Alberta iGaming: Geolocation, IP Blocking, and Cross-Provincial Player Rules Under the SRIG

Under AGLC’s Standards and Requirements for Internet Gaming (SRIG), issued January 14, 2026 under authority of the Board Chair, registered operators must ensure that games are provided only within Alberta unless they are conducted in conjunction with the government of another province. The mandate is categorical: when the gaming system cannot confirm that a player is physically inside Alberta, it must block play. There is no grace period, no fallback to account-level residency, and no operator discretion on the timing of that block. Compliance officers designing or auditing location-control architectures for the Alberta market need to understand not just that rule, but the specific technical stack it implies, the account-creation obligations that sit alongside it, and the record-retention obligations that attach to every location check performed.

The Legal Foundation: Province-Boundary Gaming Under Criminal Code Section 207

Alberta’s regulated iGaming market operates as a provincial lottery scheme under the iGaming Alberta Act and the Gaming, Liquor and Cannabis Act (Alberta). The federal criminal-law foundation is section 207 of the Criminal Code of Canada, which exempts provincially conducted and managed lottery schemes from the general prohibition on gambling. That exemption is explicitly territorial: it applies to conduct within the province. A lottery scheme conducted and managed by or on behalf of the Government of Alberta is lawful precisely because it is limited to Alberta. Any extension of that scheme to players outside the province, absent an authorised inter-provincial arrangement, removes the activity from the scope of the section 207 exemption.

The SRIG’s location requirements in Section 4.2 are the direct technical expression of this constitutional constraint. The rule that operators must ensure games are provided only within Alberta is not a regulatory preference, it is the mechanism that keeps the scheme within the legal perimeter on which the entire market’s authority depends. That distinction matters for compliance prioritisation: geolocation failure is not a technical deficiency in the same category as a log format error. It is an integrity failure that goes to the legality of the gaming activity itself.

What SRIG Section 4.2 Actually Requires

Section 4.2 of the SRIG sets out the location obligations in two layers. The overarching obligation falls on registered operators: they must ensure games are provided only within Alberta, except where games are conducted in conjunction with the government of another province. The technical implementation layer then specifies what the gaming system must do at a minimum.

“Registered Operators must ensure games are provided only within Alberta unless they are conducted in conjunction with the government of another province. At a minimum, the gaming system must: ensure [players are physically located in Alberta] and block play whenever location cannot be verified.”

The phrase “at a minimum” is deliberate. AGLC sets a floor, not a ceiling. Operators using more sophisticated multi-signal geolocation architectures, combining IP intelligence, GPS, Wi-Fi triangulation, and device fingerprinting, meet the floor and exceed it. Operators relying solely on IP geolocation do not meet the floor, because IP addresses can be spoofed, masked by VPNs, or mapped inaccurately to locations near provincial borders.

The inter-provincial carve-out in Section 4.2 is specific: games conducted “in conjunction with the government of another province.” This is a government-to-government or government-authorised arrangement, not a commercial one. An operator that is registered in both Ontario and Alberta and chooses to run a shared poker liquidity pool does not satisfy this carve-out unilaterally. As of the July 13, 2026 market launch, no inter-provincial shared-liquidity arrangements had been publicly announced for Alberta, and the default position for all operators is that the Alberta gaming site is closed to players outside the province.

The Geolocation Technology Stack: What GLI-19 Prescribes

The SRIG requires that critical gaming systems be certified by an AGLC-registered Accredited Testing Facility (ATF) before deployment. For geolocation components, the applicable technical standard is described as GLI-19 Standards for Interactive Gaming Systems, version 3.0. Section 2.7 of GLI-19 sets out location detection requirements that ATF certification would test against, and operators are advised to understand this standard as the design specification for their location-control architecture.

GLI-19 Section 2.7.4 addresses location detection on public networks, which covers all internet-facing iGaming. The standard is described as requiring the interactive gaming system to incorporate a location detection service or application that reasonably detects and dynamically monitors the location of a player attempting to play a game, and that monitors and enables blocking of unauthorised attempts.

On signal hierarchy, industry standards emphasize that accurate location data sources, Wi-Fi, GSM, GPS, should be utilised by the geolocation method to confirm the player’s location. IP address alone is considered insufficient as a primary signal. Where the remote player device’s only available location data source is an IP address, the location data of a mobile device registered to the player account may be used as a supporting data source, provided the remote player device and the mobile device are determined to be near one another and, where permitted by the regulatory body, carrier-based location data may also be used. The hierarchy is therefore: precise signals (GPS, Wi-Fi, GSM) are the primary confirmation layer, IP address is a supporting or fallback signal only, not a stand-alone compliance mechanism.

Signal Type	GLI-19 Role	Stand-alone Sufficient?	VPN/Spoofing Risk
GPS	Primary accurate signal	Yes (if available)	Low (requires device compromise)
Wi-Fi triangulation	Primary accurate signal	Yes (in range)	Low
GSM / cell carrier	Primary accurate signal	Yes (if carrier data permitted)	Low
IP address geolocation	Supporting / fallback only	No	High (VPN, proxy, Tor)
Device fingerprinting	Fraud-detection layer	No (supplementary)	Moderate

GLI-19 Section 2.7.4 also requires the geolocation method to possess the ability to control whether the accuracy radius of the location data source is permitted to overlap or exceed defined buffer zones or the permitted boundary. This is operationally significant at Alberta’s borders. The province shares borders with British Columbia, Saskatchewan, the Northwest Territories, and Montana. A player sitting in Lloydminster, straddling the Alberta-Saskatchewan border, may generate a confidence radius that overlaps the boundary. The system must be configured to treat a confidence radius overlapping the boundary as unverified, not as “probably inside.” GLI-19 further requires the use of boundary polygons based on audited maps approved by the regulatory body, not commercial approximations.

Circumvention Detection: VPNs, Proxies, and Remote Desktop Tools

The SRIG’s requirement to block play whenever location cannot be verified implicitly covers location spoofing, but industry standards make the obligation explicit. Studies suggest that geolocation services should detect and prevent circumvention attempts using VPNs, proxies, virtual machines, and remote desktop programs. According to geolocation service guidance, providers should maintain a real-time data feed of all location checks and an up-to-date list of potential location fraud risks, including fake location apps and virtual machines. The provider should offer an alert system to identify unauthorised or improper access and should facilitate routine delivery of supplemental fraud reports covering suspicious or unusual activities, account sharing, and malicious devices.

In practice, operators contracting with third-party geolocation service providers, such as those that serve the Ontario and US state markets, should require their providers to demonstrate ongoing fraud-list maintenance and to confirm the list covers Canadian-specific VPN exit nodes and proxy infrastructure. Generic global fraud lists built for US jurisdictions may not flag Canadian-specific routing patterns. Compliance teams should specify this in vendor contracts and verify it during ATF certification documentation review.

GLI-19 also requires that the geolocation method monitor and flag for investigation any games played by a single player account from geographically inconsistent locations. A player account logging sessions from Edmonton on Monday and then appearing with a verified BC location on Tuesday is a flag, not just a block. The system must capture this pattern and make it available for review, separate from the per-session blocking obligation.

Account Creation: Residency Proof and Address Verification

Geolocation at the session level is distinct from residency verification at account creation. The SRIG addresses both, and compliance teams must not conflate them.

At account creation, Section 4.4 of the SRIG requires that information relating to player identification and verification be captured and form part of the auditable trail of events. AGLC’s centralized prohibited persons system requires operators to maintain effective API connections to AGLC’s centralized information system to verify that registering players are not on the prohibited persons list. All players must be authenticated prior to accessing their player account and being permitted to gamble.

Identity verification at account creation authenticates legal name, residential address, and date of birth. Under GLI-19 Section 2.4 (account registration), identity verification must authenticate the legal name, residential address, and date of birth of the individual at a minimum. The residential address captured at registration is not the same as a per-session location check: it establishes the player’s identity on record and serves KYC purposes under FINTRAC obligations, but it does not satisfy the ongoing geolocation requirement. An Albertan who registers with a valid Alberta address and then travels to British Columbia is still subject to session-level blocking when their device signals a non-Alberta location, their registered address does not override real-time location data.

A player physically located in Manitoba who attempts to register on an Alberta-licensed site presents a different problem: their device location will fail the Section 4.2 check before account creation completes. Operators should confirm that their registration flows enforce the geolocation check at the earliest point in the onboarding sequence, not at the point of first deposit or first wager.

Travelling Albertans: Session Blocking vs. Account Suspension

One of the most operationally common questions for Alberta operators is what happens to an established Alberta player who temporarily travels out of province. The SRIG does not create a separate “travelling player” category or a temporary-absence grace period. The obligation is binary: if the gaming system cannot verify that the player is physically located in Alberta, it must block play. Account suspension is not required for a single out-of-province session, the account remains valid. The block is a session-level control, not an account-status change.

In practice, this means operators should design their systems to present a clear in-session message when a player’s location cannot be verified or falls outside Alberta, explaining that play is not available from the player’s current location and that their account remains active for when they return. The system should not characterise the block as an account suspension, and it should not initiate any account-closure or fund-return workflow unless other grounds, such as a prohibited persons list match, exist independently.

Where a player’s location signal is ambiguous, for instance because they are near a provincial border and the confidence radius overlaps, the system must treat the ambiguous signal as unverified. GLI-19’s boundary polygon requirement is the mechanism here: if the confidence radius overlaps the Alberta boundary, the system must not grant access. Operators near the BC or Saskatchewan border should map their confidence-radius thresholds against the specific Alberta boundary polygon approved by AGLC and confirm during ATF testing that their buffer-zone settings are correct.

Live Dealer: The Cross-Provincial Edge Case

Live-dealer products present a specific compliance edge case. Under SRIG Section 4.5, live-dealer games are subject to the same player location requirements as other game types. A player accessing a live-dealer table from outside Alberta triggers the same geolocation block as a player accessing a slot or sports-betting market. There is no carve-out for live dealer based on the physical location of the dealer studio.

The edge case arises where a live-dealer studio is located outside Alberta but supplies tables exclusively to Alberta-registered sites. The location of the studio is a supplier obligation, not a player-location exemption. The operator remains responsible under Section 4.2 for ensuring only Alberta-located players access those tables. Operators must not conflate the supplier’s studio location with the player’s physical location: these are independent compliance checks. Live-dealer certifications covering the dealing equipment, shuffle verification, and game integrity are handled under SRIG Section 4.5 and ATF certification, but they do not modify the player-location obligation in Section 4.2.

For peer-to-peer games under SRIG Section 4.9, the same principle applies. In a poker game where all players at a table must be Alberta-located, a single player whose location check fails must be removed from the table. The SRIG does not allow an operator to continue a hand in progress with an out-of-province player, and the system must handle mid-session location failures gracefully, ending participation and recording the event in the audit log.

Audit Log Retention for Location Checks

The SRIG’s record-retention and logging obligations are set out in the information technology and security requirements, and they apply directly to geolocation data. The SRIG requires continuous logs to be maintained for critical gaming systems, including tracking of financial accounting and game state history. Logs must be protected against alteration, through WORM storage, immutability controls, or cryptographic signing with SHA-256, and transmitted and stored over TLS 1.2 or higher. Access to logs must be role-based, with segregation of duties between operations and monitoring.

“Retain event and security logs for at least one year online and seven years archive or as otherwise required by regulation.”

The seven-year archive obligation encompasses geolocation logs. Every location check, including the signal source, the confidence radius, the outcome (pass/block), and the timestamp, must be retained in a tamper-evident format for seven years. AGLC inspectors have the right to request access to these logs, and the SRIG requires operators to assist inspectors in carrying out inspections and to provide access to systems and system information records upon request.

The SRIG also requires that accurate and complete records of transaction and game state and play information be kept and made available for the purposes of ensuring timely investigations, resolving disputes, and tracking all relevant player information including funds information. Location-check records fall within this obligation: if AGLC investigates a cross-provincial leakage allegation, the audit trail of location checks is the primary evidentiary record.

How Does Alberta Compare to Ontario’s Standard 3.02?

Compliance officers operating in both provinces will find the Alberta and Ontario frameworks substantively parallel on location controls, but with meaningful differences in how the obligations are expressed.

Ontario’s AGCO Registrar’s Standards for Internet Gaming, Standard 3.02, states that games on gaming sites shall be provided only within Ontario, unless they are conducted in conjunction with the government of another province. The requirements under Standard 3.02 direct operators to put in place mechanisms to detect and dynamically monitor the location of a player attempting to play a game and to block unverified attempts, and to detect software, programs, virtualisation, and other programs capable of circumventing player location detection.

Alberta’s SRIG Section 4.2 follows the same structural model, with the same inter-provincial carve-out language. The practical differences lie in two areas. Ontario’s Go-Live Compliance Guide explicitly requires operators to document how their controls meet Standard 3.02.1 (dynamic monitoring) and Standard 3.02.2 (circumvention detection) and to validate accuracy across the majority of expected player device and network connection types. Alberta’s Go-Live Compliance Guide, updated January 2026, sets out similar documentation expectations within the Control Activity Matrix (CAM) submission and independent audit requirements. Operators who have been through the Ontario go-live documentation process will recognise the framework, but should not assume the Alberta CAM can be satisfied by re-submitting Ontario validation evidence without Alberta-specific testing against Alberta boundary polygons and Alberta network topography.

Requirement	Alberta SRIG Section 4.2	Ontario AGCO Standard 3.02
Overarching obligation	Games provided only within Alberta	Games provided only within Ontario
Block trigger	Location cannot be verified	Unverified attempt to play
Dynamic monitoring	Required (implicit via “at a minimum”)	Explicit (Standard 3.02.1)
Circumvention detection	Required (via GLI-19 certification)	Explicit (Standard 3.02.2)
Inter-provincial carve-out	Government-to-government arrangements	Government-to-government arrangements
Log retention	1 year online, 7 years archive	Prescribed by AGCO guidance

For a detailed side-by-side analysis of how the two provincial frameworks diverge across registration, commercial structure, responsible gambling, and security requirements, see the AGCO vs AGLC key differences analysis published on this site. The location-control comparison above is one slice of a broader set of operational divergences that multi-province operators must manage as parallel workstreams.

Enforcement Record and Cross-Provincial Leakage Risk

As of the July 13, 2026 market launch, no public enforcement actions had been published by AGLC specifically targeting cross-provincial player access or geolocation failure. Alberta’s iGaming market is newly launched, and AGLC’s enforcement infrastructure, including the iGaming Compliance Branch and the discrepancy-report system, is in its early operational phase. The absence of published enforcement actions should not be read as tolerance of location-control gaps.

The SRIG’s enforcement provisions in Section 2.6 give AGLC broad authority to direct registrants to comply with additional standards as it considers necessary and to impose conditions on registrations. The discrepancy-reporting obligation, which requires operators to submit reports to AGLC within 72 hours on all prohibited persons who attempt to enter or remain on an iGaming site, establishes the expectation of proactive reporting, not reactive remediation. Compliance teams should treat cross-provincial leakage events, where a player successfully completes a gaming session from outside Alberta, as a discrepancy requiring investigation and documentation even before any formal AGLC reporting obligation is triggered.

According to iGamingBusiness reporting in July 2026, Polymarket geo-blocked Alberta following regulatory pressure, illustrating that even operators with no Alberta registration were taking proactive provincial boundary enforcement steps at market launch. For registered operators, the compliance expectation is materially higher: their geolocation architecture must demonstrably enforce the Alberta perimeter, not simply avoid it.

CAM Documentation and ATF Certification Checklist for Location Controls

The Control Activity Matrix submission is the primary vehicle through which operators demonstrate their location-control architecture to AGLC and AiGC. For geolocation specifically, the CAM must summarise the controls in place across account creation, session initiation, dynamic monitoring, and circumvention detection, and must be independently audited before submission.

ATF certification covers the gaming system’s technical implementation of GLI-19 Section 2.7. Operators should ensure their ATF engagement specifically tests the following before go-live: boundary polygon accuracy against the approved Alberta polygon, confidence-radius behaviour at provincial borders, IP-address-only fallback handling when GPS and Wi-Fi signals are unavailable, VPN and proxy detection against an updated Canadian fraud list, mid-session location failure response (block timing, session-end handling, audit log entry); and multi-device account monitoring for geographically inconsistent login patterns.

The Go-Live Compliance Guide requires that all critical gaming systems be ATF-certified before any gaming activity commences, and the SRIG requires operators to maintain all related records and evidence supporting their Technology Compliance Confirmation, made available to AGLC on request. Location-control test results, including ATF certification reports and independent penetration-test findings related to geolocation bypass attempts, must be retained within this compliance record.

Operators who entered the market through Ontario and use existing geolocation vendors certified for Ontario’s Standard 3.02 should confirm with those vendors that their ATF certification scope extends to Alberta, that Alberta boundary polygons have been loaded and verified, and that their fraud lists include Alberta-specific network infrastructure. A vendor certified for Ontario is not automatically certified for Alberta, certification is jurisdiction-specific and boundary-polygon-specific. Compliance officers should consult qualified legal counsel in Alberta to confirm the applicable certification pathway for their specific technology stack before making any go-live representations to AGLC or AiGC.

For a comprehensive overview of what the AGLC framework demands across all compliance workstreams at launch, including CAM structure, AML obligations, and responsible gambling controls, see the Alberta iGaming Market Opening reference guide. For an exploration of the full AGLC standards set across all 335 requirements, the AGLC Standards Explorer provides structured navigation by section and theme.

Key Resources

AGLC Standards and Requirements for Internet Gaming (SRIG), issued January 14, 2026, authority: Board Chair, primary compliance instrument for all registered operators and suppliers. Available at aglc.ca/igaming.

AGLC Internet Gaming Go-Live Compliance Guide, last updated January 2026, documents the specific evidence and CAM submissions required before gaming activities may commence. Available at aglc.ca/igaming.

GLI-19 Standards for Interactive Gaming Systems, Version 3.0, Section 2.7, the technical standard governing geolocation architecture, boundary polygons, signal hierarchy, and circumvention detection. Applicable to all ATF certifications for Alberta-registered gaming systems.

AGCO Registrar’s Standards for Internet Gaming, Standard 3.02, Ontario’s parallel location-control requirement, useful for multi-province operators mapping the relationship between provincial obligations. Available at agco.ca.

For jurisdiction-specific application of any requirement discussed in this article, operators and suppliers should consult qualified legal counsel in Alberta with iGaming expertise. For a structured audit of your location-control architecture against Section 4.2 and GLI-19 requirements, review the Section 4.2 Geolocation Audit Template on this site.