The UAE commercial-gaming sector is no longer accurately described by a simple statement that gambling is prohibited. The current legal position is more precise: specified commercial-gaming activities can operate within a federal licensing and supervisory framework administered by the General Commercial Gaming Regulatory Authority (GCGRA), while gaming conducted, supplied or facilitated outside that authorised framework remains illegal.
The GCGRA identifies its founding legislation as Federal Law by Decree No. 30 of 2022 on Regulating Commercial Gaming. The Authority has exclusive federal jurisdiction to regulate, license and supervise commercial gaming in the UAE and has developed an expanding body of licensing requirements, executing regulations, responsible-gaming controls, advertising standards, financial-crime expectations and technical standards.
The framework is deliberately wider than casino operators. It reaches internet gaming, sports wagering, lottery activity, land-based gaming facilities, gaming-related vendors, key corporate controllers, senior individuals and gaming employees. The GCGRA also warns that third parties providing products or services to unlicensed gaming businesses can face legal consequences.
For investors and suppliers, the most important practical principle is therefore: identify the regulated activity first, then map every entity, person, technology provider and commercial relationship that may require GCGRA licensing, approval or certification before operations begin.
What activities does the GCGRA regulate?
The GCGRA currently identifies four principal categories of commercial-gaming activity:
- lottery;
- internet gaming;
- sports wagering; and
- land-based gaming facilities or integrated gaming resorts.
The internet-gaming category is broad. GCGRA materials expressly refer to online casino games as well as bingo, poker, peer-to-peer games, eSports, fantasy games and skill-based games where the applicable commercial-gaming elements are present.
This matters for technology businesses. Describing a product as “skill-based”, “fantasy”, “social”, “eSports” or “entertainment” does not by itself determine whether the product falls outside commercial-gaming regulation. The mechanics, stake, prize structure and role of chance and skill must be analysed.
Promotional activity is not automatically commercial gaming
The GCGRA separately recognises genuine promotional activity and states that it does not license or regulate an activity merely because a marketing promotion includes a prize.
Its published guidance focuses on substance. A legitimate promotion should have a real marketing objective; where a purchase is required, the product or service should be sold at fair market value; and the prize should operate as a marketing expense rather than as the source of gaming revenue.
By contrast, inflating the price of a product so that customers are effectively purchasing a chance to win can shift a promotion toward lottery or commercial-gaming territory.
Businesses planning prize draws, purchase-linked promotions, loyalty mechanics, paid-entry contests or gamified campaigns should therefore obtain a regulatory classification before assuming that ordinary promotional approval is sufficient.
The GCGRA is the sole commercial-gaming licensing authority
The GCGRA states that it is the sole competent authority to issue commercial-gaming licences in the UAE.
A party wishing to conduct business in commercial gaming must obtain the relevant GCGRA licence before commencing regulated activity. Depending on the activity and location, other local licences, permits and approvals may also be required, but an ordinary corporate or trade licence does not replace GCGRA authorisation.
The licensing requirement extends beyond the entity taking bets. GCGRA's public guidance expressly covers operators, individuals employed by or participating in regulated gaming businesses and third parties providing related products or services.
Five principal licence categories
| Licence category | Typical regulated role |
|---|---|
| Gaming Operator | Internet gaming, sports wagering, land-based gaming facilities, lottery operators and lottery retailers. |
| Gaming-Related Vendor | Suppliers of gaming equipment or other gaming-related goods and services. |
| Key Person — Corporate | Corporate controllers, affiliates, management service providers and other entities with material decision-making roles in the ownership or management structure. |
| Key Person — Individual | Directors, executive officers, controllers and other individuals exercising material decision-making authority. |
| Gaming Employee | Individuals working for or otherwise connected with licensed gaming activity where the regulatory framework requires individual licensing. |
A group may require more than one licence. The operating company may need an operator licence while a parent, controller or management-services entity may separately require corporate key-person treatment, and designated executives may require individual approval.
The licensing process begins before the formal application
The GCGRA uses a controlled licensing process rather than an open filing system where any applicant simply uploads forms and waits for approval.
The published process begins with preliminary contact and screening. The applicant identifies the licence category and provides basic information. If the GCGRA considers the party eligible to proceed, the applicant is given access to the licensing portal and invited to submit the full application.
The full review examines eligibility, integrity, suitability and operational capability. Business plans and compliance strategies form part of the preparation process, and licensing is followed by periodic reporting and continuing supervision.
A commercial-gaming licence should therefore be approached as an ongoing regulatory relationship rather than a one-time market-entry permit.
Suitability extends beyond the operating subsidiary
The GCGRA's licence categories expressly include corporate and individual key persons. This means investors, controllers, directors, senior officers, affiliates and management-service providers can become part of the suitability analysis.
Before an application, the group should map:
- direct and indirect shareholders;
- ultimate beneficial owners;
- controllers and voting arrangements;
- board members;
- senior management;
- management-service companies;
- material affiliates;
- financing sources; and
- persons with the practical ability to direct the gaming business.
A later change in ownership or control should also be reviewed for regulatory approval requirements before implementation.
Vendor licensing is a major part of the UAE model
The UAE framework does not allow an operator to solve regulatory risk merely by outsourcing important functions.
The GCGRA defines Gaming-Related Vendors as suppliers of gaming equipment or related goods and services, and its public register now includes a significant number of technology, equipment, platform and specialist suppliers.
Depending on the service, vendor-regulation questions can arise for businesses involved in areas such as:
- gaming machines and equipment;
- lottery technology;
- online gaming platforms;
- game content;
- sports data and wagering technology;
- geolocation;
- random-number generation;
- monitoring and control systems;
- cashless gaming systems;
- player-account systems;
- testing and certification; and
- other operational technology directly connected to gaming activity.
Whether a particular supplier requires a Gaming-Related Vendor licence should be confirmed with the GCGRA based on the actual service rather than assumed from the supplier's description of itself as a general technology company.
Do not supply an unlicensed operator
The GCGRA expressly identifies vendor risk in the unregulated market. Its guidance warns that supplying unlicensed operators can create legal and licensing consequences for vendors.
A vendor entering the UAE market should therefore conduct operator due diligence before signing or activating a contract.
At a minimum, the vendor should verify:
- the legal name of the operator;
- the specific GCGRA licence held;
- whether the licence covers the intended activity;
- the approved website, platform or venue where relevant;
- whether the contract would extend into unlicensed gaming activity; and
- whether the vendor's own licence authorises the products or services being supplied.
A licence issued in another country is not a substitute for UAE authorisation.
The public licence register is now a central due-diligence tool
The GCGRA publishes a current list of licensees across lottery, land-based gaming, gaming-related vendors, internet gaming and sports wagering.
As of the current 2026 register, the list includes The Game LLC as the UAE Lottery operator, Island 3 AMI FZ-LLC doing business as Wynn Al Marjan as a land-based gaming-facility licensee, Coin Technology Projects LLC in the internet-gaming and sports-wagering categories, and a growing list of Gaming-Related Vendors.
The register should be checked at the time of contracting because licence status, vendor lists and authorised market participants can change.
Technical certification is separate from corporate licensing
Holding a Gaming-Related Vendor or operator licence does not mean every gaming product can be deployed without technical assessment.
The GCGRA publishes technical standards based on the GLI standard series for areas including gaming devices, progressive systems, monitoring and control systems, lottery systems, cashless systems, promotional systems, interactive gaming systems, kiosks, client-server systems, electronic table games, wireless systems, player interfaces, card shufflers and event-wagering systems.
The GCGRA also maintains a list of approved independent testing laboratories and other certified service providers.
Operators and vendors should therefore distinguish three questions:
- Is the entity licensed?
- Is the particular gaming product or system technically compliant and appropriately certified?
- Has the operator obtained any activity-specific approval required before deployment?
Interactive gaming requires robust location control
Remote gaming creates a particular regulatory challenge because a licensed platform may be accessible from outside the territory or from locations where wagering is not authorised.
The GCGRA-adopted technical standards for interactive and event-wagering systems contain controls for player-location detection and for detecting attempts to defeat geolocation through tools such as remote-desktop software, virtualisation or false-location applications.
For an online operator, geolocation should therefore be treated as a regulated control rather than a convenience feature.
Responsible gaming is a licensing obligation
The GCGRA treats Responsible Gaming as a core element of licensed operations.
Gaming operators must establish a Socially Responsible Gaming Program aligned with the GCGRA Responsible Gaming Framework. Current GCGRA guidance requires that programme to be audited at least every two years by a GCGRA-approved auditor.
The programme includes player education, responsible marketing, employee training, evaluation of effectiveness, player-protection tools and support for persons experiencing gaming-related harm.
The operator must also identify a person or persons responsible for maintaining the programme.
Player-protection tools must be built into the product
Responsible gaming is not satisfied by placing a short disclaimer at the bottom of a website.
The GCGRA requires operators to provide player-empowerment tools such as:
- deposit limits;
- time and money management tools;
- access-control measures;
- cooling-off mechanisms;
- self-monitoring capabilities; and
- self-exclusion options.
Operators must also provide information about odds, gaming risks and the resources available to players who require support.
Self-exclusion affects both access and marketing
Voluntary self-exclusion is a formal player-protection mechanism rather than an ordinary marketing unsubscribe request.
Advertising controls require operators to exclude self-excluded and involuntarily excluded players from direct marketing. An operator should ensure exclusion information propagates across player-account systems, land-based access systems, marketing databases, affiliate partners and customer-support tools.
Age controls differ between lottery and other gaming
The GCGRA Advertising Standards define an underage person as a person under 18 years for lottery-related activities and under 21 years for all other forms of commercial gaming.
Advertising must expressly address the prohibition on underage participation and must not be directed at, or have primary appeal to, underage persons. Digital platforms are expected to use appropriate age-verification and targeting controls to minimise youth exposure.
Operators should reflect age restrictions consistently in account creation, identity verification, venue access, advertising audiences, affiliate terms and promotional eligibility.
Gaming advertising is separately regulated
The GCGRA Advertising Standards supplement the advertising chapter of the Executing Regulations and apply minimum standards to operator marketing.
Advertising must be clear and not misleading. It must not overstate the likelihood of winning or portray gaming as a solution to financial difficulty, personal hardship or unemployment.
Promotional bonuses and inducements require transparent terms and conditions, including material restrictions such as eligibility, wagering requirements, minimum deposits, time limits, game contribution rules, winnings caps and maximum-bet limits where applicable.
Direct marketing requires opt-in and effective opt-out
The Advertising Standards require direct marketing to be based on affirmative consent or another express opt-in mechanism.
Recipients must be given a clear way to opt out of future advertising, and operators are required to act on an opt-out request within the prescribed period.
Social-media direct messages are subject to the same underlying principle: consent cannot be assumed merely because a person created an account for another purpose.
Operators remain responsible for advertising partners
Outsourcing marketing does not outsource regulatory responsibility.
The GCGRA Advertising Standards make operators responsible for the compliance of third parties engaged for advertising. Operators must also ensure that their advertising partners are not involved in promoting or facilitating unlicensed online gaming targeting players in the UAE.
This is particularly relevant for media agencies, affiliates, influencers, sports sponsorship agencies, CRM providers, comparison websites and digital advertising networks.
Advertising contracts should therefore contain regulatory warranties, audit rights, content-approval processes and immediate termination rights for gaming-compliance breaches.
Sponsorship is permitted but controlled
The GCGRA Advertising Standards recognise commercial-gaming sponsorship, including sports teams, eSports teams, ambassadors, stadiums, press conferences and global brand partnerships.
However, sponsorship must comply with responsible-advertising requirements. Product placement is restricted, sponsorship of underage persons is prohibited and activities primarily attractive to underage or vulnerable persons are unsuitable for gaming sponsorship.
Financial crime prevention is a core licensing issue
Commercial gaming can create financial-crime risks because operators receive and return large numbers of customer payments, may process high-value transactions and can be exposed to attempts to disguise the source or movement of funds.
The GCGRA is the competent authority for financial-crime prevention in the commercial-gaming sector and expects licensees to maintain systems including:
- periodic financial-crime risk assessments;
- appropriate policies and governance;
- player due diligence;
- enhanced due diligence for higher-risk relationships where required;
- transaction monitoring;
- suspicious transaction and activity reporting; and
- regulatory reporting and ongoing remediation.
The GCGRA's 2025 Commercial Gaming Policy Paper, issued jointly with the UAE national AML/CFT committee, also emphasises coordination among the GCGRA, law enforcement, the Financial Intelligence Unit and other authorities.
Payments should be designed for traceability
A compliant gaming-payment system should be capable of linking deposits, wagers, wins, withdrawals and suspicious activity to a verified player account.
Operators should assess risks associated with multiple payment instruments, third-party funding of accounts, unusual deposit-and-withdrawal patterns, rapid movement of funds with little gaming activity, higher-risk customers, chargebacks, cross-border payment flows and emerging payment methods.
Responsible gaming and AML controls should also be coordinated. The same behavioural data can sometimes indicate both harmful gaming and unusual financial activity, although each issue requires its own legal analysis.
Licence compliance continues after launch
The GCGRA applies risk-based supervision after licensing.
It may investigate suspected breaches and take administrative action for failure to meet legal or regulatory requirements, misrepresentation or significant omissions, fraudulent activity, failure to cooperate with the GCGRA, and failure to comply with GCGRA orders or settlements.
Available administrative responses include denial, suspension, revocation, restriction or conditioning of licences, monetary fines and other regulatory measures.
Unlicensed activity creates criminal as well as regulatory risk
The GCGRA repeatedly warns that engaging in, operating or facilitating commercial gaming without a valid licence is unlawful and can lead to severe penalties, including criminal penalties.
The risk is not confined to the operator. The regulator states that unlicensed activity can expose commercial-gaming operators, individuals working for or participating in the activity, third parties supplying products or services, vendors serving unlicensed gaming businesses and players who participate through unlicensed operators.
For investors and counterparties, this makes licence verification a transaction-critical issue.
An overseas gaming licence does not authorise UAE activity
A platform may hold licences in Europe, North America or another gaming jurisdiction and still have no authority to accept UAE players.
The GCGRA's framework is territorial and federal. An overseas licence can be relevant to an applicant's regulatory history and experience but does not replace UAE authorisation.
Current market authorisation is activity-specific
The existence of licensed activity in the UAE does not amount to a general legalisation of every gaming business model.
| Question | Compliance significance |
|---|---|
| What is the product? | Lottery, internet gaming, sports wagering, land-based gaming or genuine promotion? |
| Who operates it? | The legal operator should hold the correct GCGRA licence. |
| Who supplies it? | Gaming-related technology or services may require vendor licensing. |
| Who controls the group? | Corporate and individual key-person licensing may be required. |
| Is the technology certified? | Relevant systems may need testing under GCGRA-adopted technical standards. |
| Are players protected? | Responsible-gaming, age, self-exclusion and marketing controls must be operational. |
| Are payments controlled? | AML/CFT, due-diligence and monitoring requirements apply. |
| Is the activity still within licence scope? | A new product, supplier, control change or channel may require prior regulatory review. |
Practical checklist for operators
- Classify the activity. Obtain regulatory clarity before designing the corporate structure around a product.
- Map all licences. Operator, vendor, key corporate, key individual and gaming-employee requirements should be reviewed together.
- Complete ownership diligence early. Suitability review can extend through the control structure.
- Choose vendors carefully. Verify that each regulated supplier holds the appropriate UAE status.
- Certify the technology. Map each system against the applicable GCGRA technical standards.
- Design responsible gaming into the platform. Deposit limits, self-exclusion, time and money tools and player education should not be post-launch additions.
- Build age and access controls. Apply the correct lottery and non-lottery age restrictions.
- Control marketing. Review bonuses, direct marketing, sponsorships, affiliates and social-media targeting under the GCGRA Advertising Standards.
- Build financial-crime systems. Risk assessment, customer due diligence, monitoring and reporting should be operational before accepting players.
- Plan regulatory reporting. Assign responsible owners for ongoing GCGRA submissions and licence conditions.
- Govern change. Products, ownership, key personnel, technology and vendors should pass through a regulatory-change process before implementation.
- Audit continuously. Licensing is the beginning of supervision, not the end.
Practical checklist for gaming-related vendors
- Confirm whether the service is gaming-related. Do not rely on a generic technology or consultancy label.
- Verify the customer. Check the operator against the current GCGRA register.
- Confirm your own licence scope. A vendor licence should match the goods and services supplied.
- Identify product-certification requirements. Entity approval and technical approval are separate issues.
- Review subcontractors. Hosting, data, testing, marketing and other downstream providers may create regulatory dependencies.
- Protect against unlicensed use. Contracts should restrict use of the product for unauthorised UAE gaming.
- Maintain audit records. Preserve deployment, certification, change-management and customer records.
- Escalate material changes. New functionality can change the regulatory classification of the service.
Key takeaway
The UAE now has a functioning federal commercial-gaming regulatory market, but legal gaming exists only inside the GCGRA framework. Federal Law by Decree No. 30 of 2022 provides the foundation, while the GCGRA controls licensing, supervision, responsible gaming, financial-crime prevention, advertising and technical integrity.
The licensing perimeter is intentionally broad. Operators, vendors, controlling companies, senior individuals and gaming employees can each require regulatory approval. A commercial-gaming business should therefore map its entire operating ecosystem rather than focus only on the consumer-facing operator.
Responsible gaming is equally central. Operators must maintain structured programmes, provide player-control tools, respect age and self-exclusion requirements, market responsibly and undergo continuing review. Technical systems must satisfy applicable certification standards, while financial-crime controls require player due diligence, transaction monitoring and suspicious-activity reporting.
Enforcement risk remains significant. The GCGRA can investigate, fine, suspend, restrict or revoke licences, and unlicensed commercial gaming or facilitation can lead to criminal action. Serving an unlicensed operator can also expose vendors and other third parties.
HZ Legal can assist gaming operators, technology companies, vendors, investors, hospitality groups, sports businesses and service providers with UAE commercial-gaming licensing strategy, vendor classification, key-person approvals, responsible-gaming policies, advertising and sponsorship review, AML/FCP compliance, technology and outsourcing contracts, regulatory due diligence and enforcement matters.
Official and authoritative sources
- GCGRA — Legislation and Federal Law by Decree No. 30 of 2022 on Regulating Commercial Gaming.
- GCGRA — Commercial Gaming Licensing.
- GCGRA — Licence Types.
- GCGRA — Licensing Process.
- GCGRA — Current Commercial Gaming Licensees.
- GCGRA — Activities We Regulate.
- GCGRA — Commercial Gaming and Promotional Activities.
- GCGRA — Responsible Gaming Compliance.
- GCGRA — Advertising and Technical Standards.
- GCGRA — Financial Crime Prevention.
- GCGRA — Supervision and Investigations.
- GCGRA — Certified Service Providers.
This article provides general legal and regulatory information only and does not constitute legal, financial, gaming or investment advice. The GCGRA framework is developing and licence conditions, technical requirements, approved suppliers and market participants can change. A proposed operator, vendor, game, promotion, advertising campaign, ownership transaction or technology deployment should be checked against the current GCGRA requirements before launch or implementation.