The US sports betting market is the largest regulated opportunity in online gambling, but it is also the most fragmented compliance environment in the world. Operators in Nevada face different rules from those in New Jersey, which differ again from Colorado, Michigan, or Louisiana. What passes an audit in one state can fail in another. And the technical requirements are not suggestions: they are statutory mandates with teeth.
If you are building or licensing a sports betting platform for the US market, the compliance layer is not something to integrate after the product is built. It determines the architecture.
The state-by-state reality
As of 2026, sports betting is legal and operational in more than 35 US states, with more in various stages of legislation. Each state issues licences through its own gaming commission and publishes its own technical standards. The major frameworks:
- New Jersey (DGE): one of the first movers, with detailed technical standards covering RNG, geolocation, responsible gaming, data retention, and audit logging. NJ approval is often used as a benchmark.
- Nevada (NGC/NGCB): the oldest regulated market; standards are well-established but focused on in-person as much as mobile.
- Michigan, Colorado, Pennsylvania, Virginia: newer frameworks that have incorporated lessons from NJ; generally require similar technical controls but vary on specifics like session limits and self-exclusion database integration.
- Tennessee: mobile-only market with specific revenue requirements and hold percentage mandates, unusual among states.
Operating across multiple states typically requires separate licence applications and sometimes separate technical certifications per state. Some operators use a single platform with configurable compliance modules; others maintain state-specific deployments. The former is more efficient but requires careful architecture.
Geolocation: the non-negotiable
Every US state requires that bets are placed from within state borders. This is enforced technically through geolocation, and it is audited rigorously. The standard approach:
- Device-level geolocation (GPS on mobile, IP on desktop) cross-referenced against state boundary polygons
- A third-party geolocation provider (GeoComply is the dominant player) that provides fraud scoring and VPN/proxy detection alongside location verification
- Geolocation check on every wager, not just at login
- Handling of edge cases: users near state borders, users on tribal lands with different jurisdictional rules, users in federal buildings
GeoComply integration is effectively mandatory for any serious US operator. It is not cheap (licensing costs are meaningful), but the alternative is failing a state compliance audit.
Responsible gaming mandates
US states are increasingly prescriptive about responsible gaming features. The minimum requirements in most states include:
- Self-exclusion: integration with the state's self-exclusion database (e.g., NJ's Casino Self-Exclusion Program). Accounts must be checked against this database at registration and periodically thereafter.
- Deposit limits: players must be able to set daily, weekly, and monthly deposit limits. Limit reductions must take effect immediately; increases must have a cooling-off period (typically 72 hours).
- Session and loss limits: some states require operators to offer these; others make them mandatory.
- Reality checks: periodic session reminders showing time played and amount wagered.
- Problem gambling messaging: specific language and links to resources required in-platform.
Building these as bolt-on features after the platform is live is difficult. They need to be first-class features in the account management and wagering systems, not an afterthought.
The technical audit and certification process
Before going live in a US state, the platform must pass a technical audit by a state-approved testing laboratory (GLI, BMM, eCOGRA are the major ones). The audit covers:
- RNG certification (for casino games, if applicable)
- Geolocation system verification
- Responsible gaming control verification
- Data integrity and audit log review
- Security penetration testing
- API and system integration documentation
The audit process takes weeks and requires comprehensive technical documentation. Common failure points: incomplete audit logs (every wager, session event, and responsible gaming action must be logged with timestamps and user identifiers), geolocation that does not handle edge cases correctly, and self-exclusion checks that have race conditions or gaps.
Architecture considerations for US compliance
A few design decisions that affect compliance posture from the ground up:
- Immutable audit logs: every bet, every login, every responsible gaming action logged to a write-once store. PostgreSQL with append-only tables works; dedicated audit log services are more auditor-friendly.
- Configurable compliance modules: deposit limits, session limits, self-exclusion checks should be configurable per state without code changes. Compliance rules change, and you will need to update them.
- Data residency: some states require that player data be stored within the US. Check requirements before choosing cloud regions.
- Uptime requirements: several states specify minimum uptime SLAs. Design for high availability from the start.
How we build US betting platforms at Anointed Coder
Our casino and betting platform development team has built platforms designed for regulated markets, including the US. We design the compliance module architecture before the core product work: geolocation integration, responsible gaming controls, audit logging, and self-exclusion flows are built into the platform, not added later.
We are UK-led with 20+ developers experienced across sports betting, casino, and regulatory environments in the US, UK, and EU. We work on milestone-based pricing with weekly staging demos, and you own the code and IP on payment.
For a broader look at betting platform options, our guide on white-label vs custom betting platforms covers the build-vs-buy decision in detail.
The short version
US sports betting compliance is state-by-state, and the technical requirements are statutory: geolocation on every wager, self-exclusion database integration, responsible gaming controls built into the wagering flow, and a platform that can pass a GLI or BMM audit. Build compliance in from the architecture stage, not the QA stage, and design the system to be configurable per state. The market is worth the effort; the compliance shortcuts are not.