Where You Can Actually Send iGaming Traffic, and What Changes in Each Market
Regulated, open, grey, closed. Four kinds of market, and which one you are looking at decides your CPA, your traffic sources, what the creative may say, and whether a payout can be taken back. A framework that outlives the rules, plus the checklist to run before you buy the domain.
Every market you might send traffic to is one of four kinds: regulated, open, grey or closed. Which one it is changes your CPA, the sources you may run, what the creative may say, and whether a commission can be reversed a year later. None of this is legal advice, and the operator's accepted GEO list, not the law, decides whether you get paid.
The question turns up in affiliate chats about once a day. Can I send traffic to Poland? Is Japan safe? Somebody said India is open now, is India open now?
It gets answered badly for a boring reason. The honest answer is a different sentence in every country and it moves while you are reading it. Brazil is the recent worked example: a grey market almost everybody served, until the 2023 law and the licensing regime that followed. A list of safe GEOs published in August is a stale guess by March.
So, no list of countries. None of this is legal advice. Before you commit money to a market, read the regulator's own page, and if the money is significant, pay somebody qualified to read it with you.
A framework outlives the rules it was built from. Learn this one and you can sort a country you have never heard of into one of four buckets in about twenty minutes. Enough to decide whether to keep looking. Nowhere near enough to commit a budget.
Two questions people keep merging into one
"Is online gambling legal in country X" and "will this brand pay me for a deposit from country X" are different questions with different answers. Only the second one puts money in your account.
Every deal carries an accepted GEO list. That list is a licensing and commercial decision the operator has already made, and traffic from outside it does not earn under the terms you signed, whatever the law in that country says. A conversion from an unlisted country is not underpaid. It is refused, and no rate negotiation rescues it, because the payout grid only prices countries the deal already allows.
They come apart in both directions.
A country can be entirely legal and still be absent from a brand's list: no licence there, or the payment provider will not settle there, or the compliance work was not worth the volume. And a country can read as prohibited in its own statute book and still sit on an operator's list, because that operator holds an offshore licence and serves it anyway.
Read the law for your own exposure, and read the GEO list for your income.
The four kinds
Regulated
A national licence exists, operators either hold it or are not supposed to be there, and the advertising rules are written down and enforced by somebody with a budget and an appetite for fines. The UK Gambling Commission, Germany's GGL, Spain's DGOJ, Italy's ADM and Brazil's SPA are all this shape at different ages and strictness levels.
Malta's MGA is a licensing jurisdiction rather than a market, and a great many brands are structured around it. It is not a passport. An MGA licence does not license a brand in Germany, Spain or Italy, each of which issues its own.
The tell: there is a public register of licensed operators, and you can look a brand up in it by name.
Open
No meaningful local prohibition, and no local licensing regime either. Offshore licences serve the market, Curacao most commonly, and no local authority is claiming jurisdiction over how the product gets advertised.
Search for the country's online gambling regulator and nothing comes back, or a land-based authority with no online remit does.
Grey
Prohibited or restricted on paper, with enforcement that is inconsistent or absent in practice, and served by offshore-licensed operators regardless. Largest bucket by population. Grey is not a legal status. It describes the gap between a statute and its enforcement, and that gap can close in a single legislative session. How much risk it carries for you is a question for a local lawyer rather than for a blog, and the answer changes without notice.
The tell: the law says no, and page one of local-language search is full of operators advertising openly.
Closed
Prohibited and enforced, or blocked at the payment and DNS layer, or both. Some stay porous in practice, which is exactly the trap: rails somebody is about to shut are rails your players cannot deposit through next quarter, by which point you have built for the market. Brands refuse the GEO in their own terms, and local banks decline the transactions.
What each kind does to your deal
| Market type | Who licenses it | What it means for your deal | What to watch |
|---|---|---|---|
| Regulated | A national regulator: UKGC, GGL, DGOJ, ADM, SPA | Highest CPA, hardest conversion, explicit creative rules, a deal that holds while the brand holds its licence | Responsible-gambling wording, bonus restrictions, channel bans that bind you as well as the operator |
| Open | An offshore licence, Curacao and similar | Lower CPA, easier conversion, terms revised whenever the brand likes | Paid channels narrower than you expect, since platform certification usually keys off a local licence that does not exist here |
| Grey | Nobody locally, an offshore licence in practice | Rates better than the volume justifies, terms unsettled, all of it reversible if the market moves | Regulation landing mid-campaign, GEOs removed with little notice, payment rails closing first |
| Closed | Nobody, and the state is actively blocking | Rarely on any accepted GEO list, so conversions are voided rather than paid | Traffic leaking in from a neighbouring GEO and quietly earning nothing |
Why the regulated markets pay more and convert worse
Set two side by side.
A licensed European market puts real obstacles between your click and a qualifying FTD. Identity verification before the first deposit rather than the first withdrawal. A source-of-funds question once the amount gets interesting. Deposit or affordability limits, depending on the market. A national self-exclusion register the operator has to check. Every one of those is a place a player stops, and a high CPA is priced against the players who make it through all of them, not against your click.
Open markets invert all of it. Registration is three fields. The cashier carries the instant local method people actually use. Nobody asks for a document until withdrawal, if then. Click to deposit runs at a multiple of the regulated figure, the CPA is a fraction of it, and the player churns fast.
Grey markets price in between and feel like the smartest square on the board. Fewer affiliates will commit a year of content to a market that might be legislated out from under them, so competition stays thin and rates hold up. That is a risk premium. Real premium, real risk, and the mistake is banking the first while treating the second as decoration.
What you are actually risking
Both the panic and the bravado in affiliate forums are misplaced. Gambling statutes are generally written around operators rather than around the people who write reviews about them. That is a tendency, not a shield, and not a defence you get to rely on: several regulated markets reach marketing partners through licence conditions, and a few write affiliate registration into the regime itself. Building in one country rather than dabbling in eight is worth an hour of a local lawyer's time.
The exposure that reaches most publishers is commercial, and it runs roughly in this order:
- Deal removed. The GEO drops off your available markets, sometimes with no warning beyond an email.
- Conversions voided, so pending earnings never clear.
- Commission that already cleared clawed back, because a deposit was refunded or the traffic was reclassified as out of GEO.
- The account closed at that brand, and sometimes across a whole group that shares one affiliate department, which is how one GEO mistake costs four deals instead of one.
- Your ad account banned. The pixel history and the audience data go with it, which costs more than the campaign did.
The failure that actually catches people is duller than any of it. They build a single-market, single-brand business on a grey GEO. The market regulates. The brand either buys a licence and rewrites every deal around new rates and new creative rules, or it leaves. Nine months of content, one email.
The ad platform has its own rulebook, and it is often stricter
A second set of rules sits on top of the first, written by companies rather than governments. The large ad platforms run their own gambling policies country by country, each with its own certification process, and the list of countries where they accept gambling ads is narrower than the list where gambling is legal. Some accept operator advertising but not affiliate advertising. Some require the advertiser to hold the local licence, which you do not.
So a market can be regulated, licensed and open for business, and still offer you no paid channel. What is left is search, owned content, communities and email. Slower, and better, and each still has to clear the brand's own accepted-source list (the three tiers are here).
Italy (IT) is the sharp example of both rulebooks pointing the same way. It has run a general gambling advertising and sponsorship ban since 2018 while licensing the product through ADM, so a fully regulated market can still leave you no paid door. Check the current position before planning media there.
Checking a market before you build for it
Six things, none of which cost anything, and all faster than the domain registration you were about to do.
- The accepted GEO list, in writing, for the model you will run. Grids often accept far more countries on RevShare than on CPA. Ask for country codes, not flags. Choosing a first GEO starts here.
- Which licence covers this GEO. "We are MGA licensed" is not an answer to "are you licensed in Germany". Put the country name in the question.
- The regulator's own register. Look the brand up in it. A brand missing from the register of the market it is selling you has answered the question.
- The ad platform's gambling policy for that country, and whether certification is open to affiliates or only to licence holders. Before the media plan, not after the ban.
- The cashier, opened from that GEO. Language, currency, and whether the local instant method is listed. Wrong language quoting the wrong currency means the brand is not serious about that market, whatever the GEO list claims.
- What happens if the market regulates. Does the deal survive, and do earned commissions survive with it. The answer will probably be vague, and vagueness is information too.
Where AFFILIFY sits in this
Each brand's accepted GEO list sits in that brand's deal, next to the model, the rate grid and the hold, before you send a single click. Traffic from a country the deal does not cover does not earn, and it shows up as exactly that rather than going quietly missing from a total.
Three limits, said plainly.
We do not decide which countries an advertiser accepts. That list belongs to the operator and its licences, and "why is DE not on this grid" is a question for the brand's compliance team rather than for us.
A GEO can come off a list on the advertiser's timetable rather than ours. We pass on the notice we get, and it is sometimes short.
And nothing in your account is a legal opinion about any market. A country on a grid means an advertiser will pay for traffic from it under that deal. It says nothing about the law where you live, or where your audience does.
The market you have never heard of
Start with the register, because it disqualifies fastest. Is there a national online licence with a public register? Regulated. No regulator, and no prohibition worth the name? Open. A prohibition nobody enforces, while operators advertise in the local language on page one of search? Grey. A prohibition with blocking, fines or prosecutions behind it? Closed.
Then read the operator's accepted GEO list, whichever bucket the country landed in. The law tells you what kind of place you are standing in, and what your creative may say once you are there. The list tells you less, and sooner. Is the deposit you just sent a commission, or a rounding error in another affiliate's month?
Both are worth knowing. Only one shows up on your statement.
Frequently asked questions
Is it legal for me to promote casinos in a grey market?
That depends on where you live, where the traffic goes and what the local rule actually prohibits, and it is a question for a lawyer in that jurisdiction rather than for a blog post. The general shape, offered as background and not as advice: gambling statutes are usually written around the operator, and an affiliate is doing marketing rather than offering the game. That is a tendency, not a shield. Some regimes reach marketing partners through licence conditions and a few require affiliates to register. In practice the consequence that reaches most publishers is commercial: a deal pulled, conversions voided, an ad account banned. If you are about to spend a year on one market, buy an hour of local legal time first.
The country is legal but the brand will not accept it. What is going on?
Usually something that has nothing to do with you. The brand may hold no licence covering that market and be unwilling to take the risk of accepting the traffic. Its payment provider may not settle in that currency or through the local method. Its own risk policy may exclude the market. Or nobody did the compliance work, because the volume never justified it. The consequence is identical in all four cases: a conversion from a country that is not on the accepted list is refused rather than underpaid, and no rate negotiation converts it into money. Ask which specific licence covers the GEO, and ask before you build.
What happens to my earnings if a market regulates while I am running traffic there?
Three outcomes, and you rarely get to choose. Best case the brand takes a local licence and your deal is rewritten with new rates, new creative rules and a harder conversion path, so the market survives but the economics change. Middle case the GEO comes off the accepted list with some notice and your traffic stops earning from that date. Worst case the brand exits the market entirely and the deal disappears. Commission that has already cleared normally stays cleared. Pending earnings are where the exposure sits, which is the argument for never running one grey market against one brand.
Does a Curacao licence mean the brand can take traffic from anywhere?
No, and this is the most common misreading of a footer logo. An offshore licence authorises the operator to run the business, it does not grant it permission in every country on earth, and it does nothing at all about a market that has its own licensing regime or an active prohibition. Offshore-licensed brands still publish accepted GEO lists with real exclusions on them, precisely because being served from Curacao does not make a closed market open. Read the accepted list, not the licence badge.
More from this cluster
Brazil for Affiliates after Lei 14.790
Federal licensing since 2025, a public list of authorised brands, PIX on the cashier, Portuguese or nothing. What SPA actually changed for affiliates, and the checks to run before you send a Brazilian click.
iGaming Licences Affiliates Should Recognise
MGA, Curaçao, UKGC, GGL, ADM, DGOJ, ANJ, SPA, HGC. The badge on the offer is a statement about which players the brand may take, which ads you may run, and which register you should look at before you send a click. A working field guide, not a legal opinion.
Germany for Affiliates: What GlüStV, the GGL and LUGAS Change
Germany binds the player across every operator at once, not just inside one brand. Here is what that regime does to your conversion rate, your NGR, your creative and the CPA you get offered.