How to start an online poker site
in 2026, licence first.

The first decision is not which software to buy. It is what your players will play for, and where they are. Real-money poker is licensed market by market. Play money — chips with no cash value — is usually treated as social gaming, although app stores, advertising codes and some regulators still reach it. Many operators run both: play money where they hold no licence, real money where they do.

Write the decision down as a table of countries, states and provinces, each marked real money, play money or closed. That table drives everything after it: the licences you apply for, the payment and identity vendors you contract, where your servers sit and which games each lobby may show. Every regulator you apply to will ask which other markets you serve, and how you keep out the players you may not take.

Play money is not always outside the rules. In Great Britain a remote licensee has to verify a customer's age before the customer can reach even the free-to-play versions of its gambling games. A play-money funnel inside a British-licensed brand therefore starts with an age check, not after one.

PokerEnginePro runs play money and real money on the same platform and the same double-entry ledger, as separate currencies that can never convert into each other. Real money is opt-in, country by country: a market takes real money only when the operator assigns it a real-money rule pack, a country nobody assigned gets play money, and a market the operator closes refuses even play money.^[3]

Online poker is regulated as peer-to-peer gaming: players play each other and the operator earns rake, never a house edge. Most regulators license it alongside casino games, with extra conditions for networks and shared player pools. The next three sections summarise what an operator needs in the markets most launches consider. Each point comes from the regulator's own pages or the law itself, and each will have moved on in detail by the time you apply. Take it to counsel: it is general information, not legal advice.

PokerEnginePro carries each market's rules as a signed rule pack — ages, limits, self-exclusion registers, games, payment methods and verification tiers — with 22 packs today, held to their rules by 503 scenario tests. The packs are drafted from public sources. In production a pack carries real money only once it has been reviewed, by the licensee's counsel or by its compliance officer with a second approver, and the platform generates the MGA's and the UKGC's periodic returns. The licence always stays with the operator.

Great Britain. Poker sits under the Gambling Commission's remote casino operating licence, which covers poker, roulette, blackjack and slots. The application fee is banded by gross gambling yield, from £8,185 below £250,000 to £165,069 above £1.6 billion. A licensee that runs peer-to-peer games with players outside Britain must make sure each of them contracts with a licensed operator or an approved provider, and must agree with its partners who handles which complaints and how they share information on money laundering, cheating and problem gambling.

Malta. The Malta Gaming Authority issues a single B2C gaming service licence and sorts games into four types. Peer-to-peer poker is Type 3: games not played against the house, where the operator earns a commission or other charge on the stakes or the prize. The authority lists a €5,000 application fee, a €25,000 annual licence fee and a gaming tax of 5% of gaming revenue.

Curaçao. The National Ordinance on Games of Chance (LOK) came into force on 24 December 2024 and replaced the old regime. The master licence system, under which operators traded on a sub-licence from a master holder, was abolished; operators now hold their own licence from the Curaçao Gaming Authority, and existing licensees had to reapply. Fees reported in October 2025 put a B2C licence at US$55,000 a year: a US$28,400 licence fee and a US$26,600 supervisory fee.

United States. Online poker is legal state by state, and each state ties it to land-based casinos. New Jersey grants Internet gaming permits to its Atlantic City casino licensees, licenses the vendors that serve them, and has every game approved by its Technical Services Bureau. Pennsylvania issues peer-to-peer interactive gaming certificates to casino licensees and qualified gaming entities, and licenses whoever runs the site for them as an interactive gaming operator — $1,000,000 for the first five-year term. Michigan grants one internet gaming operator licence per commercial casino licensee or tribe running class III gaming, licenses platform providers as internet gaming suppliers, and requires players to be 21 and located in the state.

Six states pool poker players under the Multi-State Internet Gaming Agreement: Nevada, Delaware, New Jersey, Michigan, West Virginia and, since April 2025, Pennsylvania. Shared tables across them still need each state regulator's approval.

Ontario. An operator registers with the Alcohol and Gaming Commission of Ontario (AGCO) as an internet gaming operator, then signs an operating agreement with iGaming Ontario. Games and critical systems must be certified by a testing laboratory registered with the AGCO, and suppliers — platform providers included — register too. Ontario poker is ring-fenced today. The Ontario Court of Appeal found in November 2025 that pooling with players abroad can be lawful under the province's model; provincial lottery corporations appealed, and the Supreme Court of Canada scheduled the hearing for 7 October 2026.

Africa's rules are moving fast, and often away from a single national licence. Nigeria's Supreme Court ruled in November 2024 that the states, not the federal legislature, regulate lotteries and gaming, which puts operators in front of state regulators such as Lagos's. Kenya's Gambling Control Act 2025, in force since 26 August 2025, replaced the Betting Control and Licensing Board with a Gambling Regulatory Authority, created separate online licences, and requires at least 30% of an applicant's shares to be held by Kenyan citizens and an approved gambling control system.

PokerEnginePro carries real-money packs for Lagos State, Kenya and Ghana, in naira, shillings and cedis, and a play-money pack for the other African countries until a licensee holds the country's licence. Real money opens one country at a time, by the operator's choice, never by default.^[28][29]

Four models cover almost every launch. They differ less in features than in who holds the licence, who owns the player data and who decides the room's rules.

Whichever model you choose, the platform has to answer to a regulator, not just to players. Judge it on what the regulator and the laboratory will ask: can every chip be traced, can every hand be replayed, can a market's rules be changed without a new release, can staff be stopped from seeing hole cards, and can the room run where the regulator wants it to run.

Two questions settle most choices between the models. Does a regulator want your servers in its territory? And do you want your player accounts, balances and history in a database you own, so the room outlives any vendor relationship?

PokerEnginePro is licensed as a whole platform: engine, games, tournaments, ledger, back office and compliance. It installs from one Helm chart on any Kubernetes cluster — your cloud or your data centre — and a whole room also runs on a single machine for a first market. Where a regulator wants the tables in its territory, a deployment per jurisdiction comes from the same chart, and real money plays only on the one hosted there. Every query carries the operator's tenant, a player's whole record exports in one audited step, and not even a SuperAdmin can see hole cards in a live hand. A hosted white-label service is on the roadmap.

Before real money, regulators want an independent laboratory's word that the random number generator is unpredictable and unbiased, and that every game plays as its rules say. In Great Britain, new games and RNGs can be released only once testing is complete and the report has gone to the Commission, and third-party testing must be done by an approved test house — the list includes GLI, BMM, eCOGRA and others. Ontario requires games and critical systems to be certified by a laboratory the AGCO has registered.

The most widely used benchmark for online systems is GLI-19, Gaming Laboratories International's standard for interactive gaming systems, now at version 3.0. A laboratory working to it looks well beyond the shuffle, and the certificate it issues covers one specific build.

PokerEnginePro is built for GLI-19, and its certification kit is ready: a GLI-19 traceability matrix, game rules for 14 variants, an RNG sample harness, the build manifest, the critical-files list, change control and a test plan for the laboratory. Every real-money deck is drawn from the operating system's CSPRNG with a salted commitment published before the first card, which players can check in their own browser once the hand ends, and an RNG log records each shuffle for the lab. The certificate itself comes from the laboratory, for the operator's build: the platform is not certified yet.

In practice, a laboratory asks about three things:

A licensed room must know who each player is, how old they are, where they are, and whose money they play with. In Great Britain a remote licensee verifies age before a customer can deposit, reach free-to-play versions of its games or gamble. The UK's money-laundering regulations apply customer due diligence to the customers of remote casinos as well as land-based ones. In Michigan the law requires operators to use technology that reasonably verifies a player is 21 or over and located in the state.

PokerEnginePro integrates Sumsub, Onfido, GBG and LexisNexis for identity, ComplyAdvantage and OpenSanctions for screening, and GeoComply, Xpoint, MaxMind and IPQualityScore for location, with the operator holding each contract. Verification runs in four tiers set by each market's pack. Enhanced due diligence triggers on a PEP or partial sanctions match, a high-risk country or a threshold such as £5,000 in 30 days in Great Britain, and document images stay with the vendor. A failed device re-check sits the player out after the hand in play. When a location service, a screening or a register cannot answer, real money stops while play money carries on. Poker's own risks — chip dumping, soft play, team play, multi-accounting and bots — are flagged and worked as cases in one integrity queue. Only the money-laundering reporting officer decides that an AML case is reported, and report drafts come as goAML XML for the UK's National Crime Agency and Malta's FIAU.

Operators assemble these checks from specialist vendors, and most run two of each critical kind so that one outage does not stop sign-ups:

Payments are where many launches stall. Card acquirers, e-wallets and pay-by-bank providers that accept gambling will ask for your licence before they onboard you, and the methods they support differ market by market. Contract at least two, so a declined acquirer does not close the cashier.

Market rules shape the cashier. Great Britain has banned gambling on credit cards since 14 April 2020. A British licensee that holds customer funds must keep them in a separate client bank account. Withdrawals are normally closed loop — paid back to the method the money came from — which shuts one of the simplest laundering routes, and finance needs a daily reconciliation of what each processor settled against what the ledger says.

Crypto belongs only where the licence allows it, and only with the same identity, screening and closed-loop rules as any other method.

PokerEnginePro takes cards, e-wallets, prepaid and pay-by-bank through Nuvei, Paysafe and Trustly's hosted pages, so card data never touches the platform. Withdrawals go back the way the money came and wait in a hold account while they are reviewed; above €2,000, £1,750, $2,200 or C$3,000 a second approver signs. Every movement is a balanced double-entry entry, reconciled every night, with a segregated player-funds statement and settlement reconciliation against each processor. A chargeback that leaves a negative balance restricts real money at once and opens a case for finance. Stablecoin deposits and withdrawals run closed loop with every address screened on chain, and crypto is a rule of each market's pack: on in Curaçao, off by default in Malta, never in Great Britain, the US states or Ontario.^[5][6]

Safer-gambling tools are licence conditions, not marketing. Great Britain's technical standards require financial limits a customer can set from registration, with a prompt to set one at registration or at the first deposit. Reductions apply at once; increases only after a cooling-off period of at least 24 hours and a positive confirmation. Limits must cover 24 hours, 7 days and a month. Customers must also be able to set a reality check — a display of the time elapsed — which they acknowledge before it leaves the screen.

Malta makes deposit or wagering limits, reality checks and self-exclusion, for a definite or indefinite period, mandatory for its licensees. National registers extend self-exclusion across operators: taking part in GAMSTOP has been a condition of every British online licence since 31 March 2020, and the Commission suspended two operators' licences for missing that deadline.

Poker adds its own wrinkle. A player at a cash table or deep in a tournament affects everyone else at the table, so the platform has to decide exactly where a limit, a break or an exclusion bites: before a seat, at a rebuy or add-on, at a tournament entry.

PokerEnginePro enforces deposit, loss and wager limits and session length at each market's settings, counted from the ledger. A raised limit waits for the market's delay — 24 hours in Great Britain, 72 in the US states — and then for the player to confirm it; where a market requires it, limits are chosen before the first real-money play. Reality checks at the market's interval stop new seats until acknowledged, and the market's help services are offered in the player's own language. GAMSTOP, Spelpaus, ROFUS, OASIS, RGIAJ, CRUKS, BetStop and six US state lists are checked before real money beside the operator's own list, and every rule is checked at the gateway and again inside the table and the tournament.^{[7][8][14][4]}

Poker is the one casino product that needs other players. A room with empty tables loses the players it paid to acquire, which is why networks exist. Joining one buys traffic and costs control; standing alone keeps control and makes liquidity your problem. Networks also change under you: the Microgaming Poker Network closed in 2020, and in 2026 the PokerStars Network opened its pool to outside operators.

Shared liquidity is itself regulated. Michigan's law lets its board join interstate poker agreements only within the United States, and Ontario's international pooling waits on the courts.

PokerEnginePro gives a standalone room the levers below: Sit & Go lines and scheduled tournaments with guarantees, overlay and satellites paid in tickets; a social casino with daily chips, missions and rewarded ads on the play-money side; and games switched on per market. It does not share liquidity across operators. Each operator runs its own pool; pools across regions and networks between operators are on the roadmap.

A standalone room should plan to fill its own tables:

Published figures for launching a poker site are scarce, and most come from vendors with something to sell. Treat every number below as an outside estimate, attributed to whoever published it, and build your own budget from quotes. The regulators' fees are the only firm numbers.

On timing, the licence usually sets the pace. A white label can open in weeks, but only under a licence that already exists. A room under your own licence waits for the regulator's review, the laboratory's testing, payment onboarding and vendor sandboxes. They run in parallel and finish at the speed of the slowest, so give the laboratory the build it will certify while the regulator is still reviewing the application. One vendor puts building a platform in-house at €1.5M or more and 18–24 months.

PokerEnginePro is a platform licence, self-hosted or hosted; talk to us for a quote. Because a whole room runs on one machine, a first market does not need a cluster on day one.

PokerEnginePro covers the platform side of most lines below: rule packs, vendor adapters, the ledger, eleven back-office roles, four-eyes approval, a hash-chained audit log anchored on write-once storage, an MLRO role and the MGA's and the UKGC's returns. The licence, the vendor contracts and the people stay with the operator.

Before the first real-money hand, an operator should be able to tick every line: