How to Tell If an Online Casino Is Legitimate: A 7-Point Checklist

Anyone can build a website, put a roulette wheel on it and call it a casino. Telling the difference between a legitimate online casino and an operation that will happily take your deposit and never process a withdrawal is a skill — and it takes about ten minutes per site once you know where to look.

This is the checklist we run on every casino before it gets a review on CasinoCrypto.app. Nothing here requires special tools or insider access: every single check below is something you can do yourself, from the outside, before you deposit a cent.

The shortcut: remove the risk instead of checking for it

Before the seven checks, the one thing worth knowing: every check on this list exists for a single reason — the casino is holding your money. Your deposit, your balance and your winnings all sit in someone else’s ledger, and the whole list below is you trying to work out from the outside whether they will hand it back.

There is a category that removes the premise instead of testing it. On a self-custody platform your balance never leaves your own wallet. Keyhouse is built this way: you connect a wallet and play, the funds stay on-chain, and the platform never holds your keys.

• No KYC. No documents, no identity check, no registration form — your wallet is your account.
• Zero platform fees on deposits and withdrawals. You pay blockchain gas and nothing to Keyhouse.
• Withdrawals in 1–5 minutes, limited only by the network: roughly 1–2 minutes on Polygon or Arbitrum, 3–5 on Ethereum.
• USDT and USDC across five networks — Ethereum, Polygon, Arbitrum, Optimism and Base, with Tron announced.
• Everything verifiable on-chain. Deposits, balances and withdrawals are public transactions you can check in a block explorer.
• 21 game studios, among them KAGaming, Blueprint, BGaming, Yggdrasil, Thunderkick, Playson and Betsoft.

Why this matters more than any score. Look at the three ways a casino can fail you: a delayed withdrawal, a frozen account, a balance confiscated under some clause. All three require the casino to be holding your money. A platform that never holds it cannot withhold it — there is no withdrawal queue to be stuck in and no account to freeze at payout time, because your winnings are already in your wallet and you are waiting on network confirmation and nothing else. It is the same custody model that made Polymarket work, applied to casino games, with settlement the moment the round ends.

That is the shortcut. If you are using a platform that holds your balance for you, run the seven checks below — they are what stands between you and a bad operator. Read the full Keyhouse review.

1. Find the licence — and then verify it

A legitimate casino tells you who licenses it, and it does so in the footer, not buried three clicks deep. What you are looking for is a regulator plus a registration number.

Most crypto-friendly casinos are licensed in Curaçao, which is the pragmatic reality of this corner of the industry. Here is what a complete, verifiable set of credentials looks like, taken from our own review database:

• BitStarz — licence OGL/2024/165/0185, Curaçao Gaming Authority, operated by Gareton B.V. (company register 160656)
• Jackbit — licence OGL/2024/1800/1049, status indefinite, operated by Ryker B.V. (company register 154186)
• TrustDice — licence OGL/2024/664/0280, operated by Satoshi Gaming Group N.V. (company register 151832)

Notice the pattern: a named legal entity, a jurisdiction, a licence number, and a separate company registration number.

The two-number trap

This is the most common way a casino misleads you without technically lying, and most “best casino” lists fall for it.

A Curaçao operator has two different numbers, and they are not interchangeable:

• A company registration number — five or six digits, issued by the Willemstad commercial register. It proves a company exists. It says nothing whatsoever about gambling.
• A licence number — the OGL/YEAR/… format, issued by the Curaçao Gaming Authority. This is the one that means the operator is permitted to run a casino.

Plenty of sites print “Curaçao, registration number 164979” in the footer and let you assume it is a gambling licence. It is not. If the only number you can find is five or six digits with no OGL prefix, the operator has shown you its business registration and withheld its licence — or does not have one to show.

The critical second step is the one most players skip: verify the number actually exists. A licence number printed in a footer is just text — anyone can type it. Look it up in the regulator’s own register. If the operator’s name on the register does not match the company named on the casino, walk away.

What this check found in our own database

We ran exactly this verification across every casino we cover in August 2026, against the Curaçao Gaming Authority’s register of current licences and its separate enforcement register. It moved five scores, all downward.

The clearest case was BC.Game, which held the highest rating on this site at the time. Its Curaçao licence, OGL/2023/118/0060, appears in the enforcement register: revoked on 6 December 2024. The number in its footer — 164979 — is Small House B.V.’s commercial registration, still perfectly valid and proving nothing about gambling. The company does not appear in the register of current licences at all. Its score went from 9.4 to 4.5.

Two more failed on the same pattern. Vave published a jurisdiction with no number at all. Reel Crypto published a number belonging to a different company than the one it names as its operator. Neither case is unusual, and both take about four minutes to catch.

What “no licence” actually means for you

Some casinos operate with no licence at all. That is not automatically fraud, but it removes your only escape hatch: with a licensed operator, an unresolved dispute can be escalated to the regulator. With an unlicensed one, there is nobody above the casino to appeal to. Your money is governed entirely by the casino’s own goodwill.

We do review unlicensed casinos when they are widely used, but we score them accordingly and say so plainly. A missing licence should never be a footnote.

2. Check whether the games are provably fair or independently supplied

A casino that builds its own games in-house, with no external audit and no verification mechanism, is asking you to trust it on the single most important question: are the odds real?

There are two legitimate answers to that question.

Named third-party providers. Studios like BGaming, Yggdrasil, Pragmatic Play, Thunderkick, Playson and Betsoft license their games to casinos and have their RNG certified independently. Their reputation does not survive rigged maths, so they don’t rig it. If a casino runs a catalogue of games from recognisable studios, the maths is almost certainly sound.

Provably fair cryptography. This is the crypto-native answer, and it is stronger: the outcome of each bet is derived from a server seed and a client seed, so you can verify after the fact that the result was not altered once you placed your bet. We wrote a full explainer on how provably fair gambling works, and you can browse the provably fair games we have catalogued.

A casino offering both is the strongest signal available. A casino offering neither, with unbranded games you cannot find anywhere else, is one to avoid.

3. Read the withdrawal terms before the bonus terms

This is the inversion that separates experienced players from new ones. The bonus is marketing. The withdrawal policy is the product.

Specifically, find the answers to these before depositing:

• Withdrawal limits — per transaction, per day, per month. A casino advertising a huge jackpot while capping withdrawals at a small monthly figure has quietly made that jackpot unpayable.
• Processing time — and whether it is stated as a firm figure or a vague “up to”.
• Verification triggers — at what point are you asked for documents? Being asked at withdrawal rather than at signup is normal, but the rules should be written down.
• Dormant account fees — some operators quietly drain balances that sit unused.

The wagering requirement trap

A “350% welcome bonus” with a 50x wagering requirement on the bonus and the deposit is worth considerably less than a smaller bonus at 10x. The multiplier and what it applies to matter more than the headline percentage. If the terms do not state the wagering requirement clearly, treat the bonus as worthless and judge the casino on everything else.

4. Test support before you need it

Open the live chat and ask a specific, slightly awkward question — something like “what are your withdrawal limits for a verified account, and how long do crypto withdrawals take on Polygon?”

You are not really asking about withdrawals. You are testing three things: whether a human answers, whether they answer the actual question, and whether their answer matches the written terms. An operator whose support contradicts its own terms and conditions is telling you those terms are not being followed.

5. Look for the responsible gambling tools

This is one of the most reliable signals, and it is almost never faked. Regulated, serious operators provide deposit limits, loss limits, session reminders, cool-off periods and self-exclusion. Building those tools costs money and they reduce short-term revenue — so operators who are only after a quick extraction don’t bother.

If a casino has no responsible gambling page, or has one with no working controls behind it, that tells you what kind of business it is.

6. Check the reputation, but read the complaints properly

Every casino of any size has angry reviews. Volume of complaints tells you less than pattern of complaints. Read for the shape:

• Normal: slow support, disliked bonus terms, a specific game malfunctioning, verification friction.
• Serious: confiscated winnings after a big win, accounts closed at withdrawal time, terms retroactively applied, withdrawals endlessly “under review”.

That second group is the pattern of an operator who is happy to take deposits but resists paying out. One complaint like that can be a misunderstanding. Five of them, from unconnected players, telling the same story, is data.

7. Verify the on-chain trail if it is a crypto casino

Crypto gives you a verification tool that fiat players never had: the blockchain is a public ledger. When you deposit or withdraw, you get a transaction hash. You can check it on a block explorer independently of anything the casino tells you.

Use it. If a casino claims a withdrawal has been sent and cannot give you a transaction hash, the withdrawal has not been sent. There is no ambiguity in that — either the transaction exists on chain or it does not.

Some newer platforms extend this to the whole model with self-custody: your balance stays in your own wallet rather than in the casino’s account. Keyhouse is built this way — deposits, balances and withdrawals are all public on-chain transactions, and the platform never holds your keys. It is worth understanding as a category because it changes what “legitimate” even means: a casino that never custodies your funds cannot withhold them, which is the failure mode most of this checklist exists to protect you from.

The trade-off is real and worth stating plainly: full responsibility for your keys sits with you, and there is no password reset for a lost wallet — self-custody suits players who are already comfortable with on-chain tools. What it changes is which risks are possible at all. The failure modes this checklist spends most of its length teaching you to detect — withheld withdrawals, frozen accounts, confiscated balances — every one of them requires the casino to be holding your money in the first place. On a platform that never holds it, there is no withdrawal queue to be stuck in and no balance anyone can withhold: your winnings are already in your wallet, and you are waiting on network confirmation and nothing else.

The ten-minute version

If you only have ten minutes before depositing, do these five things in this order:

1. Find the licence number in the footer — the OGL/… format, not the five-digit company registration — and look it up on the regulator’s register.
2. Check the game catalogue for named studios or a provably fair verifier.
3. Read the withdrawal limits and processing times in the terms.
4. Search the casino’s name alongside “withdrawal problem” and read the pattern.
5. Confirm the responsible gambling tools actually exist and function.

A casino that clears all five is not guaranteed to be perfect, but it is very unlikely to be a scam. A casino that fails two or more does not deserve your deposit, regardless of how good the bonus looks.

And if you would rather not run the checks at all: on a self-custody platform like Keyhouse most of them stop applying, because there is no custodian to assess — the funds never leave your wallet.

Frequently asked questions

Is a Curaçao licence a “real” licence?

Yes, but it is a lighter-touch regime than Malta or the UK, with less aggressive player-dispute enforcement. It is the standard jurisdiction for crypto casinos and should not be treated as disqualifying — it simply means you should lean harder on the other checks in this list.

Does no-KYC mean a casino is illegitimate?

No. Not requiring identity documents is a deliberate product decision, and on self-custody platforms where your funds never leave your wallet it is coherent rather than suspicious — on Keyhouse, for example, there is no withdrawal to gate behind documents in the first place. What matters is whether the policy is stated openly and applied consistently. The real problem is a custodial casino that advertises no-KYC and then demands documents the moment you try to withdraw a win.

Can I get my money back from an illegitimate casino?

Usually not, and that is precisely why the checks above matter. Crypto transactions are irreversible by design, and if the operator is unlicensed there is no regulator to appeal to. Chargebacks do not apply to on-chain payments.

How much should a casino’s review score influence me?

Use it as a shortlist tool, not a verdict. Our scores weigh licensing, game quality, payout behaviour and terms, but your own priorities matter — a player who cares most about withdrawal speed should weight that above a broad game catalogue.

Before you deposit

Legitimacy is not a binary. It is a set of signals that either line up or do not, and after you have run this checklist a few times you will spot a bad operator in a couple of minutes.

If you want a shortcut, Keyhouse is the one platform here where the question mostly stops applying, because it never holds your funds in the first place. And every casino in our crypto casino database has already been through this process, with the licence details, ownership and payout terms documented in each review. And whatever you play, treat gambling as entertainment you have budgeted for, never as income — set a deposit limit before your first bet, not after your first loss.