Start with the number, not the badge
Can you name the regulator that licenses the casino you last deposited money into, and quote its licence number from memory? Most players cannot, and that is the gap criminal operators live in. Learning how to spot illegal casinos comes down to three checks you can finish in about five minutes: find the licence number, match it against the regulator’s own public register, and confirm that the company named on the register is the company taking your deposit. If any of those three stalls, stop.
Everybody already says “check the licence”. They are right, but usually for the wrong reason. A licence logo in the footer is an image file, and an image file protects nobody. What actually protects you is the paper trail behind a real licence: named owners who passed background checks, audited accounts, mandated anti-money-laundering controls and a regulator with the appetite to pull the plug. The badge is the shadow. The trail is the thing. And a sanctions case announced in October 2026 shows exactly how far a gaming venue can get while the badge is still hanging on the wall.
What the US Treasury sanctioned on 13 October 2026
The US Department of the Treasury sanctioned Club La Molienda, a racetrack outside Nuevo Laredo, Mexico, as part of what federal officials described as their largest financial action against Cártel del Noreste, the successor group to Los Zetas. The racetrack was one of 11 entities and four individuals designated that day. According to Treasury, La Molienda ran a betting partnership with Casino Centenario that let casino customers wager on its horse races, and remains under the control of Miguel Ángel Treviño Morales, a cartel founder currently incarcerated in the US.
Casino Centenario itself had been sanctioned the previous April. Treasury accused the property of laundering narcotics proceeds through its gaming operations, storing fentanyl and cocaine on site, and using backrooms to torture and intimidate cartel rivals. Mexican authorities suspended the casino’s operations in April after coordinated action with the US, which is what ended the racetrack partnership. The same April action blacklisted a second property, Diamante Casino in Tampico, along with its affiliated online gambling platform, because of ties to the same operating company. These details come from Casino.org’s reporting on the Treasury announcement.
Note the sequence. The casino was not stopped by a licensing review. It was stopped by a sanctions designation and a government suspension, and only after years of operating. That is the point where “just check the licence” quietly stops working.
Why criminal money keeps circling gaming venues
Casinos are attractive to launderers because they turn cash into a plausible story. A venue with slot floors, table games and admissions handles large volumes of small, anonymous-looking transactions, and the revenue it reports is hard for an outsider to disprove. Chips, tickets and account balances all act as portable stores of value that can be bought in one form and redeemed in another.
The horse-racing scheme in the same Treasury file shows the mechanics without the gaming floor. Treasury alleges the Treviño Morales brothers used drug proceeds to buy, train and race American quarter horses between 2008 and 2012, with shell companies and proxies spending $16 million over one 30-month period and laundering more than $22 million in total. Federal investigators seized 455 horses from an Oklahoma farm and other facilities in June 2012. Shell companies, a legitimate-looking industry, real prize money flowing in both directions: that is the template, and gambling venues fit it neatly.
This is exactly why licensing regimes obsess over who owns an operator rather than how pretty its website looks.
What a real gambling licence actually demands
A genuine licence is an ongoing compliance obligation, not a one-off certificate. Before it issues anything, a serious regulator wants to know who the beneficial owners are, where the founding capital came from, whether any director has a relevant criminal or financial history, and whether the company holds enough capital to pay players who win. After issue, the operator carries continuing duties: segregated player funds, anti-money-laundering programmes, KYC identity verification, transaction monitoring and suspicious activity reporting, independently tested games, published terms, responsible gambling tools and a route to independent dispute resolution.
Who issues licences and what they examine
The regulators worth trusting publish a searchable register of every licensee, which is the single feature that makes verification possible. The UK Gambling Commission and the Malta Gaming Authority both do this, as do established US state regulators such as the New Jersey Division of Gaming Enforcement. A register entry tells you the licensed company’s legal name, the licence number, its status and, in many cases, the domains it is permitted to run. A footer logo tells you someone can use an image editor.
Independent testing and fairness certification
Licensed games are tested by independent laboratories, not by the casino. Houses such as eCOGRA, Gaming Laboratories International and iTech Labs examine random number generator output and check that a game’s payout behaviour matches the mathematics the studio declared, which is how a stated RTP of, say, 96% can be treated as a real long-run figure rather than marketing. Testing does not make a game profitable for you; the house edge is the other side of RTP and it stays with the house. It only means the advertised numbers are the real numbers.
Red flags worth walking away from
- No licence number anywhere on the site, only a logo or the phrase “licensed and regulated”.
- A licence number that returns nothing, or a different company name, in the regulator’s register.
- Unverifiable ownership: no company registration details, no address, or a chain of shell companies with no named beneficial owner.
- No independent testing certificate, or seals that link nowhere.
- Bonus offers with no published wagering requirement, no maximum cashout and no game weighting.
- Crypto or cash only, with deposits accepted instantly and no identity verification at any stage.
- Absent responsible gambling tools: no deposit limits, no cool-off, no self-exclusion.
- Support agents who deflect direct questions about the licence holder’s legal name.
The last one deserves more weight than it usually gets. A compliant operator’s support team answers that question in one line, because the answer is a matter of public record.
Verifying a licence yourself, step by step
- Scroll to the site footer and copy the licence number and the name of the licensed company, usually printed as “X is operated by Y under licence number Z”.
- Open the regulator’s website directly, by typing the address, not by clicking the casino’s badge. Search the number in its public register.
- Confirm three things match: company name, licence status (active, not suspended or lapsed) and the domain you are actually on.
- Look up the licensed company in its jurisdiction’s corporate registry to see directors and shareholders. If the trail ends in a nameless holding company, treat that as unresolved rather than fine.
- Search the brand name alongside words like “fine”, “suspended” and “sanctions”, and check whether the operator or its payment partners appear on the US Treasury’s OFAC sanctions list.
- Read the payment and KYC terms before funding the account: withdrawal limits, document requirements, verification timing and any clause letting the operator void winnings.
A casino that demands ID before paying you out is not being awkward, it is doing the job its licence requires. The one that never asks is the one to worry about.
| Check | Where to look | What a failure looks like |
|---|---|---|
| Licence number | Site footer or terms page | Logo only, no number |
| Licence validity | Regulator’s public register | No result, lapsed or suspended |
| Ownership | Corporate registry in the licensing jurisdiction | Shell company, no named owner |
| Game fairness | Testing lab certificate or report | Seal with no verifiable document |
| Enforcement history | Regulator news page, sanctions lists | Recent fines, designation, licence action |
| Payments and KYC | Terms and conditions | No verification, vague withdrawal rules |
Where offshore and grey-market licences leave you exposed
In a loosely regulated jurisdiction, a licence may exist on paper while nobody is auditing the books or testing the games. The difference is enforcement capacity and your recourse when something goes wrong. Under a strong regulator you can escalate a withheld withdrawal to an independent adjudicator and, in the worst case, the regulator can suspend the licence. Under a weak one, your complaint goes to the same company that owes you money.
The Mexican case shows the sharper version of that risk. Sanctions freeze the assets of designated parties, and the April action covered not just two physical casinos but an affiliated online gambling platform. A player holding a balance on a platform that gets blacklisted or suspended has no obvious route to recover it, because the funds sit inside an entity that is now frozen or shut. Nothing about that outcome depends on you having done anything wrong.
So the honest answer to “is an offshore casino safe” is: it depends entirely on which offshore, and you need to find out which before you deposit, not after.
Your pre-deposit checklist
Before money moves: licence number found, number verified in the regulator’s own register, company name on the register matches the company billing you, ownership traceable to named people, testing certificate real and current, no recent enforcement action or sanctions designation, withdrawal and KYC terms read in full. One more signal that costs nothing to check: a casino that offers deposit limits, session reminders, cool-off and self-exclusion is a casino operating under rules that require them. Their absence tells you something, and their presence is worth using regardless of where you play.
None of this makes gambling a safe bet. The house edge is permanent, every game is designed to return less than it takes over time, and no amount of licensing changes that arithmetic. What verification buys you is narrower and more useful: knowing who holds your money, and who can be made to answer for it.