Malta B2B gaming licence: critical supply explained

What makes a supply critical?

The MGA identifies software processing essential regulatory records, its control systems and material elements of a game within its critical-supply framework. The analysis therefore starts with functionality and control, not merely the contract’s commercial title.

Inventory the components delivered to the operator. For each one, explain what data it creates or changes, whether it affects game outcomes and who can configure it. A platform containing a player ledger raises different questions from a generic office application used by the same business.

How is B2B different from B2C?

A B2C operator deals with the player-facing gaming service; a B2B supplier supports a regulated supply function. One group may contain both roles, but that does not make the permissions interchangeable.

Consider a developer that licenses its game engine to an operator and later launches a branded casino. The second activity changes the analysis: player contracts, balances, verification and complaints now need a separate operating model. Document the new role before assuming the existing supply permission covers it.

What should the technical description show?

Use a diagram that makes regulatory control understandable to a reader who did not build the system. The suggested evidence below should be reconciled with the MGA’s current System Documentation Checklist.

• Identify each game engine, ledger, control system and relevant interface.
• Show hosting locations, privileged access and the parties able to change configuration.
• Explain record creation, retention, export and audit trails.
• Identify third-party components and the contractual right to obtain evidence from their suppliers.
• Map deployment changes to testing, approval and rollback procedures.

How should commercial agreements be reviewed?

A supplier contract should make operational dependencies visible. Identify who responds to incidents, how the operator obtains required records and what happens if the contract ends. A statement that the supplier is “fully compliant” does not explain those obligations.

Test an exit scenario: the operator has to migrate the player ledger while preserving balances and historical records. Can data be exported in a usable format, who validates it and how are access rights revoked? Resolve the responsibilities before the parties become dependent on a live integration.

What are the fee and readiness considerations?

The official MGA B2B page sets application and annual fees, including revenue-based annual bands and a distinct Type 4-only category. Read the current schedule against the intended supply rather than copying a B2C quote.

Readiness also includes licensing perimeter, personnel, technical documentation and the applicable testing process. A supplier should maintain a versioned evidence pack after approval: the permitted service, deployed product, customer agreements and system documentation can otherwise drift apart. Review material changes before release instead of discovering inconsistencies during an audit.