Regulating Online Casinos: Federal vs. State Jurisdiction
Informational only. Not legal advice.
The call came late on a Thursday. A small team in Jersey City had just gone live with an online casino under a New Jersey license. Day one looked solid. Then card deposits started to fail. Their bank’s risk team had flipped a switch. “It’s a federal thing,” the banker said, and hung up. The founders stared at the screen. They had done what the state asked. Why was this still happening?
This is the U.S. in a nutshell. States run the front desk for online casinos. But federal rules still sit in the back room, watching payments, money flows, and anything that might cross a border. The line is not a neat line. It is layers. You feel those layers when a card gets declined, when a poker pool can cross state lines but a roulette pool cannot, or when an office in Washington publishes a memo and the whole market shifts.
Below is a plain‑English guide to what Washington controls, what the states own, and where the parts grind. If you play, run a site, or write about this space, this map will keep you on the right side of the rules—and save time when something breaks.
First, the federal floor: what Washington really controls
Several federal laws shape online casinos, even when a state says “yes.” The old one is the Wire Act (18 U.S.C. §1084). It bans sending sports bets or betting info across state lines by wire. For years, some read it as a wider ban. Today, most courts read it as a sports law. But the idea is the same: keep bets inside one state unless there is a clear deal that says otherwise.
The money pipes face the Unlawful Internet Gambling Enforcement Act (UIGEA). This does not make legal gambling illegal. It tells banks and payment firms to block payments tied to unlawful internet gambling. That means banks must check: is this bet lawful where it starts and where it ends? If a bank cannot be sure, it may just decline. That is why cards still fail, even in legal states.
Anti‑money‑laundering rules are also federal. Under the Bank Secrecy Act, casinos are “financial institutions.” The U.S. Treasury’s FinCEN sets duties like KYC (know your customer), CTRs (cash transaction reports), and SARs (suspicious activity reports). See FinCEN guidance for casinos. Online casino operators and their payment partners must build controls, train staff, and report.
Then there are opinions from the Department of Justice’s Office of Legal Counsel (OLC). In 2011, the DOJ said the Wire Act applies to sports betting, not other games; read the 2011 DOJ OLC opinion. In 2018, the DOJ tried a broader view; see the 2018 OLC reversal. Courts later pushed back. Still, these memos remind us: federal voices can move markets, even if courts correct them later.
One more piece: tribal gaming. Congress passed IGRA in 1988. It set the frame for tribal casinos and compacts with states. While most online casino law is state‑made, tribes and states still work under this federal umbrella for compacted gaming.
Where the states take the wheel
States do the day‑to‑day work. They write the rules for licenses, approve games, set age and ID checks, and handle complaints. New Jersey was an early mover and still sets a high bar. See the New Jersey Division of Gaming Enforcement for how a mature iGaming state runs filings, audits, and tech rules.
Pennsylvania and Michigan also built full programs. The Pennsylvania Gaming Control Board and the Michigan Gaming Control Board publish supplier lists, testing notes, and player resources. Nevada allows online poker, not full casino. Other states—Connecticut, Delaware, West Virginia—took different sized steps.
States also run responsible gambling rules. That means self‑exclusion, cool‑off tools, ad messages, and checks on bonus offers. States license vendors, not just the main brand. Labs test games. Servers run in‑state. The system is tight by design: you must be inside the state, of legal age, and pass ID checks that match your name to public and private data.
Tribal gaming adds a layer. Under the Indian Gaming Regulatory Act, tribes and states sign compacts that can cover online play. Some compacts permit online games; some do not. The text of each compact matters.
Where the gears grind: pain points you can feel
Shared player pools show the split best. The Multi‑State Internet Gaming Agreement (MSIGA) lets states share online poker liquidity. Michigan joined. You can read the agreement text here: Multi‑State Internet Gaming Agreement. Why poker but not slots and table games? Poker is player‑versus‑player. Slots and roulette are house‑banked. Crossing lines for house games triggers other issues under state law and policy, and raises fresh Wire Act questions. So, for now, casino pools stay in one state.
Payments are another rub. UIGEA tells banks to block “unlawful” internet gambling. Many banks choose caution. Some cards still fail. ACH and select e‑wallets tend to clear more often. Clear merchant codes, good data, and a strong AML program help, but do not fix all of it.
Ads can also trip you up. Truth in ads is a long‑standing rule at the federal level. See the FTC advertising guidance. States add fair‑play rules too. Fine print must be clear. No bait. Do not target minors. Bonus terms must be up front, in plain words.
What about crypto or offshore sites? Crypto adds extra AML flags and does not dodge UIGEA. Offshore sites may take U.S. bets, but they are not state‑licensed. That means no state help if there is a dispute, and real legal risk for operators and, at times, for payment partners.
Operator reality check: the compliance stack
If you run an online casino, think in stacks: federal risk at the base, state rules on top. Here is a simple view of the moving parts you must cover to sleep at night.
- KYC and AML: verify name, age, address; screen sanctions; monitor play; file SARs and CTRs; train staff; test controls. Your AML program should match your risk. Cookie‑cutter plans fail audits.
- Geolocation: fence the state line with device checks, Wi‑Fi triangulation, IP tools, and fraud blocks. Prove it works. Keep logs.
- Licensing: the brand, the platform, the payment firms, the game studios, and often key staff all need approval. Update the state when ownership or key roles change.
- Game testing: get labs to certify RNGs, RTP, and integrations. Post RTP ranges if the state asks. Keep change controls tight.
- Responsible gambling: self‑exclusion lists, deposit and loss limits, time reminders, easy opt‑outs, and no‑nonsense help links.
- Advertising and bonuses: clear terms, no dark patterns, fair headline claims, age gates, and tailored messages. Keep screenshots of live promos for your records.
- Incident response: have a plan for outages, DDoS, data leaks, or game bugs. Know who calls the state and how fast.
- Reporting: monthly and quarterly data, taxes, and incident logs. Expect surprise audits.
To track the bigger picture across states and revenue trends, many teams watch the American Gaming Association research. It helps put your own numbers in context and spot policy moves early.
Player’s angle: how to stay on the right side
As a player, you want safety and fair play. Here is a fast checklist before you deposit.
- License check: the site should name the state regulator and show an active license number in the footer. Click it. Read the page it points to.
- Location: you must be in the legal state to bet. If a site lets you play from a banned state, stop. That is a red flag.
- Payments: prefer methods that allow chargebacks or clear dispute paths. Cards may fail; ACH or approved e‑wallets often work better.
- Bonus terms: look for wagering rules, time limits, and game weight. If you cannot find or understand them, skip the promo.
- Help and complaints: a real address, phone or chat, and a clear way to file a complaint with the state board.
- Limits and tools: can you set deposit, loss, and time limits fast? Is self‑exclusion one click away? Good sites make this simple.
For neutral guidance on offers and the fine print, independent bonus explainers like Casino Promotionen (German‑language) can help you compare welcome deals and, more important, spot tricky rollover terms before you deposit.
Quick map: who does what (table)
| Payment processing | UIGEA; bank risk programs | Approve gateways and vendors | Card acceptance varies; ACH and select e‑wallets often work best |
| Interstate transmissions | Wire Act; DOJ enforcement | Intrastate servers; geofencing | Keep casino play in‑state; poker pools can share via MSIGA |
| AML/KYC | Bank Secrecy Act; FinCEN | Enhanced due diligence in licensing | KYC vendors, SARs/CTRs, audits, training |
| Licensing of operators | N/A (no federal license) | DGE (NJ), PGCB (PA), MGCB (MI), etc. | Suitability checks for owners, key staff, vendors |
| Game certification | None direct; labs operate under state rules | Approve labs; set testing standards | RNG/RTP verified; change control and versioning required |
| Advertising and UDAP | FTC truth‑in‑ads backdrop | Ad content rules; RG messages | Clear bonus T&Cs; no targeting minors; no dark patterns |
| Taxation | Federal income tax for players | GGR taxes; state and local rates | Operator margins depend on state rates and promo deductions |
| Dispute resolution | Federal courts (rare cases) | State complaint portals; ADR | Players file with state if the operator fails to resolve |
| Tribal gaming | IGRA framework | Tribal‑state compacts | Online terms vary by compact; check the text |
| Responsible gambling | Public health programs (indirect) | Self‑exclusion; limits; messages | Visible tools and trained support teams are mandatory |
| Data privacy and security | Sectoral laws (e.g., GLBA) | Cyber rules; audits; breach notices | Encryption, access logs, and vendor risk reviews |
| Enforcement | DOJ; U.S. Attorneys | State AGs; gaming boards | Fines, suspensions, and, in rare cases, criminal actions |
Timeline snapshot: the law in motion
- 1961 — Congress passes the Wire Act to target interstate sports betting by phone and telegraph.
- 2006 — UIGEA becomes law. Banks must block payments tied to unlawful internet gambling. Compliance teams build filters.
- 2011 — DOJ issues an opinion that the Wire Act applies to sports betting only. Online lotteries and casino games breathe easier. See the document above.
- 2018 — DOJ releases a reversal. Uncertainty returns. States and lotteries sue.
- 2019–2021 — Federal courts side with New Hampshire’s lottery and limit the 2018 view. Read the New Hampshire Lottery case.
- 2021–2022 — IGT sues the DOJ to protect lottery and iGaming lines from broad Wire Act claims; see IGT v. DOJ for filings.
- 2024+ — MSIGA grows as more states join for poker. Full casino liquidity sharing still sits off the table. Expect more payment and AML focus, not less.
Fast answers to tricky questions (FAQ)
Is online casino gambling federally legal in the U.S.?
There is no single federal “yes” or “no.” Federal law sets guardrails (Wire Act, UIGEA, AML). States decide whether to allow online casinos and how to license them.
What parts are truly federal?
Interstate transmissions, payment rules under UIGEA, and AML under the Bank Secrecy Act. Ads also sit under federal truth‑in‑ads rules, with states adding more.
Can states share player pools for casino games?
Poker, yes, via MSIGA. House‑banked casino games, no—not today. Policy and legal risk keep those intrastate.
How do tribal‑state compacts affect online casinos?
Compacts can permit or limit online play for tribes. Each compact is unique. You must read the text and any amendments.
Why do some banks still decline gambling deposits?
UIGEA pushes banks to avoid unlawful internet gambling. If risk rules cannot confirm a legal transaction, they may block it. Choose approved methods in your state.
What should players check before depositing?
License number, location checks, clear bonus terms, real support, and a path to file with the state board. Neutral explainers like Casino Promotionen help compare offers.
Bottom line
Think of U.S. online casinos as a two‑layer system: a federal floor and state house rules. Washington cares about what crosses borders, how money moves, and how you fight financial crime. States handle the rest: who gets a license, which games run, and how players get help. If you operate, design your stack with both layers in mind. If you play, stick to state‑licensed sites, read bonus terms, and use tools that help you set limits. This way, you keep the fun—and cut the risk.
About the author
Alex Morgan is a compliance writer with a J.D. and 8+ years covering U.S. gaming law, payments, and AML programs. Alex has interviewed regulators and operators in NJ, PA, and MI and tracks enforcement trends across states.