Investigating an online casino requires matching five things that are often presented separately: the brand, domain, contracting company, licence holder and people who ultimately own or control the operation. A licence logo or company-register entry proves only a narrow fact. A defensible investigation connects every layer with dated primary evidence.
Capture the site as the customer sees it
Record the exact URL, access date, country of access and any redirect. Save the footer, terms, privacy notice, bonus rules, complaints page, deposit screen and licence seal. Note the legal company named as operator, payment recipient, data controller and intellectual-property owner.
Repeat the capture on mobile and after login where lawful. Geo-targeting can show different operators, domains or terms to users in different countries. Preserve the evidence before contacting the business because pages can change.
Verify the licence in the official register
Search the regulator using the legal name, trading name, domain and licence number. In Great Britain, the Gambling Commission business register exposes licence status, activities, trading names, domains and published regulatory actions. The Malta Gaming Authority Licensee Hub provides licence and enforcement searches for Malta-authorised businesses.
Extract the licence holder, account or authorisation number, status, products, approved domains, start and end dates, conditions and enforcement history. Check the position on the date relevant to the complaint or transaction—not only today.
A valid licence does not automatically authorise every brand, product or country. If the domain is absent, ask the regulator or operator for an explanation rather than assuming that a group licence covers it. For a quick consumer check, use How to Check Whether an Online Gambling Operator Is Licensed.
Identify the operating model
Determine whether the brand is operated directly, through a white-label agreement, under a network licence or by a local partner. Obtain or identify the platform provider, game suppliers, affiliates, payment companies and customer-support entity.
Michael Schmidt’s overview of white-label gambling structures provides useful background on how brand and platform responsibilities can be split. Treat it as contextual analysis; the actual agreement, regulator record and current local law determine responsibility in a specific case.
Do not assume that a platform provider owns the brand or that a brand owner holds the operating licence. State each role separately and cite the source.
Reconstruct ownership and control
Search the corporate registry for the licence holder and every intermediate shareholder. Obtain incorporation records, historical shareholders, directors, accounts, charges and merger or insolvency filings. Use stable company numbers because names and registered addresses change.
Continue until natural persons are identified or the public trail ends at a trust, fund or restricted register. Then seek shareholder agreements, regulator disclosures, financing documents, court records and credible reporting. Apply the filing-to-reality verification method to distinguish registered ownership from voting, appointment and economic rights.
Track ownership and management changes against licence approvals. A regulator may require prior approval or notification when controllers, directors or key persons change. A company filing does not prove that gaming approval was obtained, and a regulator’s historic approval does not prove the ownership remains unchanged.
Follow the money and customer obligations
Compare the operator named in the terms with the merchant shown on bank statements, card receipts, e‑wallet records and crypto instructions. Identify acquirers, payment facilitators and settlement entities. An intermediary can be legitimate, but unexplained recipients or changing descriptors may reveal an undisclosed operating company.
Use the payment-fraud investigation framework to preserve transaction IDs, descriptors, refund records and communications. Separately record who owes player balances and who handles withdrawals, complaints and data rights.
Review enforcement, disputes and continuity
Search regulator actions, court databases, insolvency notices and archived websites using every former name and domain. Distinguish allegations, interim measures, settlements, sanctions and final judgments. A fine does not automatically invalidate a licence; a surrendered or cancelled licence may still leave customer-refund obligations.
Look for business continuity after a licence change: the same accounts, login, balances, games, support staff or payment recipients appearing under a new domain or company. These links can justify further questions but do not alone prove common control.
Ask precise questions and grade the evidence
Send the operator a table of discrepancies: domain not found in a register, terms naming a different entity, unexplained payment recipient, ownership change or conflicting licence claim. Request documents and give a reasonable deadline for response. Ask the regulator only questions within its remit.
The final file should contain a dated relationship map and an evidence matrix. Classify each statement as verified, contradicted, supported by secondary reporting, inferred or unresolved. Quote licence status exactly and avoid labels such as “illegal” unless the applicable authority or law supports that conclusion.
The strongest investigation does not merely name a licence and shareholder. It shows which entity operated the exact casino, under which permission, in which market, during which period, who controlled it, and where customer money and responsibility actually sat.