General Commercial Gaming Regulatory Authority
The GCGRA is the UAE's sole federal regulator for all commercial gaming — lottery, internet gaming, sports wagering and land-based facilities. Operating without its licence is a criminal offence. We map your business to the right licence type and carry the application through, from the Intake Form and GLI technical certification to the Certificate of Operation and the compliance that follows.
Confidential & non-binding · Same-day response in UAE hours
ACTIVITIES
The GCGRA holds exclusive federal jurisdiction over all commercial gaming conducted in — or offered to persons within — the UAE. Its mandate covers four activity types, and the licence type you need turns on your role in the ecosystem: operator, vendor, or key person.
Conducting, supplying or facilitating any of these without a GCGRA licence is illegal and carries criminal penalties.
Casino games, bingo, poker and slot machines delivered in licensed physical venues — casinos and resorts offering slots, roulette, blackjack, baccarat and craps.
Casino-style games, poker and eSports-adjacent content delivered online, with strict geolocation and age verification.
Betting on the outcome of sports through licensed bookmakers and sportsbooks — online and on-premise.
Draw-based games matching numbers or symbols to win prizes — operators and their retail distribution network.
Suppliers of gaming equipment, software, platforms or related goods and services to licensed operators.
Beyond the entity, the GCGRA licenses the people behind it: Key Persons — corporate controllers, affiliates and management service providers, and the directors, executive officers and controllers who run the business — and Gaming Employees working for or connected with a licensee. Each is separately assessed for suitability and integrity.
MARKET
The UAE has moved from outright prohibition to a structured federal regime. Federal Decree-Law No. 25 of 2025 gave the GCGRA — established in 2023 and headquartered in Abu Dhabi — exclusive authority to license and supervise commercial gaming nationwide. The first licences are already live: Wynn Al Marjan Island for a land-based integrated resort, and The Game LLC for lottery. Getting in early, correctly licensed, is a genuine first-mover advantage and the only lawful way in.
STANDARDS
Gaming systems run on independently verified technical integrity and a compliance framework that holds up to continuous supervision. The GCGRA assesses this evidence before a Certificate of Operation is issued, and monitors for the life of the licence.
Independent GLI-19 certification of your internet gaming platform's random number generation, game logic and security controls.
GLI-33 certification of your sports wagering and event-betting systems, covering odds integrity and transaction accuracy.
Random number generators independently tested and certified for statistical fairness before any game goes live.
Verified geolocation controls that keep online play within the UAE's licensed boundary, blocking access from outside it.
A documented AML/CFT programme — customer due diligence, transaction monitoring and suspicious-activity reporting — sized to your gaming activity.
Player-protection tools — self-exclusion, deposit limits and problem-gambling safeguards — built into the platform, not bolted on after.
LICENCE TYPES
The GCGRA grants five licence types across two groups — entity licences for operators, vendors and corporate key persons, and individual licences for the people who run and staff them. A single business often needs several at once. Select a licence type to see who it's for and what it demands.
*Descriptions reflect the GCGRA's published framework and should be reconfirmed against the current rulebook for your exact licence type.
Every licence type, who it's for and what it demands, in one PDF, aligned to Federal Decree-Law No. 25 of 2025.
PROCESS
GCGRA authorisation runs in two stages: you earn In-Principle Approval on suitability before you build, then pass technical certification to receive your Certificate of Operation — so problems surface early, not after you've committed.
We notify the GCGRA by filing the Intake Form, naming your licence type and clearing the initial screening before anything else is committed.
On invitation, we open the licensing portal and file the full application: business plan, corporate structure, AML/CFT framework and key-person disclosures.
The GCGRA runs a rigorous suitability review — background, integrity, financial capability — and issues Approval with Conditions.
Build out systems, submit for GLI-19/GLI-33 technical certification, and complete your AML/CFT and responsible-gaming programme.
The GCGRA reviews certification results and evidence, and confirms every condition of your In-Principle Approval has been met.
Certified and verified — your Certificate of Operation is granted for your licence type, and live supervisory obligations begin.
You're authorised to operate — live supervisory obligations begin from day one.
Most applicants lose months in Stage 2 — underestimating the technical certification, AML/CFT and responsible-gaming evidence the GCGRA expects to see genuinely in place. Preparing that package properly, the first time, is the core of what we do.
The four things the GCGRA pushes back on most — and the four we harden before you file.
Directors and controllers without genuine suitability evidence — source of funds, integrity, track record.
Systems submitted for GLI certification before they're genuinely ready, costing months in re-testing.
Generic AML/CFT policies not tailored to gaming-specific risk and transaction patterns.
Player-protection controls asserted on paper but not genuinely built into the platform.
REQUIREMENTS
The licence type sets your path. But authorisation turns on a wider set of requirements — the ones applicants most often underestimate. Here's the full checklist, in the GCGRA's own terms.
A properly registered UAE entity is a precondition to licensure. Foreign companies may apply, but must first establish a UAE entity meeting all relevant corporate-licensing requirements.
The right entity licence — operator or vendor — plus the corporate and individual key person and gaming-employee licences that must sit alongside it. Many businesses need several at once.
Directors, executive officers, controllers, corporate controllers and connected employees are each separately licensed — every one assessed for suitability and integrity.
Genuine substance is expected: premises, infrastructure, trained staff and operating procedures, secured as part of satisfying your In-Principle Approval conditions.
Applicants and key persons undergo a rigorous suitability investigation — competence, source of funds, financial soundness and integrity. The GCGRA screens the people, not just the paperwork.
An adequate governance framework plus embedded player-protection controls: self-exclusion, limits, harm monitoring and education — proportionate to your operation and evidenced, not asserted.
DIFFERENCE
Getting the licence is one thing. Staying licensed — with compliance that holds up to supervision and security that holds up to attack — is another. We're the only Dubai advisor that carries all three in-house, so nothing gets handed off and dropped.
We don't coach from the sidelines. We run the whole file — perimeter analysis, entity, capital structuring, the full application, technical certification and every round of GCGRA questions — through to the Certificate of Operation.
AML/KYT screening, transaction monitoring and regulatory reporting on our own platform — so the controls you're approved on are the controls you actually run, not a slide deck.
Gaming systems live or die on certified technical integrity and security. Our sister firm ITSEC delivers the penetration testing, cyber controls and audit evidence in-house — and coordinates GLI certification — a capability no other licensing advisor has.
Three disciplines competitors outsource to three vendors. With KOLL Group it's one engagement, one accountable team — advisory, RegTech and cybersecurity under one roof.
HOW WE HELP
We map your activities to the correct GCGRA licence type and confirm what is — and isn't — in scope before you commit capital or time.
We prepare the full application, AML/CFT policy pack and key-person documentation, defend it through review — then keep you compliant after certification: AML, responsible gaming, reporting and audit.
The GCGRA expects certified technical integrity from day one. As part of ITSEC, we bring GLI certification coordination, penetration testing and incident-response into the application from the start — where others outsource it later.
CLASSIFICATION
Which GCGRA licence you need turns on your role in the ecosystem — operator, vendor or key person — and getting it wrong stalls the application before it starts. We place you correctly the first time.
You conduct the gaming activity directly — running the casino floor, the sportsbook, the internet gaming platform or the lottery draw. You need an entity Operator Licence, plus individual licences for your key persons and gaming employees.
Also applies to: retail distribution networks selling lottery products on an operator's behalf.
You supply gaming equipment, software, platforms or related services to a licensed operator without conducting the activity yourself. You need a Vendor Licence, and your own key persons still require individual licensing.
Watch the line: supplying a component is different from operating with it — cross into running the activity and an Operator Licence is triggered instead.
OBLIGATION
The GCGRA supervises actively and enforces its rules. Its toolkit escalates with the breach, and includes:
As a federal regulator, the GCGRA's enforcement actions carry weight across every Emirate — there's no lighter alternative jurisdiction to fall back on. Staying ahead of obligations is cheaper than answering for them.
Where KOLL takes it from here
Licensing is one part of the engagement. We also handle regulatory and compliance advisory across the application, RegTech implementation for KYC, monitoring and reporting, cybersecurity assurance for licensed operators — the technical and security side of platform approval — and ongoing compliance after your licence.
FAQ
It depends on your role: entity licences for Operators, Vendors and Corporate Key Persons, and individual licences for Key Persons and Gaming Employees. Most businesses need several at once — the entity licence plus the people licences that go with it. We confirm the right combination before the Intake Form is filed.
Central. The framework places heavy weight on player protection, integrity and AML. We build those controls into the application from the start.
It depends on the licence type and readiness of your controls. We give a realistic estimate after the eligibility assessment.
Reporting, AML and responsible-gaming obligations apply on an ongoing basis. We stay on to keep them met.
Yes, but a properly registered UAE entity must be established as a precondition to licensure — foreign incorporation alone isn't sufficient.
Yes. Conducting, supplying or facilitating commercial gaming without a GCGRA licence is a criminal offence carrying penalties up to permanent market exclusion.
With the Intake Form — naming your licence type and passing initial screening — before you're invited to file the full application through the licensing portal.
COMPARE REGULATORS
Each pathway is advised end to end. Explore the others — or the services that run across them.
The world's first dedicated virtual-asset regulator, covering all of Dubai. Read the guide →
Financial services in the DIFC — common-law, institution-facing, firm-led crypto. Read the guide →
Abu Dhabi's common-law free zone with a pioneering virtual-asset framework. Read the guide →
The federal securities regulator for the onshore UAE capital markets. Read the guide →
Banking, payments, e-money and exchange — the Central Bank of the UAE. Read the guide →
GameFi, NFTs and blockchain-based gaming often straddle the GCGRA and VARA. We classify your model and build the compliant route across both.
Advisory, RegTech and cybersecurity under one roof — pre- and post-licence support across every UAE regulator we work with.
Building trust in a new sector
Tell us your goals. In one confidential call we'll confirm the licence you need, the controls required, a realistic timeline and the exact next steps.
