New Zealand just picked the companies allowed to apply for its first online casino licences. Find out what that means for the ID and payment details that’re stored in your old accounts.
The first online casino auction wrapped up mid-October in New Zealand, and the result starts a countdown many players haven’t taken notice of yet. Plenty of Kiwis have casino accounts scattered across sites they signed up to years ago. Some of those sites will apply for a licence. Others will exit the market. Either way, a scan of your passport or driver licence is still stored on a server somewhere, waiting for a decision about what happens to it next.
The auction that starts the clock
After 32 bidders battled it out through 10 rounds, the Department of Internal Affairs confirmed that 11 companies won the right to apply for those 15 licences, at NZ$15 million per right (the Act also caps any one company at three). Winning a slot guarantees very little. Each bidder still has to prove it can protect consumers, and the DIA says the Secretary “must not grant a licence unless the provider has demonstrated this suitability.”
Knowing which brands end up licensed will take some homework, and this resource from Casino.guru is a handy place to start. Its NZ page lists the licence holder behind each site it reviews, alongside a Safety Index the team builds from 200-plus data points, and it already covers the new law. Once licences are granted, that licence column becomes a fast way to see who’s operating legally here.
| Date | What happens |
| 13 October 2026 | Auction results announced |
| October 2026 | Licence applications open to winning bidders |
| 1 December 2026 | Sites without an application must stop serving NZ players |
| Early 2027 | Licensed market expected to be fully running |
What to do before a site packs up and leaves
There’s one tiny detail that gets missed. Closing an account doesn’t automatically delete what you uploaded to open it.
New Zealand’s Privacy Act gives you some rights here, and it can reach overseas businesses that carry on business in New Zealand. You can ask any agency for a copy of the personal information it holds about you, and it has 20 working days to respond. Privacy principle 9 adds that organisations should dispose of personal information once its purpose is done. If you get no reply, the Office of the Privacy Commissioner takes complaints.
For any account you stopped using, a short clean-up before the cutoff helps out:
- Withdraw your balance: Cash out while the site still serves NZ customers and support is reachable.
- Save your records: Screenshot or download your transaction history for tax or dispute purposes.
- Ask what they hold: Send a privacy request through the account itself and ask how long your ID documents will be kept.
- Close it properly: Use the site’s own account-closure option and keep the confirmation email.
Licensed operators are likely to hand identity checks to specialist firms. Since 1 May 2026, IPP3A has meant any organisation collecting your details secondhand must tell you “as soon as reasonably practicable after the information has been collected.” You can expect a short notice naming the verification provider.
Why scammers love a deadline
A real regulatory change with a hard date makes excellent bait. Reports of phishing and credential harvesting to the National Cyber Security Centre total 327 in April to June 2026, the most common category being scams and fraud at 348, and a hard cut-off date offers scammers a ready-made script.
“Your account will be closed under new NZ law. Verify now to keep your funds.”
That message could land in your inbox before Christmas. Skip the link entirely. Open the site from a bookmark and check the notices inside your account. The phishing guide covers where to report anything suspicious in New Zealand. Domains are getting attention too, with InternetNZ consulting until early November on extra privacy for .nz domain holders and a Protective Hold tool aimed at registrations that break the rules.
Where does your VPN fit?
Short answer is: it protects the connection, and that’s about it.
A VPN encrypts traffic between your device and the internet, which matters if you log in from a café or airport Wi-Fi. It won’t turn an unlicensed site into a licensed one, and it does nothing for a recycled password. Pair it with an authenticator app like Microsoft Authenticator on any account tied to your bank card. Two settings deserve a look in your VPN app. Switch on the kill switch, which cuts your connection if the VPN drops so nothing leaks out unencrypted, and pick a New Zealand server for logins so your bank and casino don’t flag a sudden overseas location.
New Zealand’s licensed market is still being developed, and the coming months will see which brands get to stay. Kiwi players also have a local regulatory agency to complain to when the time comes, as opposed to having to seek help desks in other time zones. Cleaning up your own data in the meantime is a relatively quick process.
