New Zealand Sets Technical Minimum Standards for Online Casinos

On 8 July 2026, New Zealand’s Online Casino Gambling (Minimum Standards) 2026 came into force, establishing a mandatory set of technical and organisational requirements for every online casino platform seeking a licence. The instrument completes the architecture of the new regulatory regime, supplementing the previously adopted Online Casino Gambling Regulations 2026 and the enabling Act. The timing is deliberate: on 17 July 2026, the Department of Internal Affairs (DIA, the body administering the regime) will open EOI (expression of interest) intake, meaning the requirements across all 19 standards must already underpin the design decisions of any prospective operator.

The minimum standards cover three major areas: harm prevention and minimisation (standards 5–10), consumer protection (standards 11–16), and information security with hosting restrictions (standards 17–19). The following are the key principles that set the tone for the entire document:

• A systemic 24-hour cooling-off rule before any increase or removal of limits and any relaxation of protective settings
• Self-exclusion: verification against the self-exclusion register upon account activation and at every login
• Platform access restricted to New Zealand only, with mandatory measures against VPN and proxy circumvention
• RNG must be “sufficiently random”; adaptive and compensated games are prohibited
• A set of controls from ISO/IEC 27001:2022 Annex A without mandatory certification, but with demonstrable compliance
• Payment service providers must comply with PCI DSS v4.0.1 (2024)
• Prohibition on hosting and processing data in jurisdictions capable of harming New Zealand’s international reputation

The relevance of such regulation grows year on year as online casinos become increasingly popular in the country. This is largely driven by active marketing campaigns conducted by dozens of brands in the local market. Analysts note that a particularly significant role in attracting new audiences is played by the free spins no deposit bonus, as the volume of such promotional offers has grown considerably over the past two years. It is precisely these kinds of incentives that bring into the industry people who previously had little interest in online gambling, which in turn increases pressure on the regulator and explains why DIA is seeking to embed protective mechanisms before the first licences are issued.

Part One: Built-in Harm Protection, Not Declarations on Paper

Standards 5–10 establish a functional framework that must operate at the system level. Neither internal procedures nor manual exceptions can substitute for architectural solutions. The central element of this section is the 24-hour cooling-off rule.

Limits, Play Breaks and Time-Outs Under a Strict Timer

Standard 5 requires that limits (time, deposit and spend/loss limits) be accessible at any point, including on deposit pages, and configurable via free-text entry. Where multiple limits are active simultaneously, the lower limit applies. Increasing or removing a limit is technically impossible before 24 hours have elapsed. Standard 6 extends the same logic to play breaks, time-outs and pop-up notifications: any relaxation of these settings requires an equivalent system-enforced waiting period.

Standard 7 introduces a “live” self-exclusion register. A one-time check at registration is insufficient: the platform must verify against the register at every user login in real time, without perceptible delay. Standard 8 requires round-the-clock customer support that is adequately staffed and capable of responding in real time, rather than merely existing in a formal sense.

Jackpots and Game Design: Responsibility Remains with the Licensee

Under Standard 9, progressive jackpot rules must be accessible within the game and must describe the funding mechanism, seed and ceiling, and the win-determination process. When a jackpot pool is decommissioned, contributions are returned equitably, with priority given to those who made them. Even where the jackpot is a networked jackpot provided by a third-party supplier, responsibility lies with the licensee.

Standard 10 sets game design parameters that may require significant reworking of typical offshore platforms:

• A minimum of 2.5 seconds between game rounds for all game types; autoplay may not circumvent this requirement
• Each game round must be initiated by a separate, deliberate action; continuous contact does not initiate a new round
• Simultaneous play on multiple slots is prohibited
• The player must always be able to see the time, even in full-screen mode
• Where the paid version differs in RTP from its free-play equivalent, this information must be disclosed to the player before placing a bet

Part Two: The User Journey Controlled from Login to Player-Favourable Settlement on Service Interruption

Standards 11–16 establish the logic of “know who is playing, from where, and on what terms.” Standard 11 requires unique account identification, MFA for sensitive operations (adding a new payment method, password reset) and automatic logout on inactivity of no more than 30 minutes. Standard 12 restricts platform access to persons located in New Zealand and requires operators to take reasonable measures against circumvention via VPN. IP geolocation alone may be insufficient; the approach should be documented for DIA audits.

Standard 13 introduces the player-favourable settlement on service interruption rule: either the amount won at the point of failure is paid out, or the stake is returned — whichever is more favourable to the player. For live dealer games, determining the “amount won at the point of failure” may be non-trivial. Standard 14 prohibits adaptive and compensated games and requires that the random number generator be cryptographically secure and continuously monitored. Standard 15 requires the use of commercial-casino-grade equipment, access logging and CCTV surveillance in live dealer studios. Standard 16 addresses peer-to-peer games: real-time control of positions and identities, with log retention in a format suitable for DIA investigations.

Part Three: Cybersecurity, Payments and Data Geography

Standard 17 prescribes compliance with a defined set of controls from Annex A of ISO/IEC 27001:2022. Formal certification is not required, but compliance must be demonstrable. Standard 18 places the PCI DSS v4.0.1 obligation on payment service providers, but the operator must embed this requirement in its contracts. Standard 19 prohibits the hosting and transfer of customer data in jurisdictions capable of damaging New Zealand’s reputation; no country list is provided, and assessment is conducted on a case-by-case basis.

DIA audits will require ISO controls mapping, PCI DSS confirmations from PSPs, data flow diagrams listing regions and risk assessments, as well as technical documentation on VPN detection and RNG testing.

Three Phases of Preparation: From gap analysis to Go-Live

Although the platform need not be live at the time of EOI submission, it must be fully compliant with all standards by the time the licence is granted and the 90-day go-live window commences. Prior to EOI submission, it is advisable to conduct an initial gap analysis across all 19 standards, design the systemic 24-hour cooling-off mechanism, and request preliminary compliance confirmations from game, jackpot and PSP suppliers.

Between EOI submission and the licensing decision, operators must implement self-exclusion checks at every login, geoblocking with VPN detection, net position display, RNG anomaly deactivation protocols and access logging in live dealer studios. Concurrently, supplier contracts should be updated, responsibility for contribution refunds upon jackpot pool closure clarified, and PCI DSS obligations formally embedded. Within the 90-day go-live window following licence issuance, final validation is conducted, RNG monitoring and geolocation controls are activated, and genuine round-the-clock support operations are verified.