iGaming Operator Licence
For online casino operators who manage player accounts and funds flow. This page covers scope boundaries, key control domains, and the evidence artefacts expected for a clean review.
Designed for ops clarity
Map each control to an artefact. Submit an Evidence Index (domain → artefact → owner → version).
Fastest approvals
Strong RG thresholds + monitoring rules + complaints workflow + logging discipline.
Common rejection risk
Weak funds-flow explanation, unclear PSP dependencies, or missing customer communications controls.
Scope (what this licence covers)
If you run player accounts and take bets/wagers, you are typically in Operator scope.
Player lifecycle
Onboarding, KYC, funding, gameplay, withdrawals, closure.
Funds flow
Deposits, balances, payouts, chargebacks, reconciliations.
Player protection
Limits, interventions, exclusions, safer gambling comms.
Boundary rule
If a third-party platform or game supplier performs technical functions, you still remain responsible for governance, player protection, AML/CFT and communications controls.
Operational workflow (diagram)
How controls connect across the player lifecycle.
Key control domains (Operator)
These domains dominate review time. Strong evidence here reduces clarification cycles.
AML/CFT
Risk assessment, KYC, screening, monitoring rules, reporting triggers.
Responsible Gaming
Limits, interventions, exclusion tools, measurable thresholds and outcomes.
Funds flow controls
PSP dependencies, payout controls, reconciliation, fraud and dispute handling.
Complaints handling
Workflow, SLAs, escalation, records, signposting and resolution reporting.
Client communications
Disclosures, fair marketing controls, approvals, retention and audit trail.
Outsourcing & vendors
Vendor due diligence, SLAs, monitoring, audit access and exit plans.
Evidence pack (starter list)
A practical baseline. Expand depending on your business model and dependencies.
| Area | Artefacts | Owner |
|---|---|---|
| Corporate & governance | Org chart, roles, oversight cadence, reporting pack, policies register, audit plan. | Management |
| AML/CFT | Risk assessment, KYC workflow, sanctions screening evidence, monitoring rules, reporting triggers. | Compliance |
| Responsible Gaming | Limits policy, threshold definitions, interventions workflow, self-exclusion tooling, outcomes reporting. | Product |
| Funds flow | PSP map, payout controls, reconciliation method, fraud/dispute handling, wallet architecture (if any). | Operations |
| Complaints & disclosures | Disclosure templates, marketing approvals, complaints policy + log structure, records retention policy. | Operations |
| Outsourcing | Vendor register, due diligence checklist, SLAs, monitoring plan, exit plan and audit rights clauses. | Operations + Legal |
Packaging standard
Use an Evidence Index spreadsheet with links to artefacts, versions, and a change log for every clarification round.
Clarification triggers (avoid these)
The most common causes of delay in Operator files.
Unclear PSP dependency
No mapping of who processes what, and where records live.
RG not measurable
No thresholds, triggers, or intervention audit trail.
Monitoring too vague
No rule examples, escalation steps, or reporting cadence.
Weak complaints workflow
No SLAs, escalation, or evidence of record retention.
Outsourcing gaps
Missing SLAs, audit rights, monitoring or exit plan.
No change discipline
Updates sent without a version table and change log.
For timeline bands, use Processing Timelines.