iGaming & Gambling Compliance in Singapore

Singapore prohibits all gambling unless it is licensed or exempted. Online, the market is effectively closed: a single state-linked operator holds the remote gambling licence, and the law reaches overseas operators whose services can be used by people physically present in Singapore.

The Gambling Regulatory Authority of Singapore (GRA) licenses and supervises all gambling. The Singapore Police Force blocks unlawful remote gambling, the National Council on Problem Gambling (NCPG) keeps the list of excluded persons, and the Suspicious Transaction Reporting Office (STRO) receives suspicious transaction and casino cash reports.

For a new entrant the obstacle is not compliance design but access: there is no licence to apply for. The rules below matter most to the incumbent licensees, their technology and identity suppliers, and businesses whose products might be classed as gambling.

1. Who regulates this sector

2. Licensing and authorisation

The Gambling Control Act 2022 (GCA) prohibits anyone from conducting a betting operation, gaming or a lottery unless licensed, class-licensed, exempt, or a casino licensee acting within its casino (s 18(1)). It reaches overseas operators: conducting gaming includes running a server anywhere that lets people in Singapore play for a prize (s 8(1)(a)(ii)), and the Act applies to gambling that people physically in Singapore can join, even if lawful where the operator is based (s 17).

Online (remote) gambling

GRA states that Singapore Pools (Private) Limited is the only operator it has licensed to provide remote gambling services. GRA renewed Singapore Pools' licence for betting operations, gaming and lotteries under section 54 of the GCA for five years from 25 October 2025. The Act sets no maximum term: a licence runs for the period stated in it (s 56). Conditions can cover responsible gambling controls, records, reporting and audits (s 57(2)). The annual licence fee for conducting betting operations is S$4,930,000 (Gambling Control (General) Regulations 2022, Schedule, Part 2, from 10 October 2025). A licensee also needs game and game rules approval and, for physical outlets, gambling venue approval.

Land-based gambling

Casinos are licensed under the Casino Control Act 2006 (CCA). Marina Bay Sands holds a three-year licence from 26 April 2025 and Resorts World Sentosa a two-year licence from 6 February 2025 (GRA).

Class licences for lower-risk products

Some products run under a class licence with no application and no notification, provided every condition in the relevant order is met (GRA class licences). For digital businesses the key one is the Gambling Control (Remote Games of Chance – Class Licence) Order 2022, in force from 15 August 2022, which covers chance-based features such as loot boxes. Type 1 covers free-to-play games; Type 2 allows paid chances but no prizes convertible into money.

3. AML, KYC and customer due diligence

The detailed AML regime sits in casino law. The GCA contains no customer due diligence provisions for other licensees; for them, the general reporting duties below apply alongside their licence conditions. The Gambling Control (General) Regulations 2022 prescribe the betting licensee's head of risk and compliance, who oversees AML and counter-terrorism financing requirements, and the officer overseeing customer account opening and remote gambling operations, as key officers (reg 8).

Casinos

Section 139 of the CCA requires a casino operator to perform prescribed customer due diligence (CDD) to detect or prevent money laundering, terrorism financing and proliferation financing:

When CDD is triggered

On opening a patron account; on paying to, or receiving from, a patron S$4,000 or more in a single transaction, whether or not in cash (wording in force from 21 September 2026); on suspicion of money laundering, terrorism or proliferation financing; and on doubts about information already held.

If CDD cannot be completed

The operator must not open the account or proceed with the transaction, and must consider filing a suspicious transaction report (s 139(2)).

Records

All CDD records must be kept, including copies of identification documents and the results of any analysis (s 139(3)). Breach exposes the operator to disciplinary action (s 139(4)).

The Casino Control (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Regulations 2009, last amended by S 649/2026 with effect from 21 September 2026, add the operational detail. Anonymous accounts are prohibited (reg 7); identity, including that of beneficial owners and those controlling corporate patrons, must be verified against reliable and independent sources (regs 8 to 10). Patron accounts are opened face to face or, in lieu of face-to-face contact, in accordance with GRA's Internal Controls Code (reg 9(1)). Where an account is opened face to face, no transaction may pass through it until a licensed special employee has met the patron at the casino and verified their identity (reg 9(3)).

Higher-risk patrons, including politically exposed persons, require verified source of wealth and funds, senior management approval and enhanced monitoring (reg 14).

Reporting thresholds

Casinos also need board-approved AML and reporting frameworks reviewed yearly, a compliance officer, staff training and an annual independent audit (regs 17 to 20). From 21 September 2026, GRA can require the casinos to share risk information on patrons they have declined or exited after filing a suspicious transaction report (CCA s 139A).

Every business in Singapore that knows or has reasonable grounds to suspect that property is connected to criminal activity must file a suspicious transaction report with STRO, as soon as reasonably practicable, whether or not the transaction was completed. Failure carries a fine of up to S$250,000, imprisonment of up to three years, or both, for individuals, and up to S$500,000 for other persons (CDSA s 45; Singapore Police Force). All persons in Singapore should screen clients against the United Nations sanctions lists published by MAS before doing business with them.

4. Identity verification and onboarding

Age

Section 13 of the GCA sets minimum ages by type of gambling. On-course and off-course horse betting, and in-person lottery and sports betting at venues without a live broadcast, are open from 18. Everything else, including all general remote gambling and casino gambling, requires the player to be 21. It is an offence for an underage person to gamble (s 31), to open or re-open an account for general remote gambling (s 32(1)(b)), or to use false evidence of age to do so (s 33). Casino staff must refuse entry to anyone suspected of being under 21 without acceptable proof of age (CCA s 134).

Exclusion status

Excluded persons include those under family or third-party exclusion orders, statutory exclusions (such as undischarged bankrupts), self-exclusion or a Police entry ban (GCA s 3; CCA s 165A). NCPG must give the licensed online operator, free of charge, the list of everyone barred from general remote gambling (CCA s 168(3A)(c)). The online licensee must take all reasonably practicable steps to stop underage and excluded people from gambling remotely (GCA s 82(2)).

Identity for AML

Casino CDD requires verification using reliable and independent sources; no gambling rule names a specific electronic method. An NRIC number (the national identity card number) should never be used to authenticate a person (see section 6).

5. Digital channels: what's different

Bottom line: online gambling is a monopoly channel with an age of 21 for every product and an identity checkpoint at account opening, while in person a lottery ticket can be bought at 18 without any account.

Account opening is the legal gate

Engaging in general remote gambling includes opening an account (s 11(1)), and the offences for underage and excluded persons attach to that step (ss 32 and 33).

Ongoing exclusion screening

NCPG updates its list as orders start and end (CCA s 168(4)). If the licensee suspects that an underage or excluded person is gambling with it by remote communication, it must refuse to pay the winnings and surrender them to GRA on demand. The person has 7 days to prove eligibility (GCA s 84).

Blocking of unlicensed operators

GRA may direct the Infocomm Media Development Authority to order internet service providers to disable access to unlawful remote gambling sites (s 117). GRA may also direct MAS to order financial institutions, or itself order financial transaction providers, to block payments to and from people who take part in unlawful remote gambling. Blocking can extend to all transactions using merchant category codes customarily associated with gambling (s 118). Since 1 January 2025 the Singapore Police Force has carried out this blocking (GRA), issuing directions under the Online Criminal Harms Act 2023 that require online service providers to restrict access to illegal gambling services and advertisements (MHA, 9 June 2026). Offences under Parts 2 and 6 of the GCA are specified offences under that Act, and its directions, including access blocking, account restriction and app removal, can be given to providers inside or outside Singapore (OCHA ss 6 and 7, First Schedule). By 31 December 2024 more than 3,800 sites and more than 145,000 transactions worth about S$37 million had been blocked (MHA, 8 April 2025).

Player location

The GCA places no geolocation duty on licensees. In August 2026 the Minister told Parliament that GRA is investigating reports of Singapore Pools app users placing bets while overseas, and that whether to restrict access abroad needs careful study (MHA, 5 August 2026).

Pending change

GRA consulted in August 2025 on allowing in-game marketplaces for Type 2 remote games of chance [Consultation closed 20 Aug 2025, order not yet amended].

6. Data protection and biometrics

The Personal Data Protection Act 2012 governs identity data captured during gambling onboarding. Casinos keep ID copies because the law requires it (CCA s 139(3)), not on consent. Gambling law has no separate biometrics rule; facial images fall under the PDPA. Under the PDPC's Advisory Guidelines for NRIC and other national identification numbers (issued 31 August 2018, still valid pending an update), an organisation may collect an NRIC number or a copy of the NRIC only where the law requires it or where it is necessary to verify identity to a high degree of fidelity, and collecting a copy means collecting all the personal data on it. Under the PDPC and Cyber Security Agency joint advisory, NRIC numbers should not be used as passwords or to authenticate customers.

7. Sector-specific obligations

Exclusion orders, entry bans and visit limits

NCPG issues family and third-party exclusion orders and visit limits, and accepts self-exclusion applications that can cover casinos, gaming machine rooms, general remote gambling, or any combination (CCA s 165AA, in force from 21 September 2026). The Police may also ban a person from online gambling (GCA s 79; GRA).

Casino entry levy

Singapore citizens and permanent residents must pay S$150 per 24 hours or S$3,000 a year to enter a casino (CCA s 116). When those players (other than premium players) fund their casino deposit account electronically, GRA requires a 30-minute wait before the funds can be used (MHA, 10 September 2024).

Responsible gambling and advertising

GRA's responsible gambling measures include a pre-commitment programme for spending and time limits, and staff training. Licensed operators may not advertise or promote gambling unless GRA approves (GRA). Advertising unlawful gambling is an offence carrying a fine of up to S$20,000 (GCA s 85). Sending an inducement to gamble to an underage person carries up to S$300,000 and six years (s 34).

8. Risk indicators and red flags

Gambling typologies drawn from Singapore's rules and enforcement

• Third-party cash deposits: cash from someone other than the patron credited to a patron account (behind GRA's 2023 S$2.25 million penalty).
• Structuring: transactions kept just under S$4,000, or cash split to stay under S$10,000 a gaming day.
• Unexplained wealth: higher-risk patrons with no documented source of funds.
• High-risk jurisdictions: patrons linked to jurisdictions identified by FATF or a regulator as having inadequate AML measures.
• Foreign remote gambling proceeds: funds from illegal remote gambling run abroad and laundered through Singapore, as in the 2023 S$3 billion case cited in Singapore's 2026 FATF evaluation.
• Proxy play: a person playing a gaming machine on behalf of someone who is not present.
• False identity evidence: documents used to pass age or exclusion checks (s 33).

9. Enforcement and penalties

• Unlicensed operators. Conducting unlawful gambling carries a fine of up to S$500,000 and imprisonment of up to seven years, rising to S$700,000 and ten years for repeat offenders (GCA s 18(2); GRA).
• Players. A player who gambles with an unlicensed provider faces a fine of up to S$10,000, imprisonment of up to six months, or both (s 20).
• Licensees. GRA may censure, direct, suspend, revoke or fine up to S$1 million (s 88). Casinos face up to 10% of prior-year gross gaming revenue for a serious breach, otherwise S$1 million per ground (CCA s 54).
• Blocking orders. An internet service provider that does not comply can be fined up to S$20,000 a day per site, up to S$500,000 (s 117(6)).

GRA's enforcement record shows how identity controls are enforced. In FY2025 GRA fined Singapore Pools S$100,000 for breaching its licence conditions by failing to verify customers' exclusion status. In 2023 GRA imposed S$2.25 million on Resorts World Sentosa for failing to perform prescribed CDD on cash deposits collected from third parties between 2016 and 2019 (GRA announcement, 8 December 2023). From 2020 to 2024 GRA issued nine warning letters and six fines totalling S$2,695,000 to the casinos for AML breaches (FATF-APG Mutual Evaluation Report of Singapore, May 2026, para 342).

10. Recent changes and what to watch

• 21 September 2026: second tranche of the Casino Control (Amendment) Act 2024 [In force]. Self-exclusion now covers online gambling, and the casino CDD trigger covers any S$4,000 payment, cash or not.
• 21 September 2026: casino AML regulations amended by S 649/2026 [In force]. Tighter enhanced due diligence and risk-information sharing between casinos.
• 25 October 2025: Singapore Pools' licence renewed for five years [In force]. The online market stays single-operator.
• August 2025: proposal to allow player-to-player marketplaces for Type 2 remote games of chance [Proposed, order not yet amended].
• 1 January 2025: the Singapore Police Force took over blocking of unlawful remote gambling [In force].
• February 2027 (watch): Resorts World Sentosa's two-year casino licence term, which began on 6 February 2025, comes up for renewal [Term ends Feb 2027].

11. What this means for identity verification

• Age and exclusion before the first stake. Online onboarding must confirm both before the account opens: an age of 21 for every remote product, and the customer's absence from NCPG's general remote gambling list.
• Exclusion is not a one-off check. The list changes and excluded players' winnings must be withheld, so screening must recur, including before payouts.
• Casinos need more data points. Residency status (for the entry levy), CDD at S$4,000 cash or not, beneficial owners, and verified source of wealth for higher-risk patrons.
• Method is not prescribed. Verification must rest on reliable and independent sources; an NRIC number alone is never proof of identity.
• Retention. Casinos must keep ID copies and CDD analysis; biometric data falls under the PDPA.