How we rank Malaysian casino sites
We score each casino out of 100 across seven criteria. Transparency, withdrawal rules and ringgit banking carry 60 of those points, because they decide who you are dealing with and whether you can get your money out.
| Criterion | Weight | What we look at | What we cannot see from outside |
|---|---|---|---|
| Operator transparency (named company, licence number that can be checked) | 20 | Company name and licence number, matched on the regulator's own register | Who owns the business, where player money is held |
| Withdrawal rules and limits published | 20 | Minimum withdrawal, daily or monthly caps, number of withdrawals allowed | How quickly payouts arrive |
| Ringgit banking methods and limits published | 20 | Ringgit methods listed (online banking, FPX, DuitNow, Touch 'n Go, USDT) and limits per method | Whether a method works on the day you use it |
| Bonus terms stated in public (wagering, max bet, expiry) | 15 | Wagering, maximum bet and expiry on a public page, consistent across the site | How strictly terms are applied at withdrawal |
| Game range and named studios | 10 | Products offered, and whether the studios behind them are named | Whether each game is the studio's official version |
| Support channels and hours | 10 | Listed channels, stated hours, site languages | How fast and how accurately agents answer |
| Mobile access | 5 | Android app, iOS app or mobile site, and where downloads are offered | How an installed app handles your data |
Scores come from what operators publish on their own sites, checked on 23 September 2026, the date shown on this page. We have no deposit or withdrawal test data, so a high score reflects clear published rules rather than fast payouts.
What decided the order
We keep the scores themselves internal and publish only the order they produce, with one exception. U88 is our commercial partner and sits first because of that partnership; the other four are in the order their scores give. MD88's pages give no licence number, one still says Curaçao, and its portal and betting platform disagree on some figures. BK8 scores best on transparency but publishes no minimum deposit or withdrawal figures. 12Play shows no licence number and names the fewest game providers. Longfu88 has the fullest banking table but names no licence or company, the main reason it ranks last.
What gets a casino left off our shortlist?
A casino is left off if we cannot trace who runs it, read its rules before signing up, reach its support, or pay it through a channel that leads back to the operator. Any one of these rules it out:
- No traceable official domain. A mirror (a copy of the site on another address) or a link from a chat cannot be told apart from a clone.
- No terms and conditions. Without written bonus and withdrawal rules, the casino decides the rules after you win.
- No working support channel. If nobody answers before you deposit, nobody will when a withdrawal is stuck.
- Deposits only to a personal bank account or a chat "agent". Your money goes to an individual, not a company you can hold to anything.
- Withdrawal fees demanded upfront. A "tax" or release fee before payout is a strong sign the payout is not coming.
- Fake or unverifiable licence seals. A seal that is only a picture, or names a company missing from the regulator's register, proves nothing.
- Banking and bonus terms hidden until you register. You should see deposit methods and wagering before handing over personal details.
Three operators we assessed were left off. Lucky Star's only reachable domain calls itself a mirror and shows no licence or company. DK88's own pages contradict each other on its licence, and it shows no banking or bonus terms before login. PlayDash shows its payment methods and bonus terms only after login. We make no accusation of wrongdoing against any of the three; the problem is that a reader cannot check the basics before depositing.
Some shortlisted sites also carry old Curaçao wording, but their operators' Anjouan records show VALID and their payment and bonus terms are public. Once on a site, watch for the red flags that should stop you depositing.
What does an offshore casino licence really mean?
An offshore licence means a foreign regulator has authorised the operator, and its number lets you check that on the regulator's register. It does not make online casino play legal in Malaysia or give you any protection under Malaysian law.
Which licences the shortlist shows
The operators behind BK8 and MD88 hold Anjouan licences that show VALID on the Anjouan regulator's register, although both sites still mention Curaçao somewhere. U88 holds a Curaçao licence and does not publish the licence number. 12Play says it is licensed in Montenegro but shows no licence number, and Longfu88 names no licence at all.
What a licence number lets you check
On the regulator's own register, a number shows whether the licence is valid, which company holds it and which websites it lists. All three Anjouan records list a different website from the Malaysian site (BK8's lists bk8sports.com), so the check confirms that the company holds a licence but cannot tell you whether the address in front of you is covered.
Why it does not protect you in Malaysia
On 18 October 2023 the Court of Appeal ruled that online gambling is an offence in Peninsular Malaysia under the Common Gaming Houses Act 1953 (Act 289), and a licence from Anjouan, Curaçao or Montenegro does not change that. No Malaysian regulator will take up your case against an online casino. The sites themselves get blocked as well. At MCMC's request, internet providers blocked 1,778 gambling websites between January 2025 and May 2026.
How to check a licence seal yourself
- Click the seal: it should open the regulator's own website, not an image or a casino page. Better, search the register yourself for the licence number or company name.
- Match the company on the register with the one named in the casino's terms and conditions.
- Check the licence status and which websites the record lists.
- No number, or no matching record? Treat the licence as unverified.
Casino app or mobile browser: which is safer?
The mobile browser is the safer default, with nothing to install and no extra permissions to grant. If you want an app, download it only through a link on the operator's official site, never from a file or link sent in a chat.
MD88 and BK8 offer Android and iOS apps, U88 says its app runs on both, 12Play offers an Android app, and Longfu88 has no app, only a home-screen shortcut.
| Aspect | Browser | Downloaded app (APK or iOS profile) |
|---|---|---|
| How you get it | Type the address or use a bookmark | An APK (Android) or a profile or web app (iPhone), from the site or a chat link |
| What you must allow | Nothing | Android: installs from unknown sources. iPhone: trusting a profile or developer |
| Access to your phone | Only what the browser allows | Whatever the app requests, which can include your SMS messages |
| Updates | Always the current site | Often a new file to install; a fake update can carry malware |
| Data use | Live dealer video uses the most data | The same streams, plus storage for the app |
Sideloading is the main risk. An APK sent through WhatsApp or Telegram may not be the operator's file. If a casino app asks to read your SMS messages (where one-time codes often arrive) or contacts, or wants accessibility access, uninstall it.
iPhones are more locked down. An iOS casino app offered outside the App Store usually means adding a configuration profile or trusting an unfamiliar developer in Settings. Either step gives that source more reach than a website has, and a home-screen shortcut to the site needs neither.
What does good casino support look like?
Good support is there around the clock, on a channel that leaves a written record, in a language you are comfortable with, and its answers match the written terms.
Every casino on our shortlist lists 24/7 live chat. Beyond chat, U88 lists phone and email, 12Play and Longfu88 list email, MD88 lists email, WhatsApp, phone and WeChat, and BK8 lists Telegram. Take any messaging number or handle from the operator's own site, since anyone can open a chat account with a casino's logo, and keep transcripts of what support confirms.
Five questions to ask support before you deposit
- What are the daily and monthly withdrawal limits for a new account?
- Which documents do you need to verify my identity, and can I send them before my first withdrawal?
- Must my withdrawal account be in my own name, and can it be the one I deposit from?
- If I take the welcome bonus, what is the turnover, the maximum bet, and which games count?
- Which licence do you hold, what is its number, and which company is it issued to?
If the answers are vague, or support pushes you to pay a personal account or an outside "agent", do not deposit. Our guide to how wagering requirements work covers turnover and maximum-bet rules.
Online casinos vs Genting Highlands
Genting Highlands has Malaysia's only licensed casino, where gaming is limited to those aged 21 and over and closed to Malaysian Muslims. Offshore online casinos are not licensed or permitted in Malaysia.
| Factor | Online casino (offshore) | Casino de Genting |
|---|---|---|
| Legal status in Malaysia | Not licensed or permitted; an offence under Act 289 in Peninsular Malaysia (Court of Appeal, 2023) | Malaysia's only casino licence, held by Genting Malaysia Berhad, renewable every three months |
| Minimum age | None: online casino play is not permitted at any age | 21, under Genting's membership terms |
| Who can enter (Muslims) | Not permitted for anyone; for Muslims also a Syariah offence (for example Act 559, section 18, in the Federal Territories) | Malaysian Muslims are excluded from gaming and get non-gaming SkyCards only |
| Stakes | Set by each operator; published minimum deposits on our shortlist run from RM10 to RM30 | Set per table; not quoted here, as the casino's web page was under maintenance when checked |
| Getting paid | By the operator, within its own limits (U88, for example, allows up to three withdrawals and RM50,000 a day) | In person at the casino |
| Protection if something goes wrong | No Malaysian regulator to turn to; only the operator or its overseas regulator | A Malaysian licensed company under Malaysian law |
Genting's own notice says online gaming is not legal or permitted in Malaysia and that it offers or endorses none, so a site using its name for online play here is not Genting's. Malaysia has one casino licence, and in April 2024 the Prime Minister ruled out a second, for Forest City in Johor.
Frequently asked questions
How is the order of the casinos decided?
By seven weighted criteria that add up to 100 points. Operator transparency, withdrawal rules and ringgit banking carry 20 each, bonus terms 15, games and support 10 each and mobile access 5, all scored only on what each operator publishes. We earn commission, as our affiliate disclosure sets out, but the order follows the scores.
How often is this comparison updated?
There is no fixed schedule. The facts here were last checked on 30 September 2026 for U88 and 23 September 2026 for the other four, and the date at the top of the page which also changes whenever we make a correction. Casinos can change bonuses, limits and web addresses at any time, so confirm figures on the operator's terms page before you deposit.
Does a Curaçao or Anjouan licence make a casino legal in Malaysia?
No. Whatever licence a site holds abroad, online casino play is not licensed or permitted in Malaysia. In October 2023 the Court of Appeal ruled that online gambling is an offence in Peninsular Malaysia under the Common Gaming Houses Act 1953. A Curaçao or Anjouan licence only shows which overseas regulator the operator answers to.
Are casino APK files safe to install?
No, not by default. An APK from outside Google Play skips Google's store review, and one sent through a chat link may not be the operator's file. If you install one, use a link on the operator's official site and refuse permissions such as reading your SMS messages, or skip the install and use the mobile browser instead.
Can I trust a casino that only takes deposits through WhatsApp or Telegram agents?
No. When the only way to pay is a chat "agent" or a personal bank account, your money goes to an individual and nothing links it to the operator. If the agent disappears, there is nobody to claim against, which is why this alone keeps a site off our shortlist.
Which languages do casino support teams offer?
English at all five shortlisted casinos, Chinese at four and Malay at U88, MD88 and BK8, going by each site's published languages. Each lists 24/7 live chat, so test it with a question in your own language before you deposit rather than trusting the language menu.
Can I enter the Genting casino at 18?
No. The minimum age to gamble at Resorts World Genting is 21, and under-21s, like Malaysian Muslims, can hold only a non-gaming SkyCard. The age of 18 does appear in the Pool Betting Act 1967 (2006 reprint), which allows pool betting from that age, while licensed 4D operators such as Magnum and Da Ma Cai set 21.
What responsible gambling tools should a casino site offer?
Look for deposit limits, loss limits, session reminders, a cool-off break and self-exclusion you can switch on yourself, and count it against a site that offers none. Our responsible gambling guide covers each tool, and Befrienders KL offers free, confidential emotional support 24 hours a day on +603-7627 2929.
Sources
- Free Malaysia Today: Court of Appeal rules online gambling an offence (18 October 2023)
- Common Gaming Houses Act 1953 (Act 289), official reprint
- The Star: 1,778 gambling websites blocked since January 2025 (16 July 2026)
- Resorts World Genting: notice that online gaming is not legal in Malaysia
- Resorts World Genting: Genting Rewards terms and conditions
- Resorts World Genting: Genting Rewards FAQ (SkyCards)
- Genting Malaysia Integrated Annual Report 2024
- The Star: no second casino licence for Forest City (26 April 2024)
- Syariah Criminal Offences (Federal Territories) Act 1997 (Act 559)
- Pool Betting Act 1967 (Act 384), official reprint
- Magnum 4D: play responsibly
- Da Ma Cai: responsible gaming
- Befrienders Kuala Lumpur
- U88 homepage (founding year, languages, apps)
- MD88 portal and licence statement
- BK8 Malaysia homepage and licence footer
- 12Play Malaysia homepage
- Longfu88 payments page