Advice on entering local regulated markets

The best option is to dedicate a project manager who has a strong background in technology and does not shy away from reading long requirements. If you already have someone with similar experience, then you’re all set. If you do not have such a person, a senior project manager from your PMO or product development might be a good choice.

Do not think that your platform provider will cover everything for you, as there are many things that fall outside of the platform’s scope. Having a project manager who can keep every party in check will help smooth out the process by a lot.

So, the first thing that we do is read the regulations carefully and discuss any vague or unclear requirements with the regulator. And if/when the regulator tells us to take it up with the testing lab, we need to select the right partner for the process. The good thing is that there are few global testing labs, and they usually are on the short-lists of most regulators. This means you’ve probably worked with them before (even if it’s a different geographic team, it still helps when you have some successful projects with them under your belt).

Once we understand the requirements better, we create a gaps analysis document, listing things that we need to add or modify in our system to pass the certification process successfully. If it’s a jurisdiction that we feel has a great potential for our business, we may even waive the fees to our clients, keeping the project costs down for them.

The longest part of the process of getting an operator license is the due diligence process — usually, your lawyers need to provide a lot of documentation on the ultimate beneficiaries of the company and notarised copies of the supporting documents.

Game providers often need to be licensed (or at least certified), as local regulations will usually require some adjustments to the games, such as a maximum bet or maximum exposure of a slot, some rules on responsible gaming, and so on.

A platform is often certified in the scope of the operator’s licensing. Often, there is no special B2B licensing for a platform. The platform needs to fully match the requirements of the regulations, but the responsibility will lie on the operator to ensure that. However, many jurisdictions also either license or register trusted third parties, mostly platform providers, but often also KYC and due diligence providers, payment systems, and so on.

Some examples from our experience: the UK and Malta have B2B licensing for platforms, Belgium and Latvia do not, and jurisdictions like Tennessee, USA have registration for platform providers, which is a cheaper and faster process than getting an operator’s license.

There might be requirements that might lead to substantial expenses; for example, a regulator can request all software to be hosted within the jurisdiction. As one consultant once told us: “regulators love to be able to send in police and arrest the servers if something really bad happens.” As usual, you are sharing the costs of servers with other operators on the platform; you might find that the platform will require you to foot the bill if they do not yet have infrastructure there.

Another hidden cost is in the recertification of software. As it is customary to have monthly, weekly or even daily updates to a modern platform, some jurisdictions do not allow a new release to be used unless it is recertified. This recertification process usually takes substantial time and requires a payment of a recertification fee to the test labs and often requires approval from the regulator as well. This might mean that you won’t be able to introduce new functionality easily, and you might think twice before introducing something that is not really important.

A jurisdiction might specify particular due diligence suppliers to be used, and those will often charge you annual and per-check fees. This is quite important for the USA, as you need to ensure not only that your players come from the USA but also that they are resident of a particular state, which is not that trivial a process.

A jurisdiction can require you to hire local personnel, which also needs to be taken into account when calculating your budget. This goes on top of other local fees, like office rent, accounting, local lawyers, and so on. You might also need to create a business plan, which might need to be outsourced if you have no experience doing them.

You can also be required to get ISO 27001 certification prior to receiving your license, which is something to keep in mind when thinking of timelines. Also, you might be required to submit your solution for a vulnerability test (usually black-box hacking simulation); this can be done either as a part of the certification or separately.

Finally, in new jurisdictions, you should expect additional requirements to come quite often (we have seen some jurisdictions change their regulations at least quarterly). This requires work both on the operator’s and platform’s side, and the platform may need to charge you for such additional development, especially if there is a strict and challenging deadline for the implementation.

Responsible gaming will usually require some sort of blocks/warnings to the players, the ability to self-exclude, and so on. In our experience, once you’ve developed requirements for 3-4 jurisdictions, you have covered most of the requirements, and you will most likely need to make just minor adjustments to the existing functionality.

KYC and due diligence usually are quite specific to the particular jurisdiction but often require simple changes to the software or integration with some external provider. Some jurisdictions might require you to integrate the country-wide exclusion database to prevent people with gambling problems from accessing your site.

Reports to the regulators are the field with the widest and the wildest differences. Some regulators require real-time per-bet access; some will need you to send data dumps at specified periods; others will require you to develop an API so that they can access the data as much as they like whenever they need it. The data in reports can also be very varied. Some regulators want just basic information; others might need almost an entire warehouse amount of data, with many different facets of the information required.

IT security usually does not give you surprises, but sometimes it does. We haven’t yet seen any vetoes on particular technologies used, but we have seen some requirements that usually cannot be feasibly implemented using specific software, which can be a significant setback. Standard requirements of encryption, best practices for storing sensitive data, backup policies, storing raw data for a number of years at an off-site storage facility are usually required, but again, do not give you trouble, as they should already be implemented anyhow.

One area that is understandably very sensitive to the regulators is preventing access to gambling by minors. We have seen much stricter requirements being imposed by regulators around the world there. What was sufficient several years ago is now considered inadequate.

Even if the process seems daunting, we can assure you that it gets easier with experience. Once you have your project managers and legal teams more experienced in the area, entering the next market becomes much less stressful and more streamlined. With local regulation becoming so popular, we think that operators that invest in building this expertise will find themselves at the forefront of the industry in many lucrative jurisdictions.

Source: EGR