New Zealand iGaming Compliance: What Operators Need to Know in 2026
Table of content
New Zealand is moving to a regulated and capped online casino market under the Online Casino Gambling Act 2026. With up to 15 online casino licences available, operators looking to serve New Zealand players now need to prepare for a new framework covering licensing, KYC, AML, player protection and geolocation.
The timeline is already underway, with Expressions of Interest closing in August and the licence auction scheduled for September 2026. 1 December 2026 is the key transition deadline: operators that have not applied for a licence must stop offering online casino gambling to New Zealand players.
For operators entering the market, the focus now shifts from understanding the legislation to putting the right compliance infrastructure in place, from age and identity verification to transaction monitoring, fraud detection and location controls.
New Zealand iGaming legislation: timeline and key dates
The new New Zealand online casino law is being introduced through a staged licensing process overseen by the Department of Internal Affairs (DIA). The key milestones are:
- April 2026: Online Casino Gambling Act 2026 receives Royal Assent.
- 1 May 2026: The Act comes into force.
- 3 July 2026: Supporting regulations come into force.
- July–14 August 2026: Expressions of Interest (EOI) open and close.
- September 2026: Online casino licence auction is scheduled.
- 1 December 2026: Application Deadline. Operators that have not applied for a licence must stop offering online casino gambling to New Zealand players.
With the licensing process now underway, operators should focus on ensuring their KYC, AML, geolocation, fraud and player-protection controls are ready to support the requirements of the new regime.
What the Online Casino Gambling Act 2026 requires from operators
The Online Casino Gambling Act 2026 combines licensing requirements with obligations around consumer protection, harm minimisation, information retention, advertising and access to gambling platforms. The accompanying regulations and minimum standards add significant technical and operational detail.
Age verification and KYC
Operators must ensure gamblers are at least 18 years old. The Act establishes the age requirement, while the regulations include requirements relating to collecting and verifying customer identity information. The wider compliance framework therefore requires operators to have reliable identity and age controls at the customer journey’s critical points. For an iGaming platform, this means integrating KYC and identity verification into registration and account activation processes rather than treating verification as a separate, manual compliance task. A robust KYC approach can combine document verification, liveness checks, age estimation and identity signals to establish whether a customer should be permitted to proceed.
AML/CFT and transaction monitoring
AML/CFT requirements remain a key part of the New Zealand compliance environment. The DIA provides specific AML/CFT guidance for online gambling operators, including requirements around risk assessment, AML/CFT programmes, customer due diligence and risk-based controls. Operators therefore need processes capable of identifying unusual customer behaviour and transaction patterns over time. Monitoring should extend beyond onboarding to deposits, withdrawals and account activity, with risk-based rules supporting investigation and escalation where appropriate.
Harm minimisation and player protection
The new framework places significant emphasis on harm prevention and consumer protection. The regulations require operators to provide tools including:
- Time, deposit and spend limits
- Breaks-in-play and time-outs
- Pop-up alerts
- Self-exclusion mechanisms
- Processes for addressing problem gambling
- Appropriate customer support
- Controls around loyalty programmes, inducements and potentially harmful game features.
The technology standards also require self-exclusion information to be checked before account activation and at login, with access prevented where a customer is identified on the relevant self-exclusion register.
Geolocation and access control
Geolocation compliance New Zealand iGaming is another critical requirement. The minimum standards state that an online casino platform must only be available to people who are physically in New Zealand. Operators must use reasonable mechanisms to detect customer location, block access where location cannot be verified, and take reasonable steps to identify and mitigate VPNs, proxies and similar technologies that could circumvent location controls. This makes location verification an ongoing control rather than a one-time registration check. Operators need the ability to apply location policies across relevant customer journeys, including registration, login and transactional events.
Advertising and affiliate rules
Advertising is also tightly regulated. The Act prohibits unlicensed online casino gambling advertising, while the regulations establish permitted and prohibited forms of advertising and marketing. The DIA has also highlighted restrictions affecting third-party advertising, including affiliate arrangements and paid endorsements. During the transition, online casino gambling advertising to New Zealand customers remains prohibited, with licensed operators able to advertise subject to restrictions once the licensing regime is operational.
Enforcement and penalties
The DIA is responsible for administering the new online casino gambling regulatory system. The Act provides enforcement mechanisms including formal warnings, enforceable undertakings, take-down notices and pecuniary penalties. The transition deadline is particularly important: from 1 December 2026, providers that have not applied for a licence must cease conducting online casino gambling in New Zealand.
How Bespot Gatekeeper maps to New Zealand’s compliance requirements
Compliance technology does not replace an operator’s legal or regulatory responsibilities. However, a unified risk and compliance gateway can help bring multiple controls together and provide consistent risk signals across the customer lifecycle. Bespot Gatekeeper combines digital footprint and device intelligence, KYC workflows, AML and transaction monitoring, geolocation policy hooks and responsible gambling signals into a single risk and compliance layer.
| NZ Regulatory Requirement | Gatekeeper Capability | How Gatekeeper Supports Compliance | Status |
| Customers must be physically located in New Zealand | Location Verification | Verifies location signals at session level to help operators enforce NZ-only access. | ✅ |
| Detect and verify the location of customers accessing the platform | Location Verification | Provides location intelligence that can be incorporated into real-time access and risk decisions. | ✅ |
| Block access where the customer’s NZ location cannot be verified | Location Verification | Supports compliance by enforcing an absolute access control that blocks access when the customer’s location cannot be verified as being within New Zealand. | ✅ |
| Identify and mitigate VPN, proxy and similar location-circumvention technologies | VPN Detection + Network Intelligence | Detects VPN usage and related network signals that may indicate an attempt to circumvent geographic controls. | ✅ |
| Detect attempts to manipulate the device’s reported location | Mock GPS Detection | Identifies device-level signals associated with location manipulation, strengthening location verification beyond IP-based checks. | ✅ |
| Maintain confidence in the integrity of the accessing device/environment | Device Intelligence + Developer Mode Detection | Provides additional device-integrity signals that can be used to identify higher-risk or manipulated environments (jailbreak, root, app cloning, and MITM attacks). | ✅ |
| Prevent prohibited behaviour in peer-to-peer casino games | Device Intelligence + Multi-Account Detection | Correlates device and account signals to identify potentially prohibited relationships between players/accounts. | ✅ |
| Prevent a player from playing against themselves or occupying multiple seats | Multi-Account Detection | Identifies multiple accounts associated with the same or related devices, helping operators detect potential self-play or multi-account behaviour. | ✅ |
| Maintain traceability of customer activity across accounts and sessions | Device & Session Intelligence | Adds device-level context to account activity, helping operators investigate suspicious relationships and sessions. | ✅ |
| Protect against suspicious or compromised account access | Account Security / Device Intelligence | Uses device and behavioural signals to identify anomalous access patterns that may indicate account takeover or compromised sessions. | ✅ |
| Detect automated or non-human interaction | AI Agent Detection | Identifies emerging automated or AI-driven interaction patterns that may present a new fraud or abuse risk. | ✅ |
| Identify and mitigate bonus / promotional abuse | Bonus Abuse Detection + Multi-Account Detection | Helps identify users creating or controlling multiple accounts to exploit bonuses, promotions or other incentives. | ✅ |
Preparing Your Compliance Stack for New Zealand
As operators prepare for NZ iGaming licensing, meeting the new requirements will depend not only on individual compliance tools, but on how effectively those controls work together across the customer journey. Before entering the New Zealand market, operators should make sure their compliance infrastructure can:
- Verify age and identity early in the customer journey, before allowing customers to proceed to key account or payment stages.
- Monitor deposits and withdrawals using configurable rules and real-time risk signals.
- Detect linked accounts and suspicious behaviour, including multi-accounting, bonus abuse and account takeover patterns.
- Verify player location and enforce New Zealand access policies at key touchpoints, including registration, login, deposits, and withdrawals.
- Connect responsible gambling signals with existing player-protection tools to identify unusual or potentially risky behaviour.
- Maintain clear audit trails of verification checks, risk decisions and compliance actions.
- Bring risk signals into one workflow, giving compliance and fraud teams a more complete view of each customer and account.
This is where a unified risk and compliance layer can make a practical difference.
How Bespot Gatekeeper supports a connected compliance workflow
Bespot Gatekeeper brings together device, transaction, location and behavioural risk signals, helping operators apply consistent controls throughout the customer lifecycle. Instead of managing separate checks across disconnected systems, operators can use Gatekeeper as a risk layer across key stages of the journey:
Device Intelligence → Geolocation → Transaction Risk → Behavioural Signals → Compliance Actions
For operators preparing to enter the New Zealand market, this means building compliance infrastructure that is designed not only for onboarding, but for ongoing monitoring, fraud prevention and risk management throughout the customer lifecycle. Bespot Gatekeeper provides a unified risk and compliance layer for identity, fraud, transactions, geolocation and behavioural risk signals.
Talk to Bespot or request a Gatekeeper demo to explore how Gatekeeper can support your New Zealand iGaming compliance strategy.
This article is for informational purposes only and does not constitute legal advice.
FAQ
Do offshore operators need a New Zealand licence?
Under the new framework, operators providing online casino gambling to people in New Zealand will need to participate in the new licensing regime. From 1 December 2026, providers that have not applied for a licence must cease operating in New Zealand.
What happens after 1 December 2026?
From 1 December 2026, providers that have not applied for a licence must stop conducting online casino gambling in New Zealand. Providers that have submitted a licence application can continue operating under the relevant exemption while their application is considered.
How does geolocation work under the new rules?
The platform must only be available to people who are in New Zealand. Operators must have reasonable mechanisms to detect customer location, block access where location cannot be verified and take reasonable steps to identify and mitigate VPNs, proxies and similar technologies that could circumvent location detection.
How many online casino licences will be available?
The new market is capped at up to 15 online casino licences. The licensing process uses three stages: Expression of Interest, competitive auction and full licence application.
Who regulates online casino gambling in New Zealand?
The Department of Internal Affairs (DIA) is responsible for implementing and administering the new online casino gambling regulatory system. The DIA provides licensing information, regulatory guidance, minimum standards and resources for operators.
