Alberta passed Bill 48, the iGaming Alberta Act, which received royal assent in May 2025. The law created the Alberta iGaming Corporation as a Crown corporation responsible for overseeing the province’s online betting market, with the Alberta Gaming, Liquor and Cannabis Commission acting as regulator. Provincial officials have pointed to late spring or early summer as a likely window for the market to go live. For bettors participating in online sports betting in Alberta, this means a new regulated environment with specific cybersecurity requirements built into licensing from day 1. Because online betting platforms handle financial transactions and personal data, cybersecurity protections play a central role in Alberta’s regulatory framework. The security of your money, your identity, and your data depends on how well the platform you choose has been vetted and how carefully you protect your own accounts.
This article covers what Alberta’s new rules require from operators on the technical side, what you should look for when choosing a platform, and what steps you can take on your own devices to keep your betting activity secure.
What Bill 48 Means for Operator Security Standards
The AiGC has set a compliance timeline that ties cybersecurity attestations directly to market entry. Before any operator can launch in Alberta, it must hold a SOC 2 Type 1 attestation. This is an independent audit that verifies a company has designed its internal controls around security, availability, processing integrity, confidentiality, and privacy according to standards set by the American Institute of Certified Public Accountants.
Starting in 2028, the requirements get stricter. Operators will need to maintain ISO 27001 certification and obtain a SOC 2 Type 2 attestation. The difference between Type 1 and Type 2 is time. Type 1 checks that the controls exist at a specific point. Type 2 evaluates how those controls perform over a sustained period, typically 6 to 12 months. ISO 27001 is an international standard for information security management systems, and holding it means the operator runs a formalized, audited process for managing data security risks on an ongoing basis.
The AGLC wants this proof up front, before an operator can launch. That sequencing matters because it prevents companies from entering the market and retroactively patching security gaps after collecting user data.
Checking Platform Credentials Before You Place a Bet
Alberta’s regulated market will require operators to hold SOC 2 Type 1 attestation before launch and maintain ISO 27001 certification by 2028, so the compliance bar is high on the operator side. On the bettor side, verifying that a platform meets these standards takes some effort. Reading third-party audits, checking AGLC licensing status, and consulting aggregated reviews from trusted sources like the top casino sites in Alberta as reviewed by Covers or RG Check accreditation listings all help confirm you are betting through a legitimate, security-compliant operator.
These regulated platforms typically offer wagering on major sports such as the NHL, NFL, NBA, and other professional leagues available through licensed sportsbooks.
Responsible Gambling Requirements Are Baked Into Licensing
The AiGC announced a partnership with the Responsible Gambling Council (RGC) that makes RG Check accreditation mandatory for all sites entering Alberta’s regulated market. RG Check is a program that audits an operator’s responsible gambling policies, tools, and player safeguards. It covers areas like self-exclusion options, deposit limits, session time alerts, and how operators handle at-risk behaviour.
This accreditation requirement functions as an additional layer of vetting. If a site carries RG Check accreditation and AGLC licensing, it has passed two separate review processes before it ever takes a bet from an Alberta resident. You can verify a platform’s RG Check status through the Responsible Gambling Council’s public listings.
Protecting Your Accounts on Your End
Regulatory standards govern the operator side. Your side of the equation still needs attention. A well-regulated platform can still be the entry point for a compromised account if your login credentials are weak or reused from another site.
Use 2-Factor Authentication
Enable 2-factor authentication on every betting account you create. This adds a second verification step, usually a code sent to your phone or generated by an authenticator app, after you enter your password. If someone obtains your password through a data breach on an unrelated service, they still cannot access your account without that second factor.
Build Strong, Unique Passwords
Each betting account should have its own password. A password manager can generate and store complex strings so you do not need to memorize them. Reusing passwords across services is one of the most common ways accounts get compromised, because a breach on one platform gives attackers a credential they can try everywhere else.
Keep Your Software Current
App and operating system updates frequently include patches for security vulnerabilities. Running outdated software on your phone or computer leaves known holes open. Set your devices to update automatically if possible, and check for pending updates before logging into a betting platform.
Recognizing Scams That Target Bettors
Phishing attempts aimed at bettors tend to follow predictable patterns. They exploit urgency and emotional manipulation to trick users into clicking links or entering credentials on fake login pages. An email telling you that your account will be suspended within 24 hours unless you verify your identity is a textbook example.
Before clicking any link in an email or text, inspect the sender’s domain. A legitimate message from an AGLC-licensed operator will come from its official domain, not a slight misspelling or a free email service. Hover over links to preview the URL before clicking. If the destination does not match the operator’s known web address, do not proceed.
Bookmark the official login pages of the platforms you use. When you need to access your account, go through the bookmark rather than through a link in a message. This simple habit eliminates most phishing risk.
Staying Within the Regulated Market
Unregulated offshore platforms are not subject to AGLC oversight, SOC 2 audits, ISO 27001 requirements, or RG Check accreditation. None of the protections Alberta built into its licensing framework apply to those sites. If something goes wrong with your funds or data on an unlicensed platform, you have limited recourse.
Sticking to AGLC-licensed operators keeps you within a system that has been designed with specific, enforceable security and responsible gambling requirements. The regulated market exists precisely so bettors do not have to guess about the legitimacy of a platform.
Conclusion
Alberta’s new iGaming framework sets a high bar for operator cybersecurity through mandatory SOC 2 attestations, upcoming ISO 27001 certification, and RG Check accreditation. Those requirements do a lot of the heavy lifting on the platform side. But your own habits fill in the rest. Strong passwords, 2-factor authentication, updated software, and basic phishing awareness will help keep your accounts and personal information secure as the province’s regulated market opens. The tools are straightforward and free to use, and they apply well beyond sports betting to every online account you hold.
FAQ
Is sports betting legal in Alberta?
Yes. Alberta legalized single-event sports betting through Bill C-218, and the province later passed the iGaming Alberta Act (Bill 48) to create a regulated online betting framework overseen by the Alberta Gaming, Liquor and Cannabis Commission.
What security standards must Alberta betting operators meet?
Operators entering Alberta’s regulated market must hold SOC 2 Type 1 attestation before launch. By 2028 they will also need ISO 27001 certification and SOC 2 Type 2 attestation to demonstrate ongoing cybersecurity compliance.
How can bettors protect their online betting accounts?
Using 2-factor authentication, creating strong unique passwords, and keeping devices updated are some of the most effective ways to protect betting accounts and personal data.
What is RG Check accreditation?
RG Check is a responsible gambling certification program run by the Responsible Gambling Council. It evaluates whether operators provide tools such as deposit limits, self-exclusion options, and player protection policies.
Why should bettors avoid offshore betting sites?
Offshore platforms are not regulated by the AGLC and are not required to meet Alberta’s cybersecurity or responsible gambling standards, which means bettors have fewer protections if issues occur.
