legalization by 2027. New York is the highest-stakes market — the potential GGR dwarfs any existing US state — but its political dynamics are complex. Illinois and Maryland have more straightforward legislative paths. Indiana and Massachusetts are secondary candidates worth monitoring.
New York is the market everyone is watching. The state generated over $2 billion in online sports betting GGR in its first full year of operation, which gave legislators hard evidence of the revenue potential. Online casino bills have been introduced in multiple sessions, and the governor's office has shown increasing openness to the revenue argument as state budget pressures mount. The complication is the land-based casino lobby — New York's commercial and tribal casinos are protective of their exclusivity and have significant political influence. My read is that NY iCasino legislation passes before the end of 2026, but the tax rate will be punishing (likely 35–45% on GGR) and the number of operator licenses will be limited.
Illinois is interesting because it already has a complex multi-tiered sports betting market with both retail and online licenses. The legislative infrastructure for online gambling regulation exists, and there's been consistent lobbying from operators who are already in the IL sports betting market. The challenge is that Illinois has a history of complicated gambling legislation with significant carve-outs for land-based interests. A bill that passes in IL will likely include geographic restrictions or revenue-sharing requirements that constrain operator economics.
For operators building a US market entry strategy, the right move is to establish your compliance infrastructure in one of the six live states now — get your platform certified, get your payment stack operational, build your regulatory relationships — so that when NY or IL opens, you're not starting from scratch. The operators who entered NJ in 2013–2015 had a massive head start when PA and MI opened. The same dynamic will play out again with the next wave of states.
How should operators structure the vendor selection process for a US iGaming launch?
Vendor selection for a US iGaming launch needs to run in a specific sequence: platform and certification strategy first, then game library, then payment stack, then marketing technology. Most operators run these workstreams in parallel and create expensive conflicts — a platform that can't support your preferred payment provider, or a game aggregator whose certified catalog doesn't align with your target state. Sequence matters.
Start with the platform decision and make it around one question: has this platform been certified in my target state, and can the vendor show me the certification documentation? Not 'we're working toward certification' or 'we're US-ready' — actual certification records. If the answer is no, you need to factor in the certification timeline (6–18 months depending on state) and cost ($100K–$500K+ in lab fees, legal, and engineering) into your launch timeline. I've seen operators sign platform contracts with vendors who were 'in the process' of NJ certification, only to discover that 'in the process' meant 'we submitted six months ago and haven't heard back.' That's a year of runway burned.
Once you've locked the platform, build your game library strategy around the certified catalog. Get a formal written representation from every studio and aggregator listing their certified titles in your specific target state — not a general US certification claim. Prioritize studios with large existing certified libraries (IGT, Light & Wonder, Evolution, Playtech) for your launch slate, and plan your expansion roadmap around the certification pipeline for additional titles. Budget $150K–$300K for game certifications in your first year if you're building a competitive library from scratch.
Payment stack selection should happen in parallel with platform selection, not after. The reason is integration complexity: some platforms have native integrations with Trustly, VIP Preferred, and PayNearMe; others require custom API work that adds 2–4 months to your timeline. Get your payment provider shortlist early, confirm which ones have existing integrations with your platform vendor, and negotiate your PSP agreements before you've committed to a platform — it gives you leverage and surfaces integration risks before they become launch blockers.
What are the ongoing compliance and reporting obligations in regulated US states?
US regulated iGaming operators face ongoing compliance obligations that are significantly more demanding than offshore jurisdictions: monthly GGR reporting, player activity reports, self-exclusion database syncing (often daily), responsible gambling metric reporting, and periodic platform re-certification after significant software updates. Budget for a dedicated compliance function — this is not a part-time role.
Every regulated US state requires regular financial reporting to the gaming regulator. In New Jersey, operators file monthly gross revenue reports with the DGE; in Pennsylvania, reporting goes to the PGCB on a similar cadence. These aren't simple spreadsheets — they require reconciliation of player accounts, bonus accounting, and payment settlement data in formats specified by the regulator. If your back office and reporting tools aren't built for this from day one, you'll be doing manual reconciliation work that consumes significant staff time and creates audit risk.
Responsible gambling reporting is increasingly detailed. Michigan's MGCB requires operators to report on self-exclusion enrollment rates, deposit limit utilization, and player intervention outcomes. NJ's DGE has been expanding its responsible gambling reporting requirements each year. This means your platform needs to capture and store this data at the player level — not just aggregate metrics — in a format that can be exported for regulatory submission. When you're evaluating platform vendors, ask for a sample of the responsible gambling reports they generate for existing US-regulated clients.
Software updates trigger re-certification requirements that operators consistently underestimate. In most regulated US states, any material change to the platform — new features, changes to RNG implementation, payment flow modifications — requires notification to the regulator and in many cases a re-certification by an approved testing lab. This creates a tension between the agility you want in product development and the compliance overhead of change management. Operators who don't build a formal change management and regulatory notification process into their product development cycle end up either moving too slowly or running compliance violations. Neither is a good outcome.
Comments
No comments yet, be the first.