Online Casino Gambling Minimum Standards

About the minimum standards

The Online Casino Gambling Minimum Standards establish a clear and transparent baseline of requirements, providing certainty for operators and supporting efficient and consistent regulatory oversight. The minimum standards work together with the Online Casino Gambling Regulations 2026. Together, the Regulations and minimum standards set out both:

the legal framework operators must meet, and
the technical and operational detail that sits alongside it.

Review both documents together to get a full picture of how the requirements apply to licensed operators.

Supporting documentation

Online Casino Gambling (Minimum Standards) 2026

Download the minimum standards

View a PDF version of the Online Casino Gambling (Minimum Standards) 2026 (PDF, 295KB).

Minimum standards

These minimum standards are made under section 80 of the Online Casino Gambling Act 2026 by the Secretary for Internal Affairs.

1 Title

These are the Online Casino Gambling (Minimum Standards) 2026.

2 Commencement

These minimum standards come into force on 8 July 2026

3 Interpretation

(1) Any term or expression that is defined in the Act or Regulations and used, but not defined, in these minimum standards has the same meaning as in the Act or the Regulations.

(2) In these minimum standards, unless the context otherwise requires,—

Act means the Online Casino Gambling Act 2026

inactivity means a continuous period during which the customer does not engage with the gambling platform through any user‑initiated input, navigation, or transaction.

progressive jackpot in relation to a game on a gambling platform means—

(a) a jackpot for which players can contribute to on the gambling platform; and

(b) network progressive jackpots.

Regulations means the Online Casino Gambling Regulations 2026.

4 Application

These minimum standards apply to operators under the Act.

Part 1 Harm Prevention and minimisation

5 Limit setting

(1) Time, deposit and spend limit setting functions must be easy to access on the gambling platform at any time after a customer has opened an account, including on deposit pages/screens or via a link on these pages/screens.

(2) A free text box to set time, deposit and spend limits must be available on the gambling platform.

(3) Where a customer sets simultaneous periods, for example, a deposit limit for a day and for a week, the lowest limit must apply.

(4) Time, deposit and spend limits must be enforced by the gambling platform including waiting at least 24 hours before allowing a request to increase or remove a previously set time, deposit or spend limit.

6 Breaks-in-play, time-outs and pop-up alerts

(1) The ability for a customer to set breaks-in-play, time-outs and pop-up alerts must be easy to access on the gambling platform at any time after the customer has opened an account.

(2) Breaks-in-play, time-outs and pop-up alerts must be enforced by the gambling platform including waiting at least 24 hours before allowing a request to:

(a) remove a break-in-play, time-out or pop-up alerts; or
(b) increase the time-period between pop-up alerts; or
(c) decrease the duration of a time-out; or
(d) make a break-in-play shorter, or less frequent, or both.

7 Self-exclusion

(1) The gambling platform must maintain an accurate and current register of customers who have self-excluded from the platform. This register must include the customer's name and any membership or account details that may be held by the operator.

(2) The gambling platform must check each customer's account against the above register before activating their account and at login, and must prevent the customer from participating in online casino gambling on the platform if the customer is identified on the register.

8 Customer support

Live customer support must be easy to access on the gambling platform at any time after the customer has opened an account and must be available at all times, actively monitored, and capable of responding to customers in real time.

9 Progressive jackpot systems

(1) Jackpot rules must be easy to access within any game linked to a progressive jackpot and must clearly explain how the jackpot operates, including how it is funded, any start-up seed and ceiling value, how prizes are determined and awarded, and, where applicable, how contributions are managed once a ceiling is reached.

(2) The gambling platform must ensure that all eligible customers are able to view the current jackpot value or values, and that they are updated as frequently as practicable.

(3) The gambling platform must ensure that a winning customer is notified of a jackpot win immediately after it is triggered and that other eligible customers are adequately notified of the jackpot reset value and its new value.

(4) Strict access and logging controls must be in place over the configuration of, and changes to, progressive jackpots.

(5) The gambling platform must ensure that where a customer contributes to a jackpot pool in a game, the customer is eligible to win the jackpot while playing the game.

(6) Where a jackpot containing customer contributions is decommissioned the contributions must be returned fairly, according to the circumstances, with priority given to the customers who made the contributions.

10 Game design and features

(1) All games on the gambling platform must operate in accordance with their applicable game rules, and all results must be determined and settled in accordance with those rules.

(2) Where a paid game has different odds/return to player to an equivalent free-to-play game on the gambling platform, this must be clearly communicated to all customers before they place a bet, pay, or stake consideration on the paid game.

(3) The gambling platform must ensure that game play only begins after a customer has placed a bet, paid, or staked consideration, and that accessing or reviewing a game or its rules does not initiate game play.

(4) The gambling platform must ensure that there is a minimum of 2.5 seconds between the start of a game and the point at which the next game round can begin. A game round begins when the customer initiates the game by pressing the start button or taking an equivalent action, and ends when all money or money’s worth staked or won has been lost, delivered to the customer, or made available for collection, and the start button or equivalent becomes available to initiate the next game round.

(5) The gambling platform must ensure that a game round only commences following a separate, deliberate action by the customer, such as releasing and pressing the start button or taking an equivalent action. A game must not automatically begin a new round, and continued contact with a button, key, or screen must not initiate a new game round.

(6) The gambling platform must ensure customers have a means to always track the passage of time.

(7) If the gambling platform uses full screen client applications that obscure the clock on the customer’s device the gambling platform itself must clearly display the time of day or the elapsed time since the application was started.

(8) The gambling platform must not allow slot games to be combined in a way that facilitates the simultaneous play of more than one slot game.

(9) Games on the gambling platform that use a pre-determined pattern, such as hidden prizes on a map, must not change the locations of winning positions during play, except as provided for under game rules.

(10) Games on the gambling platform that simulate a physical device must use theoretical probabilities that match those of the real device, for example, the probability of a coin landing on heads must be 0.5 for each toss.

(11) The gambling platform must provide functionality to control the activation and deactivation of games and must retain audit logs recording when games are activated, deactivated, or modified.

Part 2 Consumer Protection

11 Identity verification

(1) All customer accounts must be uniquely identifiable, and customers must authenticate via at least a unique identifier and password each time they login to the gambling platform.

(2) The gambling platform must maintain an auditable trail of events that are logged and available, relating to account creation and activation, account closure and account changes.

(3) The gambling platform must give customers the option to use multi-factor authentication to govern sensitive activities including but not limited to login, registering a new deposit or withdrawal method or resetting passwords.

(4) There must be a customer activity time-out that automatically logs the customer out after a period of inactivity specified by the operator, which must not exceed 30 minutes.

12 Customer location

(1) The gambling platform must only be available to a person who is in New Zealand.

(2) The gambling platform must have reasonable mechanisms to detect the location of a customer attempting to access their account and to block access where the customer's location cannot be verified as being in New Zealand.

(3) The gambling platform must take reasonable steps to identify and mitigate the use of virtual private networks, proxies or similar technologies capable of circumventing customer location detection.

13 Informed decision making

(1) All games must clearly display a customer’s net position (total of all winnings minus the sum of all losses) since the game started.

(2) All customer account transactions shall be uniquely identifiable and traceable to a unique individual customer account.

(3) Game rules and odds of winning must be easy to access on the gambling platform at any time after the customer has opened an account.

(4) The theoretical return to player must be easy to access on the gambling platform and must be presented as a return to player percentage.

(5) The gambling platform must:

(a) inform customers whether the customer's opponent is a human player or a computer system; and
(b) inform customers that the speed of connection or processor may have, or appear to have, an effect on the game; and
(c) recover from failures that cause interruptions to the game in a timely fashion; and
(d) where appropriate, void a bet; and
(e) retain sufficient information to be able to restore events to their pre-failure state, if possible; and
(f) pay customers the amount won up to that point or return bets to customers where a game cannot be continued after a service interruption, whichever is the better outcome for the customer.

14 Random number generator

(1) Random number generation and game results must be ‘acceptably random’. Acceptably random in this standard means that it is possible to demonstrate to a high degree of confidence that the output of the random number generator is random through, for example, statistical analysis using generally accepted tests and methods of analysis. Adaptive behaviour (that is, a compensated game) is not permitted.

(2) Software pseudo-random number generators must be cryptographically secure and be capable of demonstrating the following qualities:

(a) the output from the random number generator must be uniformly distributed over the entire output range and game or computer simulated sporting event outcomes must be distributed in accordance with the expected or theoretical probabilities; and
(b) the output of the random number generator must be unpredictable. For example, it should be computationally infeasible to predict what the next number will be without complete knowledge of the algorithm and seed value; and
(c) random number generation must not reproduce the same output stream (cycle), and two instances of a random number generator must not produce the same stream as each other (synchronise); and
(d) any forms of initialisation, seeding and re-seeding used do not introduce predictability; and
(e) online casino gambling technology shall implement continuous and dynamic monitoring of random number generator output integrity. In the event of any detected anomaly, degradation, or failure in random number generator output, the gambling platform shall immediately deactivate the affected game to maintain operational integrity.

(3) Where applicable hardware random number generators must be capable of meeting the requirement of standard 14(2) and:

(a) mechanical components must be constructed of materials to prevent decomposition of any component over time (e.g. a ball shall not disintegrate).
(b) the properties of physical items used to choose the selection must not be alterable.
(c) customers must not have the ability to interact with, come into physical contact with, or manipulate the electrical, physics, or mechanical derivation of the results.

(4) Any scaling or mapping of random number generator outputs must preserve uniformity, independence, and the certified probability distribution, and must not introduce bias, correlation, or any distortion of randomness.

(5) The selected game elements and their associated game outcomes shall not be altered, discarded or otherwise manipulated through a secondary decision by the game program and shall not be impacted by load on the gambling platform.

(6) Any failure by the mechanism to randomly select game elements, including an interruption in the selection process, must be identified and responded to quickly and appropriately to minimise the effect on customers.

15 Live dealer operations

(1) Equipment used in live dealer operations must be of commercial casino quality that meets the standards and game rules issued under the Gambling Act 2003 or any overseas legislation equivalent to the Gambling Act 2003.

(2) Secure areas and gambling equipment must be protected by appropriate access controls to ensure that only authorised personnel are allowed access. Access privileges must be granted, modified, and revoked based on employment status and job requirements, and all activities associated with these actions must be logged.

(3) Controls, including video surveillance to record all dealer activity, must be in place to ensure the integrity of a game is not compromised.

16 Preventing prohibited customer behaviours in peer-to-peer casino games

(1) Online casino gambling technology must be capable of identifying prohibited customer behaviour.

(2) A mechanism shall be in place to ensure that a player cannot play against themselves or occupy more than one seat at an individual table.

(3) The gambling platform must retain a record of relevant activities to facilitate investigation and be capable of suspending or disabling player accounts or gaming sessions.

Part 3 Information Security and Access

17 Security

(1) The design, manufacture and performance of all online casino gambling technology must comply with the controls set out below, being controls from Annex A of ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements (Edition 3, 2022):

(a) Organisational controls:
- (i) A.5.1 Policies for information security; and
- (ii) A.5.2 Information security roles and responsibilities; and
- (iii) A.5.3 Segregation of Duties; and
- (iv) A.5.7 Threat Intelligence; and
- (v) A.5.10 Acceptable use of information and other associated assets; and
- (vi) A.5.12 Classification of information; and
- (vii) A.5.13 Labelling of information; and
- (viii) A.5.14 Information transfer; and
- (ix) A.5.15 Access control; and
- (x) A.5.16 Identity management; and
- (xi) A.5.17 Authentication information; and
- (xii) A.5.18 Access rights; and
- (xiii) A.5.19 Information security in supplier relationships; and
- (xiv) A.5.20 Addressing information security within supplier agreements; and
- (xv) A.5.21 Managing information security in the ICT supply chain; and
- (xvi) A.5.22 Monitoring, review and change management of supplier services; and
- (xvii) A.5.23 Information security for use of cloud services; and
- (xviii) A.5.24 Information security incident management planning and preparation; and
- (xix) A.5.25 Assessment and decision on information security events; and
- (xx) A.5.26 Response to information security incidents; and
- (xxi) A.5.27 Learning from information security incidents; and
- (xxii) A.5.28 Collection of evidence; and
- (xxiii) A.5.29 Information security during disruption; and
- (xxiv) A.5.30 ICT readiness for business continuity; and
- (xxv) A.5.31 Legal, statutory, regulatory and contractual requirements
- (xxvi) A.5.33 Protection of Records; and
- (xxvii) A.5.34 Privacy and protection of personal identifiable information (PII) – ensuring compatibility with New Zealand Privacy Act 2020; and
- (xxviii) A.5.35 Independent review of information security.
(b) People controls:
- (i) A.6.3 Information security awareness, education and training; and
- (ii) A.6.5 Responsibilities after termination or change of employment; and
- (iii) A.6.6 Confidentiality or non-disclosure agreements; and
- (iv) A.6.7 Remote working; and
- (v) A.6.8 Information security event reporting.
(c) Physical controls:
- (i) A.7.8 Equipment siting and protection; and
- (ii) A.7.9 Security of assets off-premises; and
- (iii) A.7.10 Storage media; and
- (iv) A.7.14 Secure disposal or re-use of equipment.
(d) Technological control:
- (i) A.8.1 User endpoint devices; and
- (ii) A.8.2 Privileged access rights; and
- (iii) A.8.3 Information access restriction; and
- (iv) A.8.4 Access to source code; and
- (v) A.8.5 Secure authentication; and
- (vi) A.8.6 Capacity Management; and
- (vii) A.8.7 Protection against malware; and
- (viii) A.8.8 Management of technical vulnerabilities; and
- (ix) A.8.9 Configuration Management; and
- (x) A.8.11 Data masking; and
- (xi) A.8.13 Information backup; and
- (xii) A.8.14 Redundancy of information processing facilities; and
- (xiii) A.8.15 Logging; and
- (xiv) A.8.16 Monitoring Activities; and
- (xv) A.8.17 Clock synchronisation; and
- (xvi) A.8.18 Use of privileged utility programs; and
- (xvii) A.8.20 Networks security; and
- (xviii) A.8.21 Security of network services; and
- (xix) A.8.22 Segregation of networks; and
- (xx) A.8.24 Use of cryptography; and
- (xxi) A.8.25 Secure development life cycle; and
- (xxii) A.8.26 Application security requirements; and
- (xxiii) A.8.27 Secure system architecture and engineering principles; and
- (xxiv) A.8.28 Secure coding; and
- (xxv) A.8.29 Security testing in development and acceptance; and
- (xxvi) A.8.30 Outsourced development; and
- (xxvii) A.8.31 Separation of development, test and production environments; and
- (xxviii) A.8.32 Change management; and
- (xxix) A.8.33 Test information.

18 Payment systems

Payment service providers used to process transactions must be compliant with the Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0.1 (2024), PCI Security Standards Council (PCI DSS).

19 Suitability of hosting

Online casino gambling technology infrastructure must not be hosted stored, processed, or transmit customer data, in any jurisdiction where doing so would be likely to prejudice New Zealand’s international reputation in relation to trade or the maintenance of the law.

About this secondary legislation

Made at Wellington on 1 July 2026.
Paul James
Secretary for Internal Affairs.

This is secondary legislation issued under the authority of the Legislation Act 2019.

Title	Online Casino Gambling (Minimum Standards) 2026
Principal or amendment	Principal
Consolidated version	No
Empowering Act and provision	Online Casino Gambling (Minimum Standards) 2026 Section 80
Maker name	Secretary for Internal Affairs
Administering agency	Department of Internal Affairs
Date made	1 July 2026
Publication date	8 July 2026
Notification date	8 July 2026
Commencement date	8 July 2026
Related instruments	Online Casino Gambling Regulations 2026 Consistency Accountability Statement (CAS) (PDF, 58KB) Summary of Underpinning Analysis (PDF, 163KB)

Department of Internal Affairs | Te Tari Taiwhenua

Building a safe, prosperous and respected nation