iGaming outsourcing: retain control of critical suppliers

Which suppliers need the closest attention?

Prioritise services that affect player balances, game outcomes, verification, restrictions, regulatory records or business continuity. The MGA’s authorisations directive addresses responsibility for outsourced licensed activities and requirements concerning critical supplies.

Assess the actual dependency, not just the invoice value. A low-cost component can be operationally critical if the business cannot verify customers or retrieve records without it.

What should due diligence establish?

Verify the entity, relevant licence or permission, service scope and evidence supporting the provider’s claims. A group company’s licence may not cover the contracting supplier or proposed activity.

• What function is being supplied and where is it performed?
• Which regulatory permission is relevant?
• What records and assurance evidence can the operator obtain?
• Which sub-suppliers create additional dependencies?
• How are incidents, defects and material changes reported?
• What happens if the relationship ends?

How should responsibilities be documented?

Use a responsibility matrix linked to the contract. Identify who performs the task, who approves decisions and who remains accountable under the applicable framework.

For example, a verification vendor may return a result while the operator decides whether the customer can proceed. If the agreement and system design leave that decision unclear, each party may assume the other is handling exceptions. Resolve those gaps before integration.

What makes audit and access rights practical?

Specify the information format, response process and relevant limitations. A broad right to request records is less useful if the supplier cannot export them or takes longer than the operator’s reporting deadline.

Test a sample evidence request during onboarding. Ask for the records needed to investigate a disputed transaction or control failure. Confirm that the operator can interpret the response and link it to its own account records.

How should exit be planned?

Identify the data, configuration, licences and staff knowledge needed to replace the supplier. Agree migration support and treatment of outstanding customer matters.

Run a dependency review before renewal. If the provider is the only party able to reconstruct balances or operate a control, record the concentration risk and mitigation. Outsourcing should provide a manageable service relationship, not leave the operator unable to explain or supervise its own business.