Licensed vs. Offshore: What Kiwi Players Should Know About Online Casinos

New Zealand's online casino rulebook took its working shape on 8 July 2026, when minimum standards issued by the Secretary for Internal Affairs came into force. They took effect five days after the Online Casino Gambling Regulations 2026, and together the two documents turned an Act in force since 1 May into specific duties, from login security to the gap between one pokie spin and the next.

The market they'll govern came into focus this month. The Department of Internal Affairs (DIA) ran its licence auction from 29 September to 12 October, and after 10 rounds, 11 of the 32 bidders had won the right to apply for 15 licences between them, at $15 million each. The DIA expects to begin issuing licences from early 2027.

Put the new framework beside the Player Protection Directive of the Malta Gaming Authority (MGA) and the overlap is hard to miss. A licence from an established international regulator already brings most of the protections that guides tell Kiwi players to look for, and New Zealand has written the majority into its own licence conditions, adding a few of its own. One short checklist, learned now, will stay useful once local licences arrive.

New Zealand Already Treats Some Overseas Regulators as Comparable

Before this year, New Zealand had no way to license an online casino. The Gambling Act 2003 didn't provide for one, yet playing on an overseas site wasn't against the law, as a 2024 Cabinet paper acknowledged. Any protection came from the rules of wherever a site was licensed, and that stays true until New Zealand issues its own licences.

Dot Loves Data's analysis of card transactions for the DIA put the scale of that activity at $1.36 billion in the 12 months to September 2025. That total reflects money deposited, not money lost, and it was scaled up from one bank's records. Of that, 96.3% reached merchants in Malta, Great Britain, Gibraltar and Cyprus, each of which has its own gambling regulator.

The DIA's own licensing process recognises two of those regulators, plus two more. When it tests whether a licence applicant is financially sound, it counts Malta, Denmark, Ontario and the United Kingdom as comparable jurisdictions, and operators already licensed there face a lighter check.

So the useful distinction isn't onshore against offshore. A casino licensed by an established international regulator must meet that regulator's rules and can lose its licence for breaking them, while an unlicensed site has no regulator holding it to any standard at all.

A Strong International Licence Already Covers the Account and the Money

What does a strong international licence give the person behind an account? Casino.org's New Zealand guide answers with nine protections it credits to the overseas licences held by the sites it recommends, so a reader can check the best online casino options available against each one. They fall into four themes: the account, the money, fair games and play controls.

The account comes first. Casino.org's guide says its recommended sites protect payments and personal data with 128-bit or 256-bit encryption; an HTTPS address confirms the connection is encrypted. Two-factor login, an optional extra in the guide's list, adds a second code so a stolen password isn't enough on its own.

Identity and anti-money-laundering checks complete the account picture. The MGA lets its licensees take reasonable time over these checks before paying out, so uploading documents early can save a wait at the first withdrawal.

The money side of Malta's rules is especially detailed. Its directive treats balances held for players as their property, not the licensee's, and the licensee must make sure the bank holding them knows the operator's creditors have no claim on that money. The player funds account, counting money in transit, must always hold at least as much as every player balance combined.

Payouts follow set rules too. A licensee should pay within five working days where practicable, into the account the deposit came from where possible. If it can't, it mustn't impose unreasonable withdrawal restrictions or nudge a player to cancel a request. Fees have to be stated in plain language in the terms and on both the deposit and withdrawal pages.

Bonus terms fall under the same directive. Every term, promotional ones included, must be fair under Malta's consumer law and written in clear, intelligible language. The checklist then tells readers what to look for inside them: how many times a bonus must be played through, how much each game counts towards that, and whether winnings are capped.

Game Testing and Play Controls Follow Shared Standards

Fairness is harder to judge from outside, which is where testing labs come in. eCOGRA, the auditor named in Casino.org's checklist, is a private company set up in 2003 and based in Britain that tests and certifies gambling software; it isn't a regulator. It does appear on the UK Gambling Commission's list of approved test houses, cleared for Britain's remote technical standards, and the MGA can require a licensee to produce a lab's certificate of compliance.

Malta writes responsible gambling tools into its directive rather than leaving them to each operator. An MGA licensee must offer deposit or wagering limits and ask about them before the first deposit. A tighter limit applies at once, while a looser one waits 24 hours.

Players can also exclude themselves for a fixed period or indefinitely, and on repetitive games driven by a random number generator they can set pop-up alerts. Each alert pauses play and shows the session's time, stakes, wins and losses before the player chooses to stop or carry on. The directive also keeps responsible gambling information no more than one click from any page.

New Zealand's Licence Rules Cover the Same Ground, With Some Extras

New Zealand's regulations and minimum standards turn most of the checklist into licence conditions, as the table shows alongside what a player can check today.

Protection (New Zealand source)	What a player can check today	What a New Zealand licence requires
Encryption (Minimum Standards 2026)	An https web address	Security controls drawn from ISO 27001, cryptography included
Two-factor login (Minimum Standards 2026)	The account's security settings	Optional multi-factor checks for logins, new payment methods and password resets
Identity checks (Regulations 2026)	When the site first asks for ID	Identity and age verified before the account opens
Player money (Regulations 2026)	The regulator's rules on player funds	Customer balances kept in a separate bank account
Payouts (Regulations 2026)	Fees and limits on the withdrawal page	No cancelling a requested withdrawal, and payment without undue delay
Bonus terms (Regulations 2026)	Wagering, game weighting and caps	Clearly stated terms, with 60 days or more to fulfil them
Game fairness (Minimum Standards 2026)	The lab named on a testing seal	Cryptographically secure random number generation, monitored continuously
Play controls (Regulations 2026)	The limits and exclusion pages	Time, deposit and spend limits, offered at sign-up
Fraud prevention (Regulations 2026)	The site's security and fair-play policy	Processes that detect cheating, collusion and bots

In several places New Zealand's licence rules go further. A player must be able to cash out bonus winnings without first having to bet them again, and no inducement can be worth more than $100. Autoplay is banned, a customer can play only one pokie at a time, and at least 2.5 seconds must pass between the start of one round and the next.

Games must also show a player's net position since the game began and give the theoretical return to player as a percentage, and where a game comes in several versions, the DIA's guidance says the operator must make clear which return applies. Customers who haven't set limits get a fresh prompt every month, time-outs range from 24 hours to three months, and live support must be available at all times.

Two checklist points, lab testing and 24/7 monitoring, get their fullest treatment in a discussion draft the DIA released in September 2026. It would approve test houses on the UK Gambling Commission's list, eCOGRA among them, plus labs registered in Ontario and three that already test New Zealand's land-based gambling. Games an approved lab had already certified to British or Ontario standards wouldn't need retesting when a licence starts, and operators would have to watch constantly for hijacked accounts and credential-stuffing, bot and denial-of-service attacks.

None of these protections changes the maths of the games. A verified random number generator and a published return to player describe the house edge accurately; they don't remove it.

Local Licences Will Add a Complaints Route Close to Home

The next milestone is 1 December 2026. From that date, only auction winners with a licence application lodged may go on serving New Zealand customers while the DIA works through their applications. Each applicant still faces a full assessment, because winning the auction only earned the right to apply.

Once licences are issued, complaints gain a local route. A licensed operator must explain its complaints process on a page anyone can read without logging in, and under section 45 of the Act it has 40 working days to look into a complaint and reply. A customer can also take the matter to the DIA.

Players using an MGA-licensed site already have a route of their own. The authority's complaint form is the formal channel for disputes with its licensees, it handles cases written in English or Maltese, and it asks players to try the operator first. Its licensees must also offer referral to a registered alternative dispute resolution body when a complaint isn't settled.

Age rules differ by setting. Licensed online casinos must confirm that customers are 18 or over, while casino floors keep a minimum age of 20, a rule that a Love New Zealand post on local gambling rules sets out alongside the dress code: no jeans and jandals. That post also points readers to PGF Services, and anyone who wants to talk about their gambling can call the Gambling Helpline free on 0800 654 655 or text 8006.

Every Licence Points Back to a Register a Player Can Check

Checking a licence will get easier in New Zealand. According to the DIA's guidance for people who play online, a public register will list every licensed online casino, and each one will display its own registration icon, both on its site or app and in its advertising.

That icon has to show up the moment a page loads and must link through to that operator's listing on the register; audio ads get an audio mark instead. Brand names behind the 11 auction winners will appear on the register only once licences are granted, because operators may still change them during the application process.

Sites licensed in Malta can be checked the same way today. The MGA's licensee register includes a URL checker for testing whether a web address is linked to one of its licences, and the authority keeps a list of addresses that falsely claim its licence; a .nz domain joined that list on 7 September 2026.

The habit that works under either system is short: find out who issued a site's licence, then look the site up on that issuer's register. It takes a minute with a Maltese licence today, and it will work the same way with a New Zealand one once the DIA's register goes live.