Kahnawake Gambling License Requirements in 2026

A Kahnawake gaming licence requires a corporate applicant with clear ownership, demonstrated financial stability, fit-and-proper directors, shareholders and UBOs, and gaming infrastructure hosted on KGC-approved servers. Kahnawake is one of the oldest names in online gaming — the Kahnawake Gaming Commission has licensed operators since 1996 — and the credential still carries weight with players, partners and payment providers. But the licence that opens all of it, the Client Provider Authorization (CPA), issues only when your requirements file is complete. Applications rarely stall on the regulator; they stall on an unresolved UBO document, uncertified games, or hosting that has not been arranged in an approved facility.

This guide is the checklist we work from on our own desk. It sets out exactly what qualifies you for a CPA in 2026 and what you have to submit — grouped into Corporate, Compliance and Technical — and it covers the detail that makes Kahnawake distinctive: the provisional CPA, which lets you operate after an initial review of roughly three weeks rather than waiting out the full assessment.

The three buckets, at a glance

The Kahnawake Gaming Commission issues a single Client Provider Authorization that spans online casino, sports betting, poker, lotteries, eSports and crypto gambling — one licence, all verticals, at 0% corporate and gaming tax. To get it, your file has to satisfy three distinct sets of requirements. The KGC reviews people, structure and technology together, so a gap in any one bucket holds up the whole application.

The rest of this guide walks each bucket in the order you should assemble it. Costs sit outside scope here — for the full fee breakdown see the Kahnawake gaming licence cost guide.

Corporate requirements

The KGC licenses a corporate applicant with clear ownership — international operators apply as a company, not as an individual. The standard structure we use is straightforward: the applicant entity is incorporated in Costa Rica. There is no requirement to register a company on Kahnawake territory or appoint resident directors; the only location the regime cares about is where your servers live, which we cover below. That keeps the file remote from start to finish.

At application, the KGC expects a complete corporate pack for the applying entity:

• Corporate documents and ownership chart — certificate of incorporation, articles/statutes, share register and register of directors for the Costa Rica company, plus a chart that maps ownership all the way up to the ultimate beneficial owners. The KGC wants to see who ultimately controls the business, not just the named directors.
• Proof of financial stability — evidence that the applicant is adequately funded to run a licensed gaming operation. This is a genuine gate, not a formality: the Commission will not authorise an operator it does not believe can meet player liabilities.
• Business plan — describing your products, target markets, revenue model and the operational setup behind them. This is where the regulator forms its view of what you actually intend to run and which verticals you will launch under the CPA.

Pairing the CPA with a Costa Rica operating company is the norm for this regime, not a workaround. For how the entity, ownership and payment companies fit together, see our Kahnawake corporate structure breakdown.

Compliance requirements: due diligence and policies

This is the bucket that decides most timelines. The KGC runs due diligence on every director, shareholder and beneficial owner — not just the named applicant — and each of them has to clear the same bar.

Fit-and-proper checks. Every individual behind the company must pass background checks. In practice that means:

• no sanctions listings and no appearance on relevant watch lists;
• no disqualifying convictions, financial crime and fraud in particular;
• a demonstrable clean reputation and business history.

Source-of-funds evidence. For each UBO the KGC requires documented proof of where the funds behind the operation come from. Incomplete or vague source-of-funds files are the single most common cause of delay, because the Commission will not proceed on partial funds documentation.

Proof of domain ownership. You demonstrate that you control the domains you intend to operate. This ties the licensed activity to a verified operator and closes off applications filed against sites the applicant does not actually own.

Policies. Alongside the people, you file the programme that governs them in operation:

• AML/KYC policies — drafted to the regulator’s expectations and mapped to the FATF Recommendations, covering player identity verification, transaction monitoring for suspicious activity and record-keeping to industry standards. Because the CPA expressly permits crypto gambling, these must extend to the FATF Travel Rule for virtual-asset transfers.
• Responsible-gaming policies — self-exclusion, deposit limits, reality checks and firm controls to protect minors and vulnerable players.

The obligation does not end at issuance. You carry ongoing compliance reporting, annual renewal and a duty to actually operate the AML programme you filed rather than merely possess it. A written policy no one runs is a licence risk, not a safeguard. Our primer on iGaming AML and KYC covers what an operable programme looks like in practice.

Technical requirements

The third bucket is about game fairness and platform integrity, and it carries Kahnawake’s one hard infrastructure rule.

KGC-approved hosting (MIT). This is the requirement that sets Kahnawake apart. Your gaming infrastructure must run inside a KGC-approved data centre — the Mohawk Internet Technologies facilities the Commission oversees. It is the closest thing the regime has to a substance requirement, and it is non-negotiable: you cannot host the licensed platform on your own cloud of choice. Arranging approved hosting early is part of the two-to-three-week preparation phase, not something to leave until after filing.

RNG certification. If you run proprietary games, they must carry an RNG certificate from a recognised independent lab — fairness has to be demonstrable, not asserted. If you integrate from tested providers, you supply the integration agreements and rely on their certification. What the KGC will not accept is uncertified games with no documented provenance.

Technical and hosting documentation. Beyond the certificate, you submit documentation of the platform architecture, security controls and how the approved hosting is configured, plus the player-protection controls from the compliance bucket mechanised in software — deposit limits, self-exclusion and underage-play prevention rather than paper policies.

The provisional CPA: operating while you are reviewed

Here is the requirement most guides bury, and the reason many operators pick Kahnawake. You do not have to wait out the full compliance assessment to launch. After the KGC’s initial review — roughly three weeks — the Commission can issue a six-month provisional Client Provider Authorization that lets you go live while it completes the in-depth checks.

This is real regulatory cover, not a grey-zone soft launch. You operate under a genuine, if provisional, authorisation, generate revenue, and give banking and payment partners a live licence number to work with — while the KGC works through the deeper background, financial-stability and technical review in the background. Full authorisation typically lands within 8–16 weeks, comfortably inside the provisional term, provided your file was complete at submission. What can push you past it is the same thing that delays any application: an unresolved UBO document, missing source-of-funds evidence, or games that arrive uncertified. Our dedicated Kahnawake provisional licence guide walks the mechanics of the fast start in full.

Assembling the file in the right order

Requirements are one thing; sequence is another. The order that avoids rework is: incorporate the Costa Rica applicant company and arrange KGC-approved hosting first, assemble every UBO background and source-of-funds file in parallel, draft the AML/KYC and responsible-gaming policies against the actual operating model, then finalise the technical and hosting documentation and game certification before submission. Filing with gaps — a missing source-of-funds letter, unarranged hosting, an uncertified game — is what turns a clean provisional approval into weeks of back-and-forth.

None of it requires setting foot on Kahnawake territory, and none of it requires a local entity beyond the approved hosting. What it requires is a complete, internally consistent file that satisfies all three buckets at once. For the wider picture of how the licence works alongside these requirements — verticals, tax, comparisons and market limits — read our flagship Kahnawake gaming licence guide, and when you are ready to go live, the Kahnawake launch checklist sequences the final steps.

Ready to assemble your file, or want a second opinion on documents you have already prepared? Our team handles the full requirements pack end to end and will review any file against the KGC’s expectations. Book a free consultation and we will tell you exactly what is missing before you submit.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.