A license mill is an informal, critical term for a jurisdiction, regulator or licensing intermediary that issues business licences quickly, cheaply and with little real scrutiny, so that the licence works more as a marketing badge than as evidence of supervision. The phrase is practitioner slang rather than a legal category. It is used most often about online gambling, but also about some payment, crypto and offshore company regimes.
The term borrows from "diploma mill", a body that sells qualifications without real teaching. A gambling license or financial licence from such a source usually allows the holder to say it is "regulated" while leaving it free to target players or customers in countries where it holds no permission at all. The idea sits close to regulatory arbitrage, but describes the supply side: the places and firms that make that arbitrage cheap.
License mill in plain terms
Think of a restaurant hygiene certificate. In most cities an inspector walks through the kitchen, checks the fridge temperature and comes back without warning. Now imagine a town where you can buy the same-looking certificate by post, with no visit and no follow-up. The paper on the wall looks official, and diners who never read the small print might trust it.
A license mill is that postal certificate office. The licence is real in the narrow sense that someone issued it, but nobody is watching the kitchen. Banks, card networks and foreign regulators eventually learn which certificates come from which town, and they start treating those licences as close to meaningless.
How licence mills operate
Commentators usually point to a common set of features when they call a regime a licence mill:
- Light entry checks. Applications are approved on paperwork alone, with limited verification of the ultimate beneficial owner (UBO), source of funds or business model.
- Delegated or resold permission. A private licence holder, rather than a public authority, grants permissions to many downstream businesses and earns fees for each one.
- Little ongoing supervision. There are few audits, no meaningful player or customer complaint handling and rare enforcement.
- Permission that does not match the business. The licence covers activity "from" the jurisdiction, while the actual customers sit in countries that require their own licence.
- A service industry around it. Agents sell ready-made companies, local directors and sometimes a nominee owner as a package with the licence.
These packages often rest on a shell company with no real staff or office in the licensing country. The result is an entity that looks complete on paper but cannot answer basic know your business (KYB) questions from a bank.
Curaçao and the online gambling example
The most cited case is Curaçao's old online gaming system. For more than two decades, a handful of private master-licence holders issued sub-licences to thousands of websites under a national ordinance dating from the 1990s. Critics described the sub-licence as the classic offshore gaming license: inexpensive, fast and rarely enforced.
Curaçao replaced that model with the National Ordinance on Games of Chance (known by its Dutch initials, LOK), which took effect on 24 December 2024. Under the new law the Curaçao Gaming Authority (CGA) issues licences directly, ending the master-licence and sub-licence chain. Holders of older sub-licences had to apply under the new regime or leave the market during a transition period.
By contrast, the Malta Gaming Authority (MGA) and the UK Gambling Commission (UKGC) are usually cited as demanding regulators, with ownership checks, player-protection rules and active enforcement. Whether a particular regime deserves the "mill" label is a judgement, not a legal finding, and reforms can change a jurisdiction's reputation over time.
Why banks and card networks care
The practical test of a licence is whether the financial system accepts it. Operators in online gambling (iGaming) need banks, payment processors and card acceptance to take deposits and pay winnings. A high-risk acquirer deciding whether to board a merchant will look at who issued the licence, which markets it actually covers and whether the owners are named and verified.
A weak licence fails several of those checks at once. Payment providers respond with enhanced due diligence (EDD), higher reserves or outright refusal. When a whole licence class loses credibility, institutions may apply de-risking across the board, leading to waves of offboarding. Card schemes add their own registration and monitoring rules for gambling merchants, so the scheme, not only the regulator, decides who can process.
A gaming licence also does not authorise the movement of player money. Collecting deposits and paying out winnings falls inside the payments perimeter, which usually requires separate gaming payment licenses or a licensed payment partner. Licence mills tend to blur this line in their sales material.
Risks and consequences
Regimes with weak oversight create three main problems. First, they attract operators that cannot pass review elsewhere, concentrating risk in one place and harming the jurisdiction's wider reputation, including its standing as an offshore financial centre (OFC). Second, ownership secrecy collapses when confidential files leak or are subpoenaed; a data breach at a licensing body can expose years of applications at once. Third, players and customers have little recourse when an operator stops paying, because the issuing authority has neither the staff nor the mandate to intervene.
When licences of this kind stop being accepted by banks, the businesses behind them rarely disappear. Some re-license in stricter markets, while others shift to crypto rails, unlicensed agents and other channels of the grey economy. Policymakers who tighten licensing therefore tend to pair it with enforcement against unlicensed money transmission and payment blocking.