How We Review — the testing protocol, in detail
Documenting a protocol is one thing; following it is another. Every casino in our top 10 has been through this six-step sequence, with timestamps recorded and the analyst's notes archived. The protocol is below, in the order we run it.
Step 1 — Account creation
We sign up from a residential MENA IP where the operator accepts the territory; from a clearly-noted VPN otherwise. We log: time-to-account-active, the data fields demanded at sign-up, whether the operator accepts a date-of-birth that confirms ≥18 (some accept 16 — automatic downgrade), and whether the operator requires consent to a pre-ticked marketing-communications checkbox (automatic downgrade if so).
Step 2 — First deposit
A real deposit, between $20 and $100 depending on the operator's minimum. We rotate the funding rail so we don't always test the easiest one — sometimes Visa, sometimes USDT-TRC20, sometimes an e-wallet, sometimes a regional rail where the operator advertises support. We log: deposit-to-balance timing, any fees charged, any KYC trigger that activates on first deposit (some operators require KYC before any deposit, others before withdrawal).
Step 3 — Gameplay
Minimum 30 minutes split across three product categories:
- Slots — at least 3 titles from at least 2 different providers. We test load time, animation performance, RTP-disclosure presence in the game help-text.
- Table games — at least roulette and blackjack. We test bet-table responsiveness, dealer-game cue handling, and per-hand bet-size limits.
- Live dealer — at least one Evolution or Pragmatic Play Live table. We test stream quality, latency, multilingual dealer rotation if the operator advertises Arabic dealers.
Any provider that fails to load, any session crash, any latency > 250 ms is noted in the review.
Step 4 — KYC
Government ID + proof-of-address uploaded. Both upload-confirmed and approval-confirmed timestamps logged. We additionally test: what happens if a document fails initial review (does the operator escalate clearly or just hang the account?), how the operator handles documents in Arabic script, and whether source-of-funds questions are reasonable or aggressive.
Step 5 — Withdrawal
A full withdrawal at the operator's lowest-fee rail. We log three timestamps: withdrawal-requested, withdrawal-processed (operator marks it sent), money-arrived. Time-to-bank is recorded to the minute. If the operator imposes minimums (e.g. "minimum withdrawal $50") that were not disclosed at deposit, automatic downgrade. If the operator requests additional KYC documents only at withdrawal stage that were not requested at sign-up, automatic downgrade.
Step 6 — Support
A single live-chat ticket with a non-trivial question. We rotate the question across reviews so operators can't pre-script perfect answers to the same query. Recent examples: "If I trigger self-exclusion, do my pending free spins still apply when I return?"; "Your T&Cs mention 'irregular play' — give me one example of behaviour that would void a bonus"; "Can I confirm in writing the licence number under which this site operates and which regulator I would complain to?". We log: response time, agent skill, Arabic-language fluency, and willingness/ability to escalate.
Frequency of re-testing
Every reviewed operator is re-tested at minimum every six months. Re-test triggers also include: change of ownership; change of licensing jurisdiction (e.g. BC.GAME's December 2024 migration from Curaçao to Anjouan); user-reported withdrawal complaints exceeding a threshold; significant T&Cs revision. The reviewer's name and the date of the most recent re-test appear at the top of every review page.
Evidence on file
For every reviewed operator we retain (privately, not on the public site): deposit transaction screenshot, KYC document upload + approval timestamps, withdrawal transaction screenshot with timing log, support-ticket transcript. This is what we mean by "tested with real money" — the evidence exists and can be made available to auditors or regulators on request, with PII redacted.