iGaming & Gambling Compliance in Canada

Canada is open to online gambling only through provincial schemes. The Criminal Code makes gambling lawful when a province conducts and manages it, so each province decides its own model. Ontario runs a competitive market of privately operated, registered sites; British Columbia and Québec offer online gambling through their Crown lottery corporations.

The principal authorities are the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) for anti-money laundering, the AGCO and iGaming Ontario in Ontario, and the provincial gaming regulators elsewhere. For a new private entrant, the biggest obstacle is structural: outside Ontario there is no route to a private online licence, and inside Ontario the registration, operating agreement and Registrar's Standards impose controls from the first screen of onboarding.

1. Who regulates this sector

The federal government sets the criminal law and the anti-money laundering regime; each province decides who may offer games and on what terms.

Other provinces and territories have their own gaming authorities and Crown operators; this briefing details Ontario, British Columbia and Québec.

2. Licensing and authorisation

Section 207(1)(a) of the Criminal Code makes it lawful for the government of a province, alone or with another province, to conduct and manage a lottery scheme in accordance with provincial law. Under s. 207(4)(c), schemes operated on or through a computer or video device are reserved to provincial governments: charities, fairs and other licensees cannot run them. Anyone who conducts, manages or operates a lottery scheme without that authority commits an offence under s. 207(3), punishable by up to two years' imprisonment on indictment.

Ontario: registered private operators

iGaming Ontario conducts and manages igaming provided through private operators; it became an independent provincial agency in May 2025, separate from the AGCO (AGCO, Roles of the AGCO and iGaming Ontario). A private operator needs both an AGCO operator registration for each site and an operating agreement with iGaming Ontario. The AGCO registration costs $100,000 per site per year; separate brands, wallets or account credentials can mean separate sites. The application includes a gap analysis against the Registrar's Standards and disclosure forms for the entity and its key people; game and system suppliers register separately.

British Columbia and Québec: Crown operators

In British Columbia, the Gaming Control Act (SBC 2022, c. 29), which replaced the 2002 Act on 13 April 2026, defines an online gaming scheme as one played through the British Columbia Lottery Corporation's online platform. The Corporation must run a self-exclusion programme covering online play (s. 57) and deny online access to anyone it believes is gambling unlawfully (s. 63). The GPEB registers gambling services providers and certifies gambling supplies, including internet gambling systems. In Québec, Loto-Québec conducts and administers lottery schemes under the Act respecting the Société des loteries du Québec (CQLR c. S-13.1, s. 16). Its by-law on games offered over a telecommunications network (S-13.1, r. 5) covers draws, sports betting and random-outcome games played remotely with a personal player code.

Kahnawà:ke

The Kahnawà:ke Gaming Commission has regulated interactive gaming under its Regulations concerning Interactive Gaming since July 1999. It stopped issuing Interjurisdictional Authorizations on 11 July 2022, and in November 2022 the Mohawk Council of Kahnawà:ke filed an application in the Ontario Superior Court challenging Ontario's reading of the "conduct and manage" provisions.

3. AML, KYC and customer due diligence

Casinos are reporting entities under s. 5 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). Paragraph 5(k.1) brings in a province that conducts and manages a lottery scheme accessible through the Internet or another digital network, other than bingo or the sale of lottery tickets. FINTRAC's casino guidance explains that the reporting entity is the body the province authorises to conduct and manage the scheme, and that a service provider may file reports but the legal responsibility cannot be delegated. In Ontario, the Registrar's Standards for Internet Gaming (Standard 6.02) require private operators to implement AML policies supporting PCMLTFA obligations, to align their controls with those of the designated reporting entity, and to make FINTRAC reports and supporting records available to the Registrar.

What the Regulations require of a casino

Identity verification

Verify the identity of every person for whom the casino opens an account, and of anyone receiving a reportable disbursement, extending credit of $3,000 or more, exchanging $3,000 or more in foreign currency or initiating a recordable funds transfer (PCMLTF Regulations, s. 103). Corporations and other entities are verified under ss. 109 and 112.

Politically exposed persons

Take reasonable measures at account opening and periodically afterwards, and whenever an international transfer or a cash or virtual currency receipt reaches $100,000 (s. 120.2).

Threshold reporting

Report cash and virtual currency receipts of $10,000 or more, international electronic funds transfers of $10,000 or more, and disbursements of $10,000 or more such as payouts on bets and slot jackpots (ss. 70 and 71). Disbursements to or for the same person within 24 consecutive hours are aggregated (s. 130).

Suspicious transactions

Report completed or attempted transactions where there are reasonable grounds to suspect money laundering, terrorist financing or sanctions evasion (PCMLTFA, s. 7), as soon as practicable after establishing those grounds. There is no minimum amount.

The compliance programme must include a risk assessment covering delivery channels, and any new technology, such as a new onboarding flow, must be risk-assessed before launch (s. 156(2)). High-risk clients require enhanced verification and monitoring (s. 157), and records are kept for at least five years (s. 148). In Ontario, Standard 6.03 adds a provincial layer: operators must define, based on risk, when they will ascertain and reasonably corroborate a player's source of funds, escalate to refusing transactions or excluding players, and share information on suspicious activity lawfully with other operators.

4. Identity verification and onboarding

In Ontario, Standard 3.04 of the Registrar's Standards for Internet Gaming requires the operator to collect name, date of birth, address, a log-on method, contact details and the information the PCMLTFA requires, and to show that it is complete, accurate and validated before the account is created. Standard 3.01 makes ineligible anyone under 19 (18 for lottery tickets only), self-excluded or court-barred people, and insiders such as operator directors. Each player may hold only one account per site (3.09), and the audit trail must cover identification and verification events (3.10).

For the federal layer, s. 105 of the PCMLTF Regulations sets the permitted methods: a government-issued photo ID whose name and photograph match the person; information from a government body authorised to verify identity; a Canadian credit file at least three years old drawing on more than one source; a dual process using two independent reliable sources (name and address, name and date of birth, or a confirmed financial account); or reliance on an affiliate's earlier verification. Documents must be authentic, valid and current (s. 105(5)). Once a person is verified, the casino need not verify them again unless it doubts the information used (s. 155).

Location is part of eligibility: Standard 3.02 requires operators to detect and dynamically monitor the player's location, block unverified attempts to play, repeat checks at reasonable intervals and detect software or virtualisation that could defeat location detection.

5. Digital channels: what's different

Bottom line: online, identification moves from a transaction threshold to the front door: every player is verified, age-checked, screened against exclusion lists and located in the province before the first wager, while a land-based casino identifies walk-in players mainly when they reach reporting or record-keeping amounts.

Remote photo ID needs technology, not just a camera

FINTRAC's guidance on methods to verify identity (modified 3 December 2024) allows the photo ID method when the person is not present only if the business authenticates the document, for example by having it scanned with a phone camera and checked by technology against known characteristics and security features. The person must then be matched to it through a live video session or a selfie compared by facial recognition; viewing a person and their ID over a video call does not meet the standard.

Every online player has an account

Section 103 of the PCMLTF Regulations ties verification to opening an account. A walk-in casino guest who plays below the $10,000 and $3,000 triggers may never be identified, but online play always runs through an account, so the account-opening duty reaches every player.

6. Data protection and biometrics

Private operators in Ontario fall under the federal Personal Information Protection and Electronic Documents Act; British Columbia and Québec have their own private-sector privacy laws. The Office of the Privacy Commissioner's guidance on biometrics for businesses treats biometric information capable of uniquely identifying a person as sensitive in every context, even if held for milliseconds and says express consent is generally the appropriate form, so a face match needs a clear consent step and a retention limit.

Québec is stricter. Under s. 44 of the Act to establish a legal framework for information technology (CQLR c. C-1.1), identity may be verified by a biometric process only with the person's express consent and after the process has been disclosed to the Commission d'accès à l'information; the characteristics must be destroyed once verification is done. A biometric database must be disclosed to the Commission at least 60 days before it goes into service (s. 45).

7. Sector-specific obligations

Central self-exclusion (BetGuard)

Since 14 May 2026, Standard 2.14.1 requires Ontario operators to participate in iGaming Ontario's Centralized Self-Exclusion Program, BetGuard (AGCO, 14 May 2026). Operators must block centrally self-excluded people from opening or using accounts, stop marketing to them and refund outstanding wagers within 24 hours, while keeping their own site-level programme.

Limits and safer play

Players must be offered deposit and loss limits during registration, with periods of at least 24 hours, seven days and one month.

Advertising and inducements

Standard 2.05 prohibits public advertising of bonuses, credits and other inducements; they may appear only on the operator's own site or in direct marketing after the player actively opts in. Athletes under agreement with an operator may appear in advertising only to promote responsible gambling (2.03).

Sport betting integrity

Athletes, coaches, officials, insiders with non-public information and owners of 10% or more of a team or governing body may not bet on events overseen by the relevant body (3.01.1).

8. Risk indicators and red flags

FINTRAC's Special Bulletin FINTRAC-2024-SB001 (January 2024) notes that Canada's 2023 inherent risk assessment raised the money laundering threat from unlicensed gambling, including online gambling, from high to very high, and lists indicators for licensed online sites, including:

Online gambling typologies (FINTRAC)

• Mismatched funding: card or bank account names differ from the registered player.
• Multiple accounts: several identities sharing one IP address, or repeated attempts to register twice.
• Minimal play cash-out: large deposits with little or no wagering, then withdrawal.
• Prepaid layering: excessive deposits on prepaid cards, withdrawals by wire to a bank account.
• Shared instruments: one credit card or bank account used by several players.
• Location anomalies: log-ins inconsistent with the registered address or history.
• Chip-dumping and chargebacks: deliberate losses to another player, often with stolen-card deposits.
• Profile mismatch: activity inconsistent with stated occupation or means.

9. Enforcement and penalties

FINTRAC imposes administrative monetary penalties per violation, classified as minor, serious or very serious. For violations committed on or after 26 March 2026, the AMP Regulations (s. 5) set ranges of $1 to $40,000 (minor), up to $4,000,000 (serious) and up to $20,000,000 (very serious). For an entity, all violations on one notice are capped at the greater of $20,000,000 and 3% of gross global revenue (PCMLTFA s. 73.1(3)). After a violation, FINTRAC must require a compliance agreement; refusal or breach leads to a published compliance order, and breaching that order can cost up to the greater of $30,000,000 and 3% of global revenue (ss. 73.16 to 73.18). Violations before 26 March 2026 stay under the former regime.

Recent casino-sector cases show the focus on online suspicious transaction reporting. On 24 July 2026 FINTRAC imposed $399,712.50 on the New Brunswick Lotteries and Gaming Corporation for three unfiled reports involving online players sharing a credit card and suspected false identification. In July 2025 it imposed $1,075,000 on the British Columbia Lottery Corporation for unreported suspicious transactions and high-risk client failures.

In Ontario, the AGCO's schedule of monetary penalties allows up to $200,000 per contravention of the Registrar's Standards by an operator and up to $100,000 for permitting a person under 19 to play. On 6 August 2026 it penalised Betty Gaming $120,000 after a defect let 23 under-19s open accounts, nine of whom deposited and gambled. On 27 August 2026 it penalised NorthStar Gaming $100,000 under Standard 6.03 for failing to apply its own enhanced due diligence policy to a high-risk player whose deposits reached about $189,395.

10. Recent changes and what to watch

• 15 June 2026: Bill C-36 (Protecting Privacy and Consumer Data Act) introduced [Bill, not enacted]. It would enact a new private-sector privacy statute and amend PIPEDA; it is at second reading in the House of Commons, so current federal privacy rules continue to apply.
• 14 May 2026: BetGuard central self-exclusion standards in Ontario [In force]. Onboarding must check the central register as well as the operator's own list.
• 22 April 2026: Bill S-211, National Framework on Sports Betting Advertising Act [Bill, not enacted]. Passed by the Senate in October 2025, now in House committee.
• 13 April 2026: British Columbia's Gaming Control Act, SBC 2022, c. 29 replaces the 2002 Act [In force]. It puts the online self-exclusion programme and online access controls on a statutory footing.
• 26 March 2026: PCMLTFA penalty increases, mandatory compliance agreements and compliance orders [In force]. Potential penalties for AML failures are now many times higher.
• 26 March 2026: FINTRAC enrolment duty for all reporting entities (PCMLTFA s. 11.4001) [Adopted, effective date not yet set]. Casinos will have to enrol and renew once an order in council sets the date.
• May 2025: iGaming Ontario becomes an independent agency [In force]. Operating agreements and AML programme oversight sit with iGaming Ontario; registration and standards stay with the AGCO.

11. What this means for identity verification

Design for verification before account creation, not before withdrawal: Ontario requires validated data and an eligibility decision before any account exists, so document capture, age confirmation and list screening sit in the registration flow. Use a PCMLTFA method that works remotely: an authenticated government photo ID with a selfie face match or live video, the credit file method, or the dual process.

Build location as a continuous control with VPN and virtualisation detection, and pair it with a log-in authentication step that offers multi-factor authentication. Re-screen all players when exclusion lists change, and set source-of-funds triggers you will actually follow, since the AGCO enforces an operator's own thresholds. In Québec, biometric checks need express consent and prior disclosure to the Commission. Keep verification evidence for at least five years, but delete biometric templates once used where Québec law requires it.