Online Poker Platform DevelopmentReal-Money Gaming Apps, Tournaments, and Multi-State Networks in 2026

Online poker occupies a strange middle ground in the gambling industry: a global market that industry research estimates at roughly $4.7-5.5 billion in 2026, dominated by a handful of established international operators, sitting on top of a US regulatory landscape that remains fragmented, state-by-state, and legally cautious. Before any platform decision — architecture, tech stack, or vendor selection — the market and legal reality has to be understood, because it determines almost everything else about how the product gets built.

Internationally, the market is mature and consolidated. PokerStars, part of Flutter Entertainment, has operated for over two decades and remains the platform most associated with high-stakes cash games and mixed-game variety. GGPoker has grown rapidly since 2021, consistently ranking among the largest rooms by cash game traffic and building a close partnership with the World Series of Poker brand. 888poker and partypoker round out the group of long-established international rooms. These platforms operate under licenses from regulators like the UK Gambling Commission and the Malta Gaming Authority, and they represent decades of accumulated engineering investment in anti-collusion systems, tournament software, and player trust — a baseline any new entrant is implicitly competing against on product quality, even in a narrower geographic market.

The US market looks very different. Federal law (the Unlawful Internet Gambling Enforcement Act and, more directly, individual state statutes following the 2011 US Department of Justice reinterpretation of the Wire Act as applying only to sports betting) leaves online poker legality up to each state. As of 2026, six states have active, licensed online poker operators: Nevada, New Jersey, Michigan, Pennsylvania, Delaware, and West Virginia. Three more — Connecticut, Maine, and Rhode Island — have passed legal frameworks but have no operators live yet, and every other state either explicitly prohibits real-money online poker or has simply never addressed it in statute. This isn't a temporary gap that's closing quickly; it's been the stable shape of the US market for years, and any platform plan targeting the US has to be built around it rather than assuming a nationwide launch is coming.

Getting licensed to operate real-money online poker in the US is not a single process — it's a separate application, background check, and fee structure in every state you want to operate in, and the fees alone can dwarf the cost of building the software. Pennsylvania is the starkest example: its Gaming Control Board charges $4 million for a license covering a single game category (poker, slots, or table games alone) or $10 million for a comprehensive license covering all three, plus a $250,000 five-year renewal fee. New Jersey's structure is different but still substantial — a $100,000 deposit against a $300,000 first-year fee, plus a separate $250,000 annual contribution to the state's compulsive gambling treatment fund. Michigan's licensing runs faster (often 6-8 months versus New Jersey's 9-14) but still requires supplier and operator licenses in the low-to-mid six figures. None of this includes legal counsel, background investigation costs for company principals, or the bonding and financial requirements most states impose.

Because a single-state license is so expensive relative to a single state's player base, shared liquidity became the mechanism that makes online poker economically viable at all outside of a few dense states like Pennsylvania. The Multi-State Internet Gaming Agreement (MSIGA) is the compact that makes this legal: it lets licensed operators in member states pool their players into one combined table and tournament pool instead of running each state as an isolated island with too few players for healthy game selection. Nevada and Delaware signed the original agreement in 2014, New Jersey joined in 2017, Michigan in 2022, West Virginia in 2023, and Pennsylvania — the compact's largest expansion to date — joined in April 2025. All six currently regulated states are now MSIGA members.

MSIGA membership is a legal prerequisite, not an automatic technical outcome — a platform still has to be engineered to support it. That means the matchmaking and tournament engine needs to know, per player and per hand, which jurisdiction that player is physically located in and which pool they're eligible to join, since eligibility can change if a player crosses a state line mid-session. This is one of the clearest examples in the entire build of a requirement that's simultaneously a legal compliance question and a hard software architecture problem, and it's worth designing for from day one even if your first launch is a single state, because retrofitting jurisdiction-aware pooling onto a platform that assumed one flat player base later is expensive.

A real-money poker platform is a fundamentally different engineering problem than a typical consumer app, and it's also a different problem than a general iGaming casino platform. Casino games (slots, blackjack, roulette) are player-versus-house: the outcome and payout math is baked into the game itself, and the server's job is mostly to run that math honestly and record the result. Poker is player-versus-player: the platform isn't setting the odds, it's fairly dealing cards, tracking a live betting round across multiple seats, enforcing action order and timeouts, calculating side pots when players go all-in for different amounts, and settling a rake that funds the house's cut. None of that logic exists in a generic casino game engine or off-the-shelf iGaming SDK.

The server-authoritative principle is worth emphasizing on its own, because it's the single architectural decision that most separates a real-money poker engine from a typical multiplayer app. Every card dealt, every pot calculation, and every legal-action check has to happen on infrastructure the operator controls and a regulator can audit — a client only ever renders what the server tells it and sends the player's intended action back for validation. This has real performance and cost implications: it means the server does meaningfully more work per hand than a client-authoritative game would, and it's why poker platforms are typically built and hosted with dedicated attention to latency and uptime rather than treated as a standard web or mobile app deployment.

Every hand of online poker depends on one component being provably fair: the random number generator that drives the shuffle. Get this wrong — or fail to prove it's right — and there's no regulated platform at all, regardless of how polished the rest of the product is. The standard approach is a cryptographically secure pseudo-random number generator feeding a shuffle algorithm (commonly a Fisher-Yates-style algorithm, which produces a mathematically unbiased permutation of the deck) run entirely server-side, with the resulting card order never transmitted to a client until each card is legitimately revealed.

Building an RNG isn't a matter of internal confidence — it has to be independently certified. Gaming Laboratories International (GLI) publishes GLI-19, the technical standard most US states and many international regulators reference for interactive gaming systems, covering RNG statistical behavior, game logic and math, system security, and reporting. GLI-19's RNG chapter is typically the most heavily scrutinized section: labs classify and test RNG implementations for statistical randomness, unpredictability, and resistance to seed prediction before certifying that a platform's shuffle can legally be used for real-money play. The UK Gambling Commission's Remote Gambling and Software Technical Standards and similar frameworks in other jurisdictions serve the same function outside GLI's direct footprint.

Certification isn't a one-time event tied to launch — every material change to the shuffle algorithm, RNG library, or game logic typically requires re-submission to the lab before it goes live, which is why the RNG and shuffle engine are usually isolated as a stable, carefully version-controlled core of the platform rather than code that changes with every release.

Beyond the RNG itself, regulators expect every dealt card and shuffle to be logged in a way that supports independent reconstruction — if a player disputes a hand, the operator (and, on request, the regulator) needs to be able to show exactly how that hand's deck was shuffled and dealt from the immutable server-side log, not just report a final result. This logging requirement threads through the entire platform architecture described in the previous section: it's not a bolt-on audit feature, it's a property the hand history and ledger system has to be designed around from the start.

Fair dealing is only one piece of regulatory compliance. A licensed poker platform also has to continuously prove three separate things about every player: that they're physically located in a licensed state, that they're a real, age-verified person, and that their money isn't part of a laundering scheme. Each of these is its own compliance discipline with its own vendor ecosystem, and treating them as one generic "verification" step is a common and costly architectural mistake.

Geolocation deserves particular attention because it's the layer most unique to gambling compliance and the easiest to underestimate. GeoComply, the vendor most widely used across US regulated sports betting and iGaming, handles this by fusing multiple concurrent location signals so a player can't spoof their location with a simple VPN. A platform has to call this check not just at login but periodically throughout a session, and it needs a defined, regulator-compliant behavior for what happens to a player's hand or tournament entry if they're found outside the licensed boundary mid-session — a real product and UX decision, not just a backend flag.

Payments carry their own friction. Because gambling is classified as a high-risk merchant category, most mainstream payment processors won't touch it, and platforms typically work with specialized gambling payment processors that layer PCI DSS 4.0 compliance, fraud screening, and jurisdiction-aware payment method availability (some states or payment networks restrict certain deposit methods for gambling specifically) into a single integration. Responsible gambling controls — deposit limits, loss limits, cooling-off periods, and self-exclusion — are also typically required by regulators and have to be enforced at the payment and session layer, not just offered as a settings toggle a player can ignore. Every regulated platform should also surface the National Problem Gambling Helpline (1-800-522-4700), a free, confidential, 24/7 resource available across all 50 states.

Fair dealing solves cheating by the platform; game integrity systems solve cheating by players against each other, which is a distinct and ongoing engineering discipline of its own. Poker's player-versus-player structure creates cheating incentives that don't exist in casino games: two or more accounts secretly sharing hole card information (collusion), automated scripts playing thousands of hands with minimal human oversight (bots), and multiple accounts controlled by one person to gain a seating or information advantage (multi-accounting).

Large established operators run this detection continuously in production rather than treating it as an occasional audit. Both PokerStars and GGPoker use machine learning models trained on large volumes of historical hand data to flag statistical anomalies — win rates well outside normal variance, betting patterns that look coordinated between specific accounts, or repeated session overlap that suggests two "different" players are actually the same person or a colluding pair. This is paired with device and browser fingerprinting, which collects dozens of hardware and software signals to detect when supposedly separate accounts are actually running on the same machine or a cluster of machines at one location.

• Behavioral analytics: Statistical models flag win-rate outliers, unusual folding/betting patterns, and hands where two players' actions correlate suspiciously well across many sessions.
• Device and network fingerprinting: Hardware and browser signals detect when multiple accounts share a device, IP range, or network fingerprint consistent with a shared physical location.
• Session and table correlation: Flags accounts that repeatedly end up seated together across many different tables, which is statistically unlikely without deliberate coordination.
• Human review and reporting: Automated flags route to a security review team, and players can report suspected collusion or bots directly, since automated systems alone rarely catch everything.

The practical takeaway for anyone scoping a build is that integrity monitoring can't be a phase-two feature. Retrofitting collusion and bot detection onto a platform that's already live with real money moving through it is far harder than instrumenting the hand history, session, and device data these models need from the very first release. This is one of several reasons a poker platform's engineering roadmap looks different from a typical consumer app's — some "nice to have later" features elsewhere are non-negotiable launch requirements here.

Beyond fair dealing and compliance, players judge a poker platform on game selection and tournament quality — and this is where a purpose-built poker engine earns its cost relative to a generic real-time multiplayer framework. Cash games, Sit & Go tournaments (SNGs), and Multi-Table Tournaments (MTTs) each carry distinct rules and system requirements that have to be modeled explicitly.

Table balancing is one of the more deceptively hard problems in this list: as players are eliminated from an MTT, the system has to consolidate tables in real time, moving players between tables to keep seat counts even, without ever pausing action, breaking hand history continuity, or seating two colluding accounts together by algorithmic accident. Blind level structures, break scheduling, and late registration windows all interact with this balancing logic, and a platform's reputation among serious players is built substantially on how smoothly these mechanics run under real tournament load, not just on the UI polish of the client apps.

Rake — the fee the platform takes from cash game pots or tournament buy-ins — is the core revenue mechanism, and its calculation has to be both accurate to the cent and transparent to players, since rake structures are frequently scrutinized by both players and regulators. Getting this logic wrong, even by a small percentage, is the kind of bug that erodes player trust fastest in a real-money environment, which is why rake calculation typically gets the same rigorous testing attention as the RNG itself.

Pulling the previous sections together into a budget: a general iGaming casino platform build (slots, table games) commonly runs from roughly $80,000 for a lightweight product up to $1.5 million for a full-featured, multi-game enterprise casino platform, according to industry cost surveys. A real-money poker platform starts from a comparable or higher core engineering cost — because of the player-versus-player game logic, tournament systems, and integrity monitoring described above — and then adds licensing, certification, and compliance costs that a casino-only platform in a single friendly jurisdiction may not face at the same scale.

Add these together for a platform targeting even one or two MSIGA states with a comprehensive license, and the realistic total — engineering plus licensing plus certification plus first-year compliance operating costs — commonly lands in the $2 million to $10 million-plus range, with licensing fees frequently the single largest line item rather than software development. This is a materially different budget conversation than most consumer or enterprise app builds, and it's why poker and iGaming platform projects need cost planning and legal/compliance counsel engaged from the very first scoping conversation, not after the software is already designed.

Timeline follows the same pattern: engineering the game engine, real-time infrastructure, and client apps for an experienced team typically takes several months, but it's rarely the critical path. State licensing review, background investigations on company principals and key employees, and independent lab certification of the RNG and game logic frequently take longer than the software build itself, and multi-state MSIGA participation adds coordination overhead across each state's individual regulator and timeline. Realistic end-to-end timelines from kickoff to a live, licensed single-state launch commonly run nine months to two years, with multi-state expansion adding further time per additional jurisdiction.

Frenchy Digital builds the technology layer that regulated real-money gaming operators need — the game engine, real-time multiplayer infrastructure, mobile and web clients, and back-office tooling — architected around the compliance realities covered in this guide, from jurisdiction-aware matchmaking for MSIGA pools to integrations with third-party licensed RNG, GeoComply-style geolocation, KYC/AML, and PCI DSS-compliant payment providers. That combination of MVP development, enterprise-grade custom engineering, and a security audit practice suited to systems that handle real money and sensitive player data maps directly onto what a poker or iGaming platform build actually requires — a technology partner comfortable with both the product engineering and the compliance-driven architecture decisions that shape it from day one.

Frenchy Digital is headquartered in Los Angeles, with international teams in Geneva, Switzerland and Paris, France — coverage that matters for iGaming projects, where compliance vendors, licensing counsel, and international operators frequently work across US and European hours simultaneously. The gambling license itself is always issued directly to the operator by the relevant state regulator, never to the development partner, so Frenchy Digital's role is the engineering and compliance-integration work that runs in parallel with an operator's own legal and licensing process — including startup consulting support for teams scoping which states and which licensing tier make sense before committing capital.

Ready to scope your online poker or iGaming platform? Schedule your free discovery call and get a clear read on the architecture, compliance integrations, and realistic budget for your target states.