How does the regulatory oversight of Ontario online casinos work after a site has already launched?

Picture a Toronto player who's been using a regulated Ontario casino site for six months. They've set up their account, verified their identity, played some games — and they assume the regulatory story ended the day the site launched. It didn't. The oversight machinery that runs in the background is, if anything, more layered post-launch than it was before.

Two bodies, two distinct roles — both active after go-live

The AGCO is the regulator for the province, while iGaming Ontario (iGO) is the commercial conduct-and-manage entity. Both stay deeply involved once a site is live, but they're watching for different things.

The AGCO's job is pure regulation. It monitors operators, suppliers, and digital game offerings for compliance with regulatory obligations — including the Registrar's Standards for Internet Gaming — and where concerns are identified, brings operators back into compliance through progressive sanctions: warnings, suspensions, monetary penalties, and in the most serious cases, revocations. That oversight authority includes the ability to conduct compliance assurance activities such as audits, inspections, and the gathering of targeted data from operators and suppliers.

iGO's role is contractual as much as regulatory. iGO maintains sole and absolute discretion regarding the monitoring of operators for compliance with its requirements, and may suspend or terminate the Operating Agreement if an operator does not comply with its obligations. iGaming Ontario retains the right to audit and inspect all aspects of an operator's security regime, and FINTRAC also maintains the right to conduct audits and inspections to ensure compliance with anti-money laundering requirements.

The Control Activity Matrix and ongoing self-reporting

One of the more substantive post-launch obligations is the Control Activity Matrix (CAM). All operators are required to submit an independently audited document — the CAM — setting out the processes and controls they have in place to meet all outcomes and requirements in the Registrar's Standards. Within six months of commencing operations, operators must also provide a live demonstration of the controls they've established.

On top of that, operators must notify the AGCO according to a Notification Matrix, which outlines minimum notification obligations including timeframes and modes of contact — with required notifications covering instances of non-compliance or substantial changes to the control environment.

What the standards actually cover on an ongoing basis

Areas addressed include the prevention of underage access, game integrity, privacy and information security, anti-money laundering, and responsible gambling. Game technology doesn't get a one-time pass either: for internet gaming, the AGCO oversees the certification of gaming technology against the Registrar's Standards by registered independent test labs on an ongoing basis.

Anti-money laundering oversight is particularly active. iGO monitors operator risk and oversees operator compliance with AML requirements — in one recent fiscal year alone, iGO reviewed and filed over 52,000 regulatory reports to FINTRAC, a 50% increase year-over-year. In fiscal year 2024–2025, the AGCO's Investigations and Enforcement Branch conducted over 1,100 investigations following a notable increase in operator reports of suspicious or criminal activity on regulated online gaming sites.

Player-protection tools baked into the ongoing framework

The responsible gambling obligations don't freeze at launch either. iGaming Ontario requires operators to obtain the Responsible Gambling Council's RG Check accreditation within the first two years of their Operating Agreement and maintain it for the duration. On the self-exclusion side, all Ontario igaming operators participate in BetGuard, the centralized tool that allows people to opt out of all regulated online gambling in Ontario. If you ever want to use it, ConnexOntario (1-866-531-2600) can also connect you with support — and BetGuard is accessible directly at betguard.ca.

The Registrar's Standards also require that any request to relax or remove a deposit or loss limit a player has set cannot take effect until after a cooling-off period of at least 24 hours — a friction-by-design rule that stays enforceable throughout the life of the operator's registration.

How to confirm a site is still in good standing

For Toronto players, the practical check is straightforward: every fully registered Ontario igaming site displays both the iGaming Ontario logo and the BetGuard logo. Their presence signals the site is managed by iGO and regulated by the AGCO. Registration status can change, though, so the live source of truth is the official iGaming Ontario operator registry — worth a quick look if you're trying a site for the first time. Only players 19 and older may participate in Ontario's regulated market.