Online Gaming in India Under PROGA 2025: How the Gaming Rules 2026 Actually Work

The Promotion and Regulation of Online Gaming Act, 2025, and the Promotion and Regulation of Online Gaming Rules, 2026, both came into force on 1 May 2026. The Act received Presidential assent on 22 August 2025, but its provisions were brought into operation only by a separate Central Government notification dated 22 April 2026 (S.O. 1994(E)), on the same day the Rules were notified. From 1 May 2026, the Act and the Rules operate together.

The Indian gaming market did not, however, wait for the commencement notification. The substantive wind-down happened in the immediate aftermath of Presidential assent on 22 August 2025, almost eight months before the Act's provisions came into force. India's largest fantasy sports, real-money rummy and real-money poker operators suspended their cash formats from late August 2025. Banks and payment intermediaries similarly stopped permitting new deposits to real-money gaming platforms from the same period, while continuing to process withdrawals so that users could recover their existing balances. The market read the enacted-but-not-yet-in-force Act as a binding signal: the criminal prohibition under Section 5 and the financial-transaction prohibition under Section 7 were on the statute book, and waiting on the Centre's commencement notification was not a tenable risk position for either operators or their bankers. The Rules of May 2026 do not redraw that commercial map; they put a digitally administered architecture around a prohibition the market had already absorbed. For legitimate operators and the service providers around them, the period of state-by-state ambiguity has substantially narrowed (subject to a pending constitutional challenge addressed below) and the path to operating lawfully is now mapped.

This article walks through the framework as it stands. The questions practitioners and product teams ask most often are these: what exactly counts as an "online money game", what does the new regulator do, who has to register, and what changes for the banks, payment processors, advertisers, app stores and hosting providers that sit around an online gaming product. The answers are now in the gazette, and they are workable.

How PROGA Sorts Online Games Into Three Buckets

The Act recognises three categories of online games, and almost everything that follows depends on getting the boundary right.

Online money games (Section 2(1)(g)) are the prohibited category. The definition is the operative engine of the entire framework: an online money game means an online game, irrespective of whether such game is based on skill, chance, or both, played by a user by paying fees, depositing money or other stakes in expectation of winning which entails monetary and other enrichment in return of money or other stakes. The exclusion of e-sports is built into the definition.

The "irrespective of skill or chance" clause is the drafting move that substantially narrowed the long-running State-versus-Centre debate over the legal status of fantasy sports, online rummy and online poker. Under the pre-PROGA regime, the question of whether a real-money game was a "game of skill" (constitutionally protected by a line of authority that began with State of Bombay v RMD Chamarbaugwalla (AIR 1957 SC 699), continued through KR Lakshmanan v State of Tamil Nadu (1996) 2 SCC 226, and was applied to online rummy and fantasy sports in cases such as Junglee Games India v State of Tamil Nadu (2021)) or a "game of chance" (regulable as gambling under State legislation) was litigated repeatedly, with different answers in different States. By collapsing that distinction inside the Central definition, PROGA brings both within the same category for online formats. A skill-based money game played online is now an online money game; so is a chance-based one. The classification turns on the structure of the user's economic experience, not the cognitive content of the gameplay.

Online social games (Section 2(1)(i)) are the permitted general category. The Act defines them as online games which (i) do not involve staking of money or other stakes or participation with the expectation of winning by way of monetary gain, (ii) may allow access through payment of a subscription fee or one-time access fee provided that such payment is not in the nature of a stake or wager, (iii) are offered solely for entertainment, recreation or skill-development purposes, and (iv) are not online money games or e-sports. This is the bucket that subscription games, in-app-purchase mobile games, free-to-play casual titles and educational and skill-development apps fall into.

E-sports (Section 2(1)(c)) are a narrower carve-out for organised competitive events. To qualify, a game must (a) be played as part of multi-sports events, (b) involve organised competitive events between individuals or teams in multiplayer formats governed by predefined rules, (c) be duly recognised under the National Sports Governance Act, 2025 and registered with the Authority under the PROGA framework, and (d) have outcomes determined solely by physical dexterity, mental agility, strategic thinking or other similar skills. E-sports may include payment of registration or participation fees solely to enter the competition or cover administrative costs, and performance-based prize money for the player. They must not involve the placing of bets, wagers or any other stakes by any person, including any winning out of those stakes.

The prohibition architecture follows from the categorisation. Section 5 prohibits any person from offering, aiding, abetting, inducing or otherwise indulging or engaging in the offering of an online money game or online money gaming service. Section 6 prohibits making, causing to be made, aiding, abetting, inducing or otherwise being involved in any advertisement that directly or indirectly promotes or induces playing an online money game. Section 7 prohibits any bank, financial institution or any other person facilitating financial transactions or authorisation of funds from facilitating any transaction towards payment for an online money gaming service. The Act expressly extends to services offered within India and to services operated from outside India (Section 1(2)).

Section 18 gives the Act overriding effect over inconsistent State laws, to the extent of inconsistency. There is no express repeal of State legislation, but the practical consequence for compliance teams is that the Centre's framework now sits on top of the patchwork of State gambling and online gaming statutes that previously made cross-border operation an exercise in jurisdictional cartography.

The Money-In × Money-Out Test

Section 2(1)(g) is, on its proper reading, a single integrated wager-test. The user must have paid fees, deposited money or staked something, and the user must have an expectation of winning monetary or other enrichment in return for that very consideration. The "in return of money or other stakes" phrase ties the two elements together; they are interlocked, not independent. The shorthand below decomposes the test into a "money in" leg and a "money out" leg as a heuristic for product teams; the matrix is a teaching aid, not a substitute for the section.

The first element, money in, is engaged where the user pays fees, deposits money or other stakes at any stage of participation in the game. The reach of this element depends on how widely "other stakes" is read. Section 2(1)(j) defines the term to include credits, coins, tokens or objects, real or virtual, purchased by paying money directly or indirectly or as part of an online game. This makes the money-in question a gradient rather than a binary. A user who buys generic in-game currency in a parent app and uses that currency to enter a sub-game offering enrichment has put money in for the purposes of Section 2(1)(g). Operators that route user spend through indirect channels should not assume the section is unhooked.

The second element, money out, is engaged where users have an expectation of winning monetary or other enrichment in return for the money or stakes they deposited. This is what distinguishes a wagering structure from a pure access structure.

Both elements are necessary. The matrix below sets out the four combinations of money in and money out, and the kind of products that sit in each cell. The legal rationale for each cell is grounded in the Act's text and the Rules' factor list at Rule 9.

Two points are worth drawing out from the matrix. The first is on the off-diagonal cells. The second is on what really determines whether a product is in Cell 4.

The free-entry cell (Cell 3, money out without money in) is clean. Section 2(1)(g) requires user-side payment as the gating element. Where the user pays nothing in any form, the section does not engage. Money flowing out to users from advertisers, sponsors or the operator is not, by itself, the trigger for the prohibition. Free-entry promotional draws, advertiser-funded reward contests, sponsor-supported free-prize models, and promotional contests remain permissible. The Act was not drafted to catch promotional draws; it was drafted to suppress real-money contest formats where users themselves stake something with the expectation of winning. A genuinely free-entry contest has no user-side stake to suppress.

The risk question on the off-diagonal therefore lives entirely on the money-in side. The hinge is the breadth of "money in", which Section 2(1)(j) defines wide enough to capture both direct and indirect routes. Direct routes are obvious: an entry fee, a deposit, a buy-in. The indirect routes are where most edge cases live. A user who buys virtual currency in a parent app and uses that currency to enter a prize-bearing sub-game has put money in. A subscription that is in substance the price of admission to a prize-bearing event is money in, even if the operator labels it access. A monthly battle-pass purchase that is a precondition to participating in cash-prize events is money in. The Authority can use Rule 9(d) (the structure and operation of the revenue model) and Rule 9(e) (how rewards are transferred, redeemed or monetised outside the game environment) to look past form. The classification work in those edge cases happens inside Cell 4, not on the money-out side. The practical implication is that a free-entry advertiser-funded contest is not tainted merely because money flows out: it is tainted only if the structure is in fact one in which users are paying something, somewhere, to participate.

The Cell 2 question (money in, no money out) is its own analytical sub-track. A subscription model with no cash payouts is comfortably within the online social game cell. Section 2(1)(i)(ii) expressly preserves access via subscription or one-time access fees provided the payment is not in the nature of a stake or wager. The position within that cell turns on the monetisation design. Deterministic in-app purchases (a fixed price for a known product) sit squarely inside Cell 2. Probabilistic monetisation, such as loot boxes, gacha pulls and randomised reward chests, divides on an external-monetisation axis. Where the items dropped are cosmetic, account-bound, and have no external monetisation route, the mechanic remains within Cell 2: nothing the user obtains is enrichment "in return of money" in any recognisable sense. Where the items dropped are tradeable on operator-supported or third-party marketplaces, or have meaningful secondary-market value, the mechanic sits inside Cell 4 in substance, regardless of how the in-app purchase is labelled: Section 2(1)(j)'s wide "other stakes" definition closes the consideration side, and the rare drop is enrichment for purposes of the section. The genuinely contested middle band consists of probabilistic drops with informal grey-market trading the operator does not officially support, and battle-pass mechanics with rare unlocks of variable value. The safest position for product teams running probabilistic monetisation is full strip-out of external monetisation.

How the Rules Actually Work: The Online Gaming Authority of India

The Rules establish the Online Gaming Authority of India and assign it three principal functions: classification of online games, registration of e-sports and any notified categories of online social games, and complaint and grievance handling. Understanding how the Authority is structured and how it works is the difference between treating PROGA compliance as a permanent regulatory project and treating it as a defined hygiene workstream.

The Authority is constituted as an attached office of the Ministry of Electronics and Information Technology with its head office at the National Capital Territory of Delhi (Rule 3(5) and 3(6)). It is a six-member ex officio body: the Chairperson is the Additional Secretary, MeitY, with five Members drawn at Joint Secretary rank from the Ministry of Home Affairs, the Department of Financial Services in the Ministry of Finance, the Ministry of Information and Broadcasting, the Ministry of Youth Affairs and Sports, and the Department of Legal Affairs in the Ministry of Law and Justice (Rule 3(1)). The Authority is designed to function, as far as practicable, as a digital office and may adopt techno-legal measures to conduct proceedings without requiring the physical presence of any individual (Rule 3(6)).

The design is best read as a coordination model rather than a sectoral-regulator model. Every Member is an existing officer drawn from a domain ministry, and the breadth of the composition (home affairs, finance, broadcasting, sports, law) signals that classification of an online game can engage the perspectives of any of those ministries, and that coordinated enforcement with financial regulators and law-enforcement agencies is built in. Whether this design will evolve, as TRAI and other Indian regulators have, into a body with industry or expert appointments is a question for the framework's second-generation rules.

The most consequential structural choice in the Rules is Rule 8. There is no general filing or registration requirement for online games. Rule 8(1) opens with a clear non-obstante: no online game of an online game service provider shall be required to be determined for the purpose of clause (a) of sub-section (2) of section 8 of the Act, except where the Authority on its own motion directs the operator to have one or more of its games determined, where the operator intends to offer the game as an e-sport, or where the Central Government, by notification, requires a category of online social games to be determined.

Two of those triggers are operator-initiated and the third is regulator-initiated. For an ordinary online social game operator, Rule 8 is permissive by default. There is no proactive filing, no certificate to keep current, no annual return, no licence at risk. The product can be launched, run and updated without going near the Authority. The flip side has two parts. First, the Authority retains a suo motu power to call any game in for assessment, on a written notice specifying the grounds of the proposed determination, followed by an information-seeking step and a reasonable opportunity to make representations (Rule 10(1)(a)). Second, Rule 12(1)(a) reserves to the Central Government the power to notify categories of online social games into the registration regime on factors including risk to children, scale of participation, financial-transaction volume, country of origin, and an open-ended public-interest residue. The architecture is therefore better characterised as "no registration unless notified", not "no registration ever". Operators in foreign-origin, child-facing or high-volume product categories should plan for the possibility of a notification in the next 12 to 24 months.

The substantive test the Authority applies is set out at Rule 9. The Authority shall have due regard to all or any of the following factors: (a) whether the online game involves payment of fees, deposit of money or other stakes, by whatever name called, at any stage of participation; (b) whether users have an expectation of winning monetary or other enrichment in return for such money or other stakes; (c) whether the payment of fees or deposits is used as part of a competitive event with predefined rules and registration or participation or administrative-cost fees, or as a subscription or one-time access fee, or as a bet, wager or other stake in expectation of winning; (d) the structure and operation of the revenue model of the online game; and (e) the manner in which rewards, benefits or in-game assets may be transferred, redeemed, monetised or used outside the game environment. The five factors are the analytical framework the Authority will run any product through.

Rule 10 sets a 90-day timeline on determination, "as far as practicable", measured from receipt of a complete application or from issuance of the suo motu notice. The Rules provide for time-stoppages in two situations: time taken by the applicant to remedy form defects in an application, and (in suo motu proceedings) time taken to obtain any information from the operator after issuance of the notice. The Authority is required to examine the technical architecture, gameplay mechanics, revenue model and user interface of the game, and may seek expert or technical evaluation where appropriate (Rule 10(1)(c) and (d)).

A determination has two possible outcomes. If the Authority concludes that the game is an online money game, it issues a determination order and may initiate any action available under the Act (Rule 10(2)(a)) including penalty proceedings, blocking under Section 14, and directions to financial intermediaries. If the Authority concludes that the game is not an online money game, it issues a determination order to that effect (in the case of an online social game) or, in the case of an e-sport application, processes the application for recognition and registration as an e-sport under Rule 13 (Rule 10(2)(b)).

The reach of a determination order is narrow. The Explanation to Rule 10(2) clarifies that a determination is specific to the particular online game and the particular online game service provider offering it. It does not bind the Authority's view of the same or similar online games offered by other providers. This is a practitioner-friendly drafting choice: an adverse determination against one operator is not automatically a precedent against another, and a favourable determination is not transferable.

Rule 11 governs the longevity of a favourable determination. A determination order is valid and subsisting until there is a change to the game that affects the facilitation of payments or authorisation of funds for participation or access. The Authority may also conduct periodic reviews and, where it has reason to believe a game has been modified in a way that may require fresh determination, can suspend the determination order, hold an inquiry, and either order a fresh determination or proceed under the online money game limb if the modification has converted the product. The operational implication is straightforward: changes to a game's monetisation flow are a notification trigger.

Registration: A Narrow Regime, Not a Gate

The Rules deliberately reject a general licensing model for online gaming. Rule 12(1) opens with the same non-obstante structure as Rule 8: no online game shall be registered with the Authority except where the Central Government, by notification, requires it, or where the game is intended to be offered as an e-sport.

The Central Government's power to notify a class of games into the registration regime is structured around six factors enumerated in Rule 12(1)(a): (i) risk of harm to users, including children; (ii) the nature of the outcome or potential risks of injury or detrimental impact on the public due to such online game; (iii) scale of user participation; (iv) nature, volume or value of financial transactions or authorisation of funds permitted in the game; (v) the country of origin or the head office of the online game service provider; and (vi) such other factors as the Authority deems necessary in public interest or to protect the interests of users. As of the date of writing, no category of online social games has been notified into the registration regime, but the architecture is in place.

For e-sports, registration is mandatory. The path is sequenced. The operator applies under Rule 8(2). The Authority processes the application as a determination under Rule 10. If the game is determined not to be an online money game and the operator has obtained recognition under the National Sports Governance Act, 2025, the Authority issues a Certificate of Registration within 90 days of a complete application (Rule 13(3)). The Certificate is digital, carries a unique registration number, and is valid for the period (up to 10 years) chosen by the operator at the application stage, unless surrendered, suspended or cancelled earlier (Rule 14(2)).

Rule 12(3) bars any online game determined to be an online money game from being recognised or registered as an e-sport under the National Sports Governance Act, 2025. The two routes are mutually exclusive; an operator cannot relabel a real-money tournament as an e-sport.

Rule 14(3) sets out the grounds for suspension or cancellation of a Certificate of Registration: the game changes in a manner likely to be determined as an online money game; the operator has, on more than one instance, failed to comply with a direction, order, code of practice or guideline; in the case of an e-sport, recognition under the National Sports Governance Act has expired or been withdrawn; the operator made a false or incorrect statement in the application; the operator has failed to pay a penalty; or there has been a violation of the Act, rules or any other applicable law. Suspension or cancellation requires an opportunity of being heard.

Rule 15 imposes display and representation obligations. A registered operator must prominently display the determination or registration details on the computer resource through which the game is offered. It must not represent or advertise a game as a determined online social game unless it has actually been determined not to be an online money game, and must not represent a game as a registered online game unless it is in fact registered.

What Changes for Online Game Service Providers

The defined term in Rule 2(1)(h) is "online game service provider": any person who alone or jointly offers, operates, organises, manages or makes available one or more online games. The breadth of the definition matters because the Rules' steady-state obligations apply to every online game service provider offering an online social game or an e-sport, not only to those that have been through the determination or registration process. The "alone or jointly" formulation is significant: it brings white-label operators, consortium structures, platform-as-a-service arrangements and any joint-offer relationship within the obligations, even where each individual party is providing only a slice of the total product.

Designate a point of contact (Rule 16). Every operator offering an online social game or e-sport must comply with directions, orders, guidelines or codes of practice issued under Section 8(3) of the Act on the designation of personnel as a point of contact and the publication of their contact details. The standard architecture in similar Indian regulatory regimes points to a named officer with operational authority and India-resident presence; final modalities will be in the codes of practice the Authority issues under Rule 6.

Maintain a functional grievance redressal mechanism (Rule 20(1)). Every operator offering an online social game or e-sport must establish and maintain a functional grievance redressal mechanism for complaints from users about its game. A user dissatisfied with the operator's resolution (or who has not received resolution within the operator's published timeline) can approach the Authority within 30 days through the digital form on the Authority's website or app (Rule 20(2)). The Authority endeavours to dispose of the appeal within 30 days (Rule 20(3)). A user dissatisfied with the Authority's resolution can file a second appeal before the Appellate Authority, the Secretary, MeitY, under Rule 7 (Rule 20(5)). The two-tier model is clean, time-bound and entirely digital.

Build and disclose user safety features (Rules 2(1)(i) and 23). The Rules introduce a defined term, "user safety features", at Rule 2(1)(i): technical, procedural, operational, behavioural or system-related safeguards appropriate to the nature and risks of the game, for protecting users from financial, psychological, social, security-related or content-related risks, and for promoting responsible gaming, preventing injury, enhancing transparency, enabling informed user choice and ensuring integrity. The Explanation specifies that the safeguards include age verification or age-gating mechanisms, time restrictions, parental controls, user reporting and grievance redressal mechanisms, counselling support, and fair-play and integrity monitoring tools. Rule 23 requires user safety features and the internal grievance mechanism to be disclosed at the time of any application for determination or registration. Operators that never apply will not file the disclosure, but the substantive obligation to provide appropriate safeguards remains a live compliance expectation that the Authority can probe in any suo motu inquiry.

Notify changes in payment facilitation (Rule 10(2)(b)(iii)). Where the Authority has determined that a game is not an online money game, it directs the operator to inform the Authority of any changes in the facilitation of payments in the game before offering or making such changes available, in the manner published on the Authority's website or app. This is a forward-looking notification obligation: it sits alongside the principle in Rule 11 that a favourable determination ceases to subsist when payment-flow changes happen without notification.

Comply with payment facilitation directions (Rule 18) and data retention directions (Rule 17). Operators offering an online social game or e-sport must comply with directions, orders, guidelines or codes of practice issued under Section 8(3) on the facilitation, routing and settlement of user payments and revenues, and on retention and storage of traffic data, metadata and other related information on computer resources located in India. The drafting points squarely at building Indian-resident logging infrastructure as a baseline expectation.

What Changes for Service Providers Around the Operator

The Act and Rules pull in a wider set of businesses than just operators. A bank that processes deposits, a payment aggregator that routes a transaction, an advertising platform that runs a banner, an app store that hosts a download, and a hosting provider that serves content are each addressed by different operative levers. The picture below is the consolidated view.

Banks, payment aggregators, and any person facilitating financial transactions. Section 7 of the Act prohibits any bank, financial institution, or any other person facilitating financial transactions or authorisation of funds from facilitating any transaction towards payment for an online money gaming service. Penalty under Section 9(3) is up to three years' imprisonment, or up to one crore rupees, or both. The offence under Section 7 is cognizable and non-bailable under Section 10. On a repeat conviction, Section 9(4) provides a mandatory minimum of three years' imprisonment (extendable to five) and a fine of not less than one crore rupees (extendable to two crore). The Act's Section 1(2) extraterritorial reach is operationally significant here: it extends to services operated from outside India, which means an Indian payment processor cannot offshore the legal exposure by routing the transaction through a non-resident gateway when the underlying service is an online money game offered to Indian users.

The Rules build a forward-looking compliance architecture on top of the prohibition. Rule 19(1) requires any bank, financial institution or any other person facilitating financial transactions to comply with directions issued under Section 8(3) on verification of the Certificate of Registration prior to facilitating funds for an e-sport or online social game, "in such manner as may be specified" in the Authority's directions. As of the date of writing the Authority has not published the specific verification-modality directions; the substantive compliance burden will crystallise when those directions issue. Rule 19(2) is more immediately operational: on receipt of an Authority direction in respect of a determined online money game, every bank, financial institution or other person facilitating financial transactions must, without delay, suspend, restrict or discontinue facilitation and furnish such information or assistance as the Authority may require. The list of online money games maintained and published by the Authority under Rule 6(1)(a) and Rule 26 is the operative reference data set for payment-rail screening. A fintech compliance team should be integrating that list into its sanctions and prohibitions screening pipeline alongside the lists it already runs against, and should plan an integration roadmap for the Rule 19(1) verification process once directions are issued.

Advertisers, ad agencies, ad-tech intermediaries, influencers and celebrities. Section 6 is drafted broadly. It catches any person who makes, causes to be made, aids, abets, induces, or otherwise is involved in the making or causing to be made of any advertisement, in any media including electronic, that directly or indirectly promotes or induces playing an online money game. The reach extends to publishers, platforms running ad inventories, agencies producing creatives, talent agencies booking endorsements, influencers and brand ambassadors. Penalty under Section 9(2) is up to two years' imprisonment, or up to fifty lakh rupees fine, or both. Repeat offences under Section 9(5) carry a mandatory minimum of two years and fifty lakh rupees. Unlike Sections 5 and 7, advertising offences under Section 6 are not made cognizable and non-bailable; that means a police officer cannot arrest without a warrant and bail is available in the ordinary course. The substantive exposure, however, remains real: two years' imprisonment is not a soft outcome, and a magistrate can order investigation on a private complaint.

The "indirectly promotes or induces" phrasing is broad on its face but it does not collapse all parent-subsidiary or brand-association links. Section 6 requires a causal connection between the advertisement and the inducement to play. The genuine risk areas for advertisers and talent agencies are direct endorsements of gaming products, surrogate advertisements where the product advertised is a thinly-veiled proxy for the gaming service, cross-promotional placements within the gaming operator's ecosystem, and sustained brand-ambassador relationships with operators whose products are or have been classified as online money games. For an in-house team running ad approvals, the practical workflow is: maintain a screen against the Authority's published list of online money games (Rule 6(1)(a) and Rule 26), update it on a regular cadence, apply standard advertising-law indirect-promotion analysis to identify causal links, and document the approval trail, especially for celebrity endorsements and influencer campaigns.

App stores, hosting providers, content delivery networks, marketing intermediaries. The Act does not specifically enumerate these classes of intermediaries. Section 5's catch-all formulation ("aid, abet, induce or otherwise indulge or engage in the offering") is broad on its face, but criminal exposure under Section 5 turns, on first principles of Indian criminal law, on the standard mens rea for abetment under the Bharatiya Nyaya Sanhita, 2023: knowledge, intentional aid, or wilful blindness. An app store that distributes an operator's app under a standard developer agreement, with no specific knowledge that the app is an online money gaming service, has a genuine mens rea defence to Section 5 prosecution.

That defence is, however, time-limited. Once the Authority publishes a list of online money games under Rule 6(1)(a) and Rule 26, knowledge will likely be inferred by a trial court for every infrastructure provider with reasonable access to that list. Once a determination order issues against a specific app, every infrastructure provider hosting or distributing that app has actual knowledge. The mens rea defence operates only in the narrow window before the published list reasonably catches the app or before any specific complaint is escalated; after that window, an infrastructure provider that continues to facilitate is in the same position as any actor with knowledge of the principal offence. The constructive-knowledge effect of the Rule 26 list is, in operational terms, the most important consequence for app store and hosting compliance teams.

The compliance design of the framework reinforces this reading. Section 14 enables blocking of any information generated, transmitted, received or hosted in any computer resource in relation to an online money gaming service. Section 14 is drafted to operate notwithstanding Section 69A of the Information Technology Act, 2000. On the natural reading, that displaces the procedural framework of Section 69A (and, by extension, the Information Technology (Procedure and Safeguards for Blocking) Rules, 2009 made under it) for PROGA blocking; the procedural safeguards for PROGA blocking will turn on the Authority's directions and any further rules issued under the Act. Section 8(3) of the Act and Rule 6(1)(d) empower the Authority to issue directions to persons offering, organising or facilitating any online game. Non-compliance with those directions attracts the Section 12 civil-penalty regime: up to Rs 10 lakh, plus suspension or cancellation of any registration, plus prohibition from offering, facilitating or promoting such games for a period determined by the Authority. Part V (Rules 21 and 22) lays down the procedural architecture: notice with particulars of alleged non-compliance (Rule 21(1)), digital-mode hearing unless physical presence is necessary, 90-day disposal (Rule 21(6)), and a structured set of factors for proportionality (Rule 21(8)) including gain from non-compliance, loss to users, recurrence, gravity, duration, number of users affected, mitigation steps and overall proportionality. Criminal exposure under Section 5 is the residual risk for actors who continue to facilitate after notice or after publication of the Rule 26 list.

Where the Law on Gaming Stands Today

The picture that emerges is not the picture much of the early commentary anticipated. PROGA, read with the May 2026 Rules, is not a sprawling licensing regime. It is a tightly drafted prohibition of a specific category, online money games, defined to capture both skill-based and chance-based variants, combined with a determination-and-classification regime for everything else and a registration regime that is mandatory only for e-sports and any future-notified categories.

For the wider digital economy, three consequences are visible.

First, the State-versus-Centre debate over real-money online skill games is substantially narrowed, though not closed. The "irrespective of skill, chance, or both" formulation in Section 2(1)(g) is a Central classification choice, and Section 18 gives the Act overriding effect over inconsistent State laws to the extent of inconsistency. The narrowing has two contingencies that compliance teams should hold in view. The narrowing is, first, operational rather than doctrinal: pending Supreme Court constitutional challenges (see below) raise legislative-competence questions, and a holding that online money gaming falls primarily within the States' legislative field would materially disturb the present balance. The State-law fields that survive under Section 18 are, second, reasonably specific. State advertising restrictions on offline gambling, age-gating and licensing of physical gaming premises, State-level responsible-gaming codes, and State enactments on consumer-protection grounds not directly inconsistent with PROGA continue to operate. The pre-PROGA online-gaming statutes in Tamil Nadu and Karnataka, to the extent they prohibited online formats now governed by PROGA, are largely displaced; their offline and hybrid provisions survive. Operators planning products that touch any of those edges should map their product not only against Section 2(1)(g) but also against the State law they are proposing to engage. The 28-State patchwork has narrowed; it has not vanished.

Second, legitimate online social game operators are free of the registration burden that some regulatory regimes impose. There is no licence, no proactive filing, no annual return, and no certificate to keep current, unless the Central Government notifies a category into the registration regime under Rule 12(1)(a). The Authority's principal tool is suo motu inquiry under a structured 90-day procedure with factors that are public, narrow and grounded in the economic structure of the product. For business teams planning new launches in casual, educational, skill-development, subscription, and free-to-play formats, the path is open.

Third, the risk allocation across the value chain is now mapped. Operators of online money games carry the heaviest exposure under Sections 5 and 9, with director-level vicarious liability under Section 11. Banks and payment intermediaries carry parallel exposure under Sections 7 and 9(3), with verification duties to crystallise once the Authority's Rule 19 directions issue. Advertisers, ad agencies and influencers face Section 6 exposure of up to two years' imprisonment and fifty lakh rupees. App stores, hosting providers and marketing intermediaries face primarily the Section 12 civil-penalty regime for non-compliance with Authority directions, with Section 5 criminal exposure as the residual risk for actors who continue to facilitate after notice or after publication of the Authority's list. Section 11 is worth a closer note for boards: it imposes the standard "in charge / responsible" director-vicarious-liability template, with an express carve-out at the proviso to Section 11(3) for independent and non-executive directors not involved in the actual decision-making. The Authority's published list of online money games under Rule 6(1)(a) and Rule 26 is the single canonical reference for operational screening across all of these tracks.

One important uncertainty remains. Constitutional challenges to PROGA, raising legislative-competence and Article 19(1)(g) trade-and-profession grounds, have been transferred from the Karnataka, Delhi and Madhya Pradesh High Courts to the Supreme Court. Until those proceedings are decided, the framework's constitutional foundation is sub judice. Compliance teams should plan for the framework as it stands, while watching the transferred matter as the principal source of structural risk.

The market has already absorbed the most disruptive layer of this framework. The major real-money operators that had built their business on the skill/chance distinction wound down those formats from late August 2025, immediately on Presidential assent, without waiting for the Act's commencement notification. The financial system mirrored that response on the deposit side: banks and payment intermediaries stopped accepting new deposits to real-money gaming platforms from August 2025 onwards, while continuing to allow withdrawals so that users could exit their balances. By the time the Act and the Rules came into force on 1 May 2026, the commercial restructuring was already complete. The Rules of May 2026 do not undo that adjustment; they make the post-adjustment world workable.

Practical Takeaways

For operators of online social games and e-sports

• Run every product through the integrated test in Section 2(1)(g). Where the user pays consideration and has an expectation of winning monetary or other enrichment in return, the product is an online money game and cannot be offered in India irrespective of how the gameplay is structured.
• "Money in" is the gating element. Read it broadly: direct fees, subscriptions in substance functioning as entry, virtual currency or in-game items purchased in a parent app and routed into a prize-bearing event, and any other indirect consideration are all money in. Section 2(1)(j)'s "other stakes" definition is the operative anti-avoidance lever. Where there is genuinely no user-side payment in any form, money flowing out from advertisers or sponsors does not, by itself, trigger Section 2(1)(g); free-entry sponsor-funded contests remain permissible.
• Probabilistic monetisation (loot boxes, gacha, randomised reward drops) is a separate analytical sub-track inside Cell 2. The cleanliness depends on whether dropped items have external monetisation. The safest design strips out secondary-market and tradeable routes.
• For ordinary online social games, no proactive filing is required. Be ready, however, for a suo motu inquiry. Maintain documented technical architecture, gameplay mechanics, revenue model and user interface notes that map cleanly onto Rule 9 factors.
• For e-sports, sequence the registrations: National Sports Governance Act recognition first, then the Authority's Certificate of Registration. Plan for 90 days of regulatory time after the application is complete.
• Build user safety features into the product, not bolted on. Age verification, age-gating, time restrictions, parental controls, user reporting, counselling links and fair-play monitoring are the explicit Rule 2(1)(i) examples.
• Set up a grievance redressal mechanism that meets Rule 20: a working channel, defined timelines, and a reasoned response so that the 30-day clock for the user's appeal to the Authority does not run while the operator is silent.
• Treat any change in payment facilitation as a notification trigger if the product has been determined or registered.

For service providers around the operator

• Banks, payment aggregators and any other person facilitating financial transactions: integrate the Authority's published list of online money games (Rule 6(1)(a) and Rule 26) into transaction screening. Build a process for compliance with Rule 19(2) Authority directions on suspension, restriction or discontinuation of facilitation.
• Advertisers, ad agencies, and ad-tech platforms: build a creative-review checklist tied to the published list. Train reviewers to spot indirect promotion. Document approval trails, especially for celebrity endorsements and influencer campaigns.
• App stores, hosting providers, CDNs, and marketing intermediaries: establish a takedown and de-listing workflow that maps to Section 14 blocking directions and Authority directions under Rule 6(1)(d). Build a Section 12 escalation path for civil-penalty proceedings.
• Counsel for any of the above: the Authority's directions, codes of practice and advisories under Rule 6 will be the next layer of operational detail. A standing watchlist process for these is the right baseline.

What was previously a question of legal exposure has, for the most part, become a question of compliance hygiene. The framework remains young: the Authority's first determination orders, codes of practice and direction-issuance under Rule 19 will define the operational texture of the next two years, and a constitutional challenge is pending before the Supreme Court. For legitimate operators and the service providers around them, the architecture is now visible and the categories are defined.