How do I check if an online casino is legit?

Find the licence number in the casino's footer or terms, then search the regulator's own public register for that number. Check that the legal name on the register matches the name in the terms, that the status is active, and that the domain you are on is listed. A licence number that appears only on the casino's site is a claim, not a check.

Which regulators actually protect players?

The UK Gambling Commission, the Malta Gaming Authority, and state regulators in the US attach specific conditions to a licence, including complaints routes and, in the UK, player-funds protection levels. Curaçao licences are real but historically carry thinner player-protection conditions. A licence is a condition, not a rating: two operators with the same licence can behave differently.

Why is my withdrawal taking longer than the site said?

A withdrawal time depends on the operator, the payment method, whether your account is fully verified, and the date. A first withdrawal from an unverified account can take days longer than a later one. If the site quotes a time without naming the method, the amount, the verification state and the date it was measured, the figure is not a measurement.

What is a maximum conversion clause?

It is a cap on how much of a bonus win becomes withdrawable cash. A 100 bonus with a 5x maximum conversion means at most 500 leaves the bonus balance, however large the win. The clause is usually in the bonus terms, not the headline, and it is the single term most likely to change what a player actually receives.

Are blacklists of rogue casinos reliable?

Blacklists are incomplete by construction and often lack a source. A regulator's published decisions page is more useful because it records what an operator was penalised for, with dates. If a regulator has fined an operator for misleading promotions or for failing to segregate player funds, that is a fact with a source; a blacklist entry without one is a rumour.

Legit Online Casino Checks: Licence, Payouts, Terms

A casino’s footer can say anything. A licence number printed there is a claim, not a fact. The only version of that claim that matters is the one that appears on the regulator’s own register, under the operating company’s legal name, with the same licence number. Everything below is a way to move from what an operator says about itself to what a third party records about it.

This page compares operators. Some links on it earn commission. That does not change the arithmetic or the checks. Where an operator scores badly on a check, the page says so. Where a figure is not published, the page says that instead of filling the gap.

The legal position differs by jurisdiction. Online gambling is an offence in many places, and what is permitted where you are is a question for your local regulator, not for a casino’s marketing page. Nothing here is legal advice. If you are under 18, or under the legal age where you are, this page is not for you.

If gambling stops being a decision and starts being a need, help exists. In the UK, GamCare runs a helpline on 0808 8020 133. In the US, the National Problem Gambling Helpline is 1-800-522-4700. Both are free and independent of any operator.

The five-minute check that matters most

Open the regulator’s public register in one tab and the casino in another. Do not use the casino’s own licence page; use the regulator’s search.

Find the licence number in the casino’s footer or terms. Write it down.
Search the regulator’s register for that number.
Check the name on the register against the name in the casino’s terms and conditions. They should match, or the register should name a parent company that the terms also name.
Check the status. “Active”, “issued” or “current” is what you want. “Surrendered”, “suspended” or “revoked” is not.
Check the domain list. Most regulators publish the domains a licence covers. If the domain you are on is not listed, the licence does not cover it.

That is the whole check. It takes less time than reading a bonus table, and it is the difference between a legit online casino and a page wearing someone else’s number.

What each regulator will and will not do

A licence is not a guarantee of good behaviour. It is a statement that an operator is subject to a particular set of rules and a particular complaints route. The rules differ, and so does what a player can expect when something goes wrong.

Regulator	What it covers	What it will not do
UK Gambling Commission	Operators serving Great Britain. Requires segregation of player funds at one of three protection levels, published complaints procedure, and participation in an alternative dispute resolution (ADR) scheme.	Recover money for you directly. It supervises the operator; disputes go to the ADR provider named in the operator’s terms.
Malta Gaming Authority	Operators licensed in Malta, often serving multiple countries. Publishes licence status and a list of approved domains.	Resolve a dispute about a bet outcome. It expects the operator’s own complaints process first, then its own.
Gibraltar, Isle of Man, Alderney	Smaller jurisdictions with their own rules, often used by operators serving markets outside the UK.	Provide the same player-funds protection as the UK unless the licence says so. Read the specific licence conditions.
Curaçao (formerly Netherlands Antilles)	A large number of internationally facing operators. Historically lighter on player-protection conditions than the UK or Malta.	Enforce player-funds segregation or ADR in the way the UK does. The licence is real; the protections attached to it are thinner.
State regulators in the US (for example, New Jersey, Pennsylvania, Michigan)	Operators licensed in that state, usually tied to a land-based casino or a tribal operator.	Cover players outside that state. The licence is state-specific.

A licence from a strict regulator is not a rating. It is a condition. Two operators can hold the same licence and treat players very differently. The register tells you the licence is real; the terms and the measured payout record tell you what the operator does with it.

The clauses that decide whether a payout is real

A withdrawal time is not a property of a casino. It is a property of a casino, a payment method, a verification status and a date. “Fast withdrawals” in a banner is not a figure. A figure looks like: “measured on 14 March 2025, a £200 card withdrawal after full verification, from request to funds visible, took 26 hours.” If a site cannot state the method, the amount, the verification state and the date, it does not have a measured withdrawal time. It has a claim.

The clauses below are where a payout that looks fine on the cashier page turns into a payout that does not arrive.

Clause	What to look for	Why it changes the figure
Maximum conversion from bonus to cash	A cap on how much of a bonus win becomes withdrawable. Often 2x to 10x the bonus, sometimes a flat amount.	A 100 bonus with a 5x conversion cap means at most 500 leaves the bonus balance, however large the win.
Maximum bet while a bonus is active	Often 5 or 10 per spin or per hand.	Breaching it can void the bonus and any winnings from it. The rule is in the terms, not the banner.
Dormancy and inactivity fees	A monthly charge after a set period of no login, often 12 months, sometimes less.	A balance of 40 can be reduced to zero by a 5 monthly fee over eight months.
Withdrawal limits	A maximum per transaction, per day, per week or per month.	A 10,000 win with a 2,000 weekly cap takes five weeks to leave, if nothing else changes.
Payment method restrictions	Some methods are excluded from bonus play or from withdrawals.	A deposit by one method and a withdrawal by another can trigger extra checks or a different timeline.
Verification timing	Whether ID is checked at deposit or at withdrawal.	A casino that verifies at withdrawal adds days to the first payout, not the last.

Read the terms before depositing, not after winning. The clauses that matter are the ones that only bite when a balance is large.

A worked example: what a bonus cap does to a win

Suppose an operator offers a 100% deposit bonus up to 100, with a 30x wagering requirement on the bonus, a 5x maximum conversion, and a 5 maximum bet while the bonus is active.

Step 1. Deposit 100. Bonus is 100. Bonus balance is 100.

Step 2. Wagering requirement is 30 x 100 = 3,000 in total bets before any bonus funds convert to cash.

Step 3. Suppose the player runs well and the balance reaches 1,200 after meeting the requirement. The maximum conversion is 5 x 100 = 500. So 500 becomes withdrawable cash, and the remaining 700 is removed from the bonus balance.

Step 4. If any single bet during the wagering exceeded 5, the operator’s terms may void the bonus and any winnings from it. The 500 is not guaranteed by the arithmetic; it is conditional on the bet-size rule having been kept.

Step 5. If the player withdraws 500 by card and the operator’s published card timeline is 1 to 3 working days after a 24-hour internal review, the realistic arrival is 2 to 4 working days from the request, assuming verification is already complete.

The advertised “up to 100 bonus” is real. The advertised “win 1,200” is not, because the conversion cap sits between the two. That is not a trick unique to rogue operators. It is a term, and it is in the terms.

What people get wrong, and why

The most common mistake is treating a licence as a rating. A licence is a condition, not a score. A Curaçao-licensed operator can pay every withdrawal on time for years. A UK-licensed operator can be slow, and the UK Gambling Commission publishes its regulatory decisions, including fines and licence reviews, so the record is public. The mistake is natural because a licence number looks like a seal of approval, and seals are designed to end thought rather than start it.

The second mistake is reading the bonus headline and not the conversion cap. The headline is written to be read. The cap is written to be found. A reader who has never had a large win has never had a reason to look for it, so the omission feels like a discovery rather than a gap in the reading.

The third mistake is assuming a fast withdrawal time is a property of the operator. It is a property of the operator, the payment method, the verification state and the date. A card withdrawal and a bank transfer from the same account on the same day can differ by days. A first withdrawal from an unverified account can differ from a tenth from a verified one by a week.

The fourth mistake is searching for a blacklist and treating its absence as a clean bill of health. Blacklists are incomplete by construction. A regulator’s decisions page is more useful, because it records what an operator was actually penalised for, with dates. If a regulator has fined an operator for misleading promotions or for failing to segregate player funds, that is a fact with a source. A blacklist entry without a source is a rumour with a font.

What a casino cannot tell you about itself

No casino can tell you whether it is safe in the sense of covering every risk. A licence does not cover the risk that the operator’s parent company becomes insolvent. Player-funds segregation, where it applies, reduces that risk but does not remove it, and the level of protection differs by licence. A UK licence requires one of three protection levels, and the operator must state which one it uses. That statement is checkable. “Your funds are safe” is not.

No casino can tell you that its RTP is the same as another casino’s for the same game. The same slot ships at several RTP settings, and the version matters. If a site publishes an RTP without the game version and the jurisdiction, the figure is not usable. If it publishes no RTP at all, the honest entry is “not published”.

No casino can tell you that a withdrawal time is fast without a date. A time without a date is a memory, not a measurement.

The checks, in order

Regulator’s register: licence number, legal name, status, domains. Five minutes.
Terms: maximum conversion, maximum bet while a bonus is active, dormancy fee, withdrawal limits, verification timing. Fifteen minutes.
Regulator’s decisions page: search the operating company’s name. Five minutes.
Payment method: what the operator publishes for that method, and whether the figure carries a date. Two minutes.
If any of the above is missing, treat the missing item as the answer. A legit online casino publishes its licence, its terms and its complaints route. A rogue one publishes the first and hopes you stop there.

The legal position differs by jurisdiction, and the age at which you may gamble differs too. Check both before depositing anywhere. If gambling is causing harm, the helplines above are free and independent.

How to Tell a Legitimate Casino from a Rogue One