Articles 28.º, 30.º, 37.º and 47.º of the RJO
Legal online casino: the test runs on the register, in two minutes
An online casino is legal in Portugal when the entity operating it appears on the SRIJ register. Everything else — the seal in the footer, the foreign licence number, the design of the page: all indication rather than proof. Here is what the law obliges a licensed site to carry, field by field, and how each field gets checked.
The question “is this online casino legal?” has, in Portugal, a closed answer, and most of the pages that answer it say where they got it from nowhere. The answer sits on a list published by the State, and the law says what that list must contain, what a licensed operator’s site must show and what it must ask for before letting anybody play. Here is the route, with the number of each rule beside it.
The list exists because a statute orders it published
The fifth paragraph of article 47.º of the Regime Jurídico dos Jogos e Apostas Online is one line long and solves half the problem: the control, inspection and regulation body must «criar, manter atualizado e divulgar um registo das entidades exploradoras de jogos e apostas online e dos respetivos sítios na Internet» — create, keep updated and publish a register of the entities operating online games and bets and of their websites.
Three useful things follow. The list is compulsory, so it survives the preferences of whoever maintains it. It includes the sites, rather than company names alone, which makes checking by domain possible. And it is kept updated, which means a count made today is a count of today: when we opened it, on 2 September, it held 19 entities, and the page itself was dated 3 August 2026.
The whole list, brand by brand, with the holding company beside each, sits in legal online casinos in Portugal.
We counted 19 holders in this register, all of them on .pt addresses, and a recount on the 2nd returned the same 19 — with 17 sites a player can open, because Moosh has its activity suspended and the Vincino address carries the words «brevemente disponível», available shortly. Portugal publishes no matching list of blocked sites: this closed list is the only one the regulator keeps, and a domain is checked against it.
The address has to end in .pt, and that is statutory
This is the field that settles most cases before anything else gets opened. Article 28.º says:
As entidades exploradoras estão obrigadas a instalar um sítio na Internet, com o nome do respetivo domínio subordinado à identificação «.pt», para a exploração dos jogos e apostas online, para o qual devem ser redirecionados todos os acessos que se estabeleçam a partir de localizações situadas em território português ou que façam uso de contas de jogadores registados em Portugal.
In English: operating entities are obliged to install a website whose domain name is subordinate to the identifier «.pt» for the operation of online games and bets, to which all accesses established from locations in Portuguese territory, or using the accounts of players registered in Portugal, must be redirected.
Two duties in one sentence. The first is the .pt domain. The second is the routing: an international group holding a Portuguese licence is barred from serving a player registered in Portugal through its international address — it has to send them to the .pt. Hence the nineteen register entries all ending the same way, and hence that uniformity being something other than coincidence.
The reverse needs saying, because this is where the test gets misused. A .pt domain is a necessary condition and falls short of a sufficient one. Anyone at all registers a .pt, and a Portuguese address puts nobody on the register. The question stays the same one: does this domain, spelled letter by letter, appear on the regulator’s list?
The paragraph that follows adds a limit almost nobody notices: the site «não pode incluir quaisquer outros conteúdos para além dos relativos aos jogos e apostas online autorizados pelas respetivas licenças» — it may include content other than that relating to the online games and bets authorised by its licences in no circumstances.
What a licensed site is obliged to show
Article 30.º enumerates the information the site must give the player. It works as a visual checklist, run without leaving the page you are looking at:
- the rules of the games, the payment instruments admitted, the minimum and maximum stakes and the rules for calculating and paying prizes, as information that is «clara, verdadeira, completa e atualizada», clear, true, complete and up to date, under point a)
- the means of access to personal data — point b)
- the prohibitions on playing, in particular as to minors, persons lacking capacity and anybody barred from play — point c)
- warnings against excessive play and information about the right of self-exclusion — point d)
- contacts for bodies that support people with dependency problems — point e)
- the logo and contacts of the operating entity and of the control, inspection and regulation body — point f)
- a reference to holding a licence for the operation of online games and bets — point g)
Point f) is the most operational of the seven. On a licensed site the regulator’s contacts are there because the law puts them there; a site displaying a handsome seal and the contacts of no Portuguese authority is saying, without meaning to, which side of the border it works on.
Article 38.º completes the picture from the rights side: to receive the prizes due, to play freely and free of any coercion, to know at all times the identity and contacts of the operator and the way to make a complaint.
The decree-law that enacted the Regime Jurídico dos Jogos e Apostas Online, published in Diário da República n.º 83/2015 and in force since 29 June 2015. Articles 49.º, 57.º, 58.º and 61.º, quoted across this site, all sit inside it.
Player registration takes effect only once identity is verified
This is where the difference between the two sides stops being abstract.
The fifth paragraph of article 37.º says that player registration «só se torna efetivo depois de verificada a respetiva identidade e confirmada a inexistência de proibição de jogar, momento a partir do qual o jogador pode dar início à prática de jogos de apostas online» — takes effect only after the player’s identity has been verified and the absence of a bar on playing has been confirmed, from which moment the player may begin to play. At a licensed site the sequence “play first, show papers when you ask for money” exists nowhere.
Verification runs, under the preceding paragraph, by real-time query to public-sector databases through a connection to the regulator. It can also run directly on the site, through the citizen card or the digital mobile key. Only where both routes fail does the decree-law admit a copy of a document bearing a photograph and a date of birth. Lower down, the same article closes with a plain rule: one registration per person per site.
Compare that with what the documents of the ten houses in our table say. All ten are absent from the Portuguese register. There, identification almost always appears on the payout side rather than at the entrance: Rocketpot writes a threshold of 2500 USD in clause 11.4, Bitcasino.io 2500 EUR in 6.6, Empire.io 2000 USDT in 5.4. The remaining six reserve the right to ask whenever they choose, with a figure written nowhere. The exception is Wild Fortune, which in clause 18.1 requires identification before play from anyone using bitcoin — and thereby lands, by private contract, close to what is a legal duty here.
Two sequences, two moments, two authorities. The order in which papers get asked for is the most visible difference between a site on the register and a site outside it, and it is visible before any money is at stake.
What a foreign licence proves, and what it leaves unproven
It proves that a foreign authority issued a document. That is the whole of it, and it is already more than many seals are worth.
In Portugal it proves nothing. The fourth paragraph of article 5.º of the RJO says that «são proibidas a exploração e a prática de jogos e apostas online não regulamentados», the operation and playing of unregulated online games and bets are prohibited, and regulated means licensed by the SRIJ. A permit from Curaçao or Anjouan falls outside that definition and is recognised by equivalence nowhere. It alters articles 49.º, 57.º, 58.º and 61.º in no respect, and all four are transcribed in what the law says.
And foreign licences differ in worth among themselves. Of the nine houses in our table displaying a number, three lead to an individual record in the register of the body that issued it, four point only at a generic register, and two are known from the operator’s word alone. The separation is made column by column in best online casino.
Four ways to run this test badly
Searching for the brand instead of the domain. The law looks at the address, and a well-known name is exactly the kind of name that turns up copied into lookalike addresses.
Taking the footer seal as proof. A logo is an image anybody can draw. The proof sits in the register kept by the issuing side, and the individual record, where one exists, has an address of its own.
Reading the holding company as though it were the brand. They almost never coincide. The company answers a complaint and the company appears on the register, here and abroad.
Looking for the site on a list of blocked addresses. That list goes unpublished. We searched five regulator pages and found it on none. Set nineteen authorised names against 2631 sites already subject to a blocking request up to 30 September 2025, and the asymmetry explains why such a list would ever be complete.
If doubt survives, ask whoever holds the list
The regulator publishes channels of its own: the address [email protected] and the telephone 211 140 200. It differs from a support line for people who play. That one is free and anonymous, and it is described in where to ask for help.
And if the test comes back negative, the consequence for the player carries an article number in place of an opinion: a minor administrative offence under article 58.º, with a fine of up to 2500 € for an individual under point c) of article 61.º. The origin of the two figures circulating about this sits in the player’s fine.
The quotations on this page come from the official consolidation of Decreto-Lei n.º 66/2015, published as a PDF by the regulator itself, version of 31 March 2020. The register of licensed entities is the second source. Both were opened on 02.09.2026. What stayed unconfirmed is listed in how we read the documents.