Certification vs Licensing: What GICNT Is and What It Is Not

Certification versus licensing in gambling describes two different instruments, not two routes to the same permission. A licence, issued by a statutory regulator, makes an operation lawful. A certification mark records an independent assessment against a published standard and carries no legal force. GICNT works only in the second category, across six compliance domains, and holds no supervisory authority over any operator.

What Separates a Gambling Licence From a Certification Mark

A licence answers a legal question. May this company accept a stake from a person located in this territory, under what conditions, and for which products. A certification mark answers a narrower one. Did this company meet the requirements of a named standard on the day an assessor examined it.

The difference runs deeper than wording. A regulator draws its powers from statute, opens investigations, imposes financial penalties and can close a business down. Certification bodies working in igaming draw theirs from a contract with the client. The strongest sanction available to any of them is withdrawal of the mark and removal from the scheme register.

Reach differs as well. A licence stops at the border of the territory that issued it, which is why the map of gambling regulators by country decides market access rather than any private standard.

Attribute	Operating licence	Certification mark
Source of authority	National or provincial statute	A published scheme owned by a private body
Legal effect	Authorises the gambling activity	None; evidential value only
Granted by	Statutory regulator	Certification body
Effect of failure	Suspension, revocation, criminal or administrative liability	Withdrawal of the mark
Geographic scope	The licensing territory alone	Wherever counterparties recognise the scheme
Public record	Statutory licence register	Scheme register

Where the Legal Authority to Operate Comes From

In Great Britain, providing facilities for gambling without the required operating licence is a criminal offence under section 33 of the Gambling Act 2005. The offence is summary only, carrying a maximum of 51 weeks of imprisonment in England and Wales, six months in Scotland, a fine at level 5 on the standard scale, or both. Section 36 extends it to remote operators whose gambling equipment sits in Great Britain, and to those who know or should know that their facilities are used there.

Malta runs a two-tier system under the Gaming Act 2018. The Malta Gaming Authority issues a B2C Gaming Service Licence to operators serving players and a B2B Critical Gaming Supply Licence to platform and content suppliers, each for a term of 10 years, with one authorisation able to span game types 1–4. Which MGA licence types a company holds determines what it may offer, and says nothing about how well it runs its AML programme.

Ontario splits the function again. An operator registers with the Alcohol and Gaming Commission of Ontario under the Gaming Control Act, 1992, then signs an operating agreement with iGaming Ontario before accepting a single wager. The market opened on 4 April 2022, and iGaming Ontario became an independent agency in May 2025.

No mutual recognition of gambling licences exists inside the EU, and none between the major offshore and onshore regimes. The licence requirements a gambling operator must meet therefore reset with every market entered. Certification travels differently: a scheme applies the same criteria wherever the operator happens to be licensed, which makes it useful to counterparties and useless as a substitute for authorisation.

What GICNT Assesses Across the Six Framework Domains

The framework covers six domains, all mandatory, each with its own assessment rhythm. GICNT-LS verifies that a licence exists, that it names the entity operating the site and that it remains in force. Verification is the whole of it. The standard confirms an authorisation granted elsewhere and never creates one.

Code	Domain	Assessment cycle
GICNT-LS	Licensing and Legal Status	Annual review
GICNT-PP	Player Protection and Responsible Gambling	Bi-annual audit
GICNT-AML	Anti-Money Laundering and KYC	Annual third-party audit
GICNT-FP	Fair Play and Game Integrity	Game-level certification
GICNT-DS	Data Protection and Cybersecurity	Annual security assessment
GICNT-AM	Advertising and Marketing Standards	Complaint-triggered review

Frequency follows the volatility of the subject matter, which is the logic behind the GICNT audit cycles attached to each domain. Advertising complaints arrive unpredictably, so review is triggered by them. Player protection controls drift quickly enough to justify two audits a year.

Regulators Already Build Third-Party Assurance Into Their Own Rules

Third-party compliance audits in online gambling are not an invention of private schemes. Under licence condition 2.3.1, the Gambling Commission requires licensees to have games tested by an approved test house and to submit the test report before release. The Commission states plainly that it approves neither games nor test results. Test houses on its published list must hold accreditation to ISO/IEC 17025 together with selected requirements from ISO/IEC 17065 and ISO/IEC 27002.

Ontario imports a voluntary scheme wholesale. iGaming Ontario requires operators to obtain the Responsible Gambling Council’s RG Check accreditation within the first two years of the operating agreement date and to keep it for the remainder of the term, alongside the AGCO Registrar’s Standards that govern conduct on the platform. Each accreditation runs three years before reaccreditation falls due. Alberta has followed the same path: on 20 February 2026 the Alberta iGaming Corporation announced a partnership with the council making RG Check a condition of entry to its forthcoming market.

The pattern is older than either market. eCOGRA has awarded its Safe and Fair seal against the eGAP requirements since 2003, assessing operators through annual on-site reviews. ISO/IEC 17065 sets the international benchmark for bodies that issue such marks, covering the competence, consistent operation and impartiality of certification bodies for products, processes and services.

What the GICNT Certification Mark Does Not Guarantee

A trust mark on an online gambling site is a graphic file until someone checks the register behind it. Certification under the framework carries limits worth stating in full:

• No permission to operate anywhere. Licence validity is checked under GICNT-LS licensing requirements, which examines an authorisation the operator already holds.
• No prediction of future conduct. An audit describes the controls observed during the assessment window and nothing beyond it.
• No opinion on commercial terms. Withdrawal speed, bonus value, game catalogue and pricing sit outside all six domains.
• No relief from regulatory reporting. Obligations owed to the licensing authority continue unchanged.
• No guarantee against operator insolvency. Protection of player balances depends on the segregation rules of the licensing regime.
• No survival beyond the licence. Where a regulator suspends or revokes the authorisation, the premise of certification falls away with it.

Verifying a Licence Before Reading Any Trust Mark

Logos and seals are copied in minutes; register entries are not. A short sequence separates the two:

1. Take the legal entity name and licence number from the footer text, never from the image.
2. Search the regulator’s own register. Malta maintains a public Licensee Register, and the UKGC licence conditions bind only the holders listed on the Commission’s public register.
3. Match the domain. Registers list authorised URLs, and a brand missing from the entry falls outside the authorisation.
4. Check status rather than existence. Licences get suspended, cancelled and surrendered, while old numbers keep circulating.
5. Treat a dynamic seal as a claim until the link resolves to the regulator’s own domain.

The Maltese regulator publishes notices naming sites that falsely claim its authorisation, including one on 29 January 2026 covering four domains, and has confirmed in a separate case that a licence screenshot and dynamic seal displayed by an unlicensed site were fabricated. Its 2025 enforcement record lists 35 cease and desist letters, 22 warnings and 30 administrative penalties totalling EUR 162,520.

How Certification and Licensing Work Together for Operators and Partners

Banks, payment providers, game studios and affiliate networks all run diligence of their own, and they read the two documents for different reasons. The licence tells them the counterparty is lawful in a named territory. The certification report tells them what an assessor found when examining AML escalation paths, self-exclusion integration, breach response timelines or advertising sign-off.

Voluntary certification schemes in igaming earn their place where supervision is thin or intermittent. A regulator with several hundred licensees cannot audit each of them every year, and a certification cycle fills part of that interval. Where supervision is intensive, certification supplies a second opinion instead of a substitute. In neither case does a mark move an operator closer to legal permission, and any use of it that implies otherwise misrepresents the scheme.