The first decision is whether the vendor can lawfully perform the work from India. The Maltese classification then determines the destination requirements. Even a dashboard outside Malta’s critical-supply category needs its Indian use assessed. The product description, support arrangements and actual system permissions must establish the permitted service.
Executive Summary
- Optional statistical reporting can remain ancillary in Malta if it meets neither the critical nor material supply tests. Software indispensable to outcomes or essential regulatory data requires a different assessment. Read-only access does not itself decide the classification. (Gaming Act, Cap. 583, art. 2; Gaming Definitions Regulations, S.L. 583.04, reg. 2.)
- Risk management, fraud management and managed hosting can be material supplies. The operator must obtain a certified service or MGA approval of the particular arrangement. A supplier’s voluntary certification route does not make the operator’s duty optional. (Gaming Authorisations Regulations, S.L. 583.05, reg. 20 and Third Schedule; Gaming Authorisations and Compliance Directive, Directive 3 of 2018, art. 27(3).)
- India’s prohibition extends to aiding online money gaming. The foreign customer’s licence and exclusion of Indian players do not establish an export exemption. Whether the dashboard assists the prohibited activity must be assessed from its actual functions and use. (Promotion and Regulation of Online Gaming Act, 2025, ss. 1(2), 2(1)(g)–(h) and 5.)
- A direct Maltese licence requires EEA establishment. Incorporation, supplier licensing, approved system changes and the legality of Indian work are separate conditions. (S.L. 583.05, regs. 3, 10 and 16; Directive 3 of 2018, arts. 16 and 27(1).)
- Proceed only with a defined service that passes both countries’ tests. Record its functions, markets, access rights, approval dependencies and suspension triggers in the contract and deployed system.
Separate statistical reporting from game and record control
The vendor should prepare separate specifications for the dashboard and the extension. Each specification should identify inputs, outputs, production permissions, hosting, maintenance and the consequences of failure. The operator’s compliance and technology teams should confirm which system holds each required gaming record.
An optional dashboard displaying historical aggregates presents a different Maltese classification from an engine that determines results or settles play. To support the ordinary-analytics position, the operator should retain complete regulatory records independently. The dashboard should have no authority to change game mathematics, commit transactions, alter balances or replace required reporting. These are proposed product controls, not a statutory exemption.
The extension needs a more exact description than “influences outcomes”. A commercial recommendation reviewed by the operator differs from executable logic that determines a result. Likewise, displaying transaction statistics differs from generating or maintaining the record through which transactions can be reconstructed. Malta’s test turns on indispensability and the supplied function, including continuing maintenance. (Gaming Act, art. 2; S.L. 583.05, First Schedule, para. 3.)
Engineering should demonstrate what happens when the vendor’s service is disconnected. Continued game operation is only part of that test. If the operator loses required records, regulatory reporting or an important fraud-control function, a claim of ordinary analytics needs reconsideration.
Malta applies three supply classifications
The Gaming Act defines critical supply through two alternative connections. The supply can be indispensable to determining game outcomes, or indispensable to processing or managing essential regulatory data. The second connection can apply without any power to influence the result. (Gaming Act, art. 2.)
The licensing categories cover supply and management of material game elements. They also cover essential-record software and its control system. “Management” carries a specific qualification: ongoing active maintenance and support indispensable to providing the gaming service. The review must therefore examine the continuing service as well as the code. A one-off software delivery and an operated, maintained component cannot be treated as identical without examining the facts. (S.L. 583.05, First Schedule, para. 3.)
Essential regulatory records include the minimum required data concerning players, deposits, withdrawals, gaming transactions and gaming revenue. Software can process those records without write access. A separate analytical copy supports a narrower classification only where the operator’s regulatory record and required processing remain independent of it. Calling a database a reporting warehouse does not decide its function. (S.L. 583.04, reg. 2, definition of essential regulatory record or data.)
Below the critical threshold, material supplies remain regulated. The statutory list includes risk and fraud management, odds, player-fund management, customer due diligence, identity checks, managed IT, qualifying cloud hosting and backup services. A dashboard that performs fraud decisions or supplies operational risk management may fall here. Materiality also depends on the consequences of failure for compliance, risk management or business continuity. (Gaming Act, art. 2; S.L. 583.05, Third Schedule.)
The supplier may apply for a material-supply certificate. If it does not hold one, the operator must obtain the MGA’s approval of the particular supply. Notification through the operator’s outsourcing process does not replace required approval. For ancillary outsourcing, the operator remains responsible and must include the prescribed regulatory terms in the agreement. (S.L. 583.05, reg. 20; Directive 3 of 2018, arts. 25–27.)
Supply from India to a person in Malta can trigger the licensing requirement. An MGA licensee must also source critical supply from a provider with the appropriate B2B licence or recognition notice. Its own operator licence does not cover an independent supplier’s regulated activity. Supply relating solely to an exempt game has a separate statutory treatment; the customer’s status as a gaming business does not establish that exemption. (S.L. 583.05, regs. 3 and 5; Directive 3 of 2018, art. 27(1).)
Player-facing powers create a further boundary. For outsourced website or premises managers, direct player contracts, or handling both registration and deposits and withdrawals, can trigger a gaming-service licence presumption. The specified exception requires proof that the functions serve the licensed operator under its approved arrangements. Merely displaying payment statistics does not establish those conditions. The proposed analytics service should exclude player contracting and authority over stakes or withdrawals. (Directive 3 of 2018, art. 28(2).)
Indian law applies to the service performed from India
The Promotion and Regulation of Online Gaming Act, 2025 took effect on 1 May 2026. An online money game involves fees, money or other stakes paid with an expectation of monetary or equivalent enrichment. The definition covers skill, chance and mixed games, while excluding qualifying e-sports. Section 5 prohibits offering, aiding, abetting or otherwise engaging in the offering of online money games and online money gaming services. (Act 32 of 2025, ss. 2(1)(c), (g)–(j) and 5; S.O. 1994(E), 22 April 2026.)
An outcome-control module maintained from India for a money-gaming operation presents a direct assistance issue. Essential transaction or operating-record support can present the same issue even when it never determines a result. The vendor should not activate either function on the strength of the operator’s Maltese permission.
Read-only reporting also needs examination. Reports used to manage or improve prohibited money-gaming operations can assist their offering. A genuine corporate reporting service with no such role supports a different argument, but the vendor must establish that distinction through its outputs, integrations and actual use. Malta’s ancillary classification does not supply the missing Indian conclusion.
The Act extends throughout India and expressly addresses money-gaming services operated from outside India. It contains no express exemption for supplying a foreign licensed operator. The strongest narrower argument concerns services wholly directed to foreign activity and sufficiently removed from offering a game. That argument requires examination of the Indian acts of assistance; an offshore contract or geographic block cannot establish it alone. (Act 32 of 2025, ss. 1(2), 2(1)(h) and 5.)
The Online Gaming Authority of India reinforced its position on intermediaries in its 29 July 2026 advisory. It addresses persons assisting money gaming even when they are not primary operators, including cloud and payment providers. It calls for non-compliant activity to be suspended and compliance controls implemented. The advisory does not specifically resolve the overseas analytics model. Its administrative position must be read with the statutory prohibition, without inventing a foreign-supply permission. (OGAI, Advisory on compliance with sections 5, 6 and 7, 29 July 2026, paras. 4–7.)
The practical instruction is to remove or decline work that falls within the prohibition. If the proposed overseas-only use remains legally unresolved, hold deployment while Indian counsel addresses that precise use and location. The Act’s recognition arrangements for permissible games do not create a licence to provide prohibited money-gaming assistance. A shift to non-money games also requires fresh classification under each country’s rules. (Act 32 of 2025, ss. 2–5 and 8.)
State law must be checked where staff and systems perform the work. The national Act operates in addition to other laws. It overrides another Act to the extent of an inconsistency. The contract therefore needs the supplier’s actual operating locations, including any state from which staff support production. An assessment covering one state cannot clear work performed elsewhere. (Act 32 of 2025, s. 18.)
If the vendor works from Telangana, its Gaming Act requires a further assessment. The legislation includes intended assistance to wagering, third-party acts and stakes on games of skill. Its gaming-instrument definition expressly includes electronic and digital records, while section 3 prohibits assistance in conducting a common gaming house. These provisions require a review of the actual business and statutory elements; they do not classify every software office as a gaming house. Establish the operating locations and state-law position before production access begins. (Telangana Gaming Act, 1974, ss. 2(1)(ii), 2(2), Explanation (i)(c)–(e), 2(4) and 3(1), as amended by Act 29 of 2017.)
The payment model must keep software invoices separate from player stakes and winnings. Section 7 addresses financial transactions and authorisation of funds towards payment for money-gaming services; section 6 separately prohibits the relevant advertising. Exclude player-payment execution, player acquisition and game promotion from the analytics scope. A fixed service fee may clarify the commercial relationship, but it cannot legalise prohibited assistance. (Act 32 of 2025, ss. 6–7.)
For a lawful export, the vendor must use the current foreign-exchange process. The 2026 export and import regulations took effect on 1 October 2026 and include software within services. Software exports require an Export Declaration Form within 30 days after the invoice month ends, subject to an authorised dealer’s permitted extension. The ordinary realisation and repatriation period is nine months from the service invoice, or twelve months where invoiced or settled in rupees, with permitted extensions. The finance team should agree the documentary and receipt process with its authorised dealer before invoicing. These requirements do not establish that the underlying service is lawful. (FEMA 23(R)/2026-RB, regs. 1–5, as amended by FEMA 23(R)/(1)/2026-RB.)
Complete the permission and product changes before production
The preferred starting scope is optional analytics with tightly limited access, provided the Indian assessment supports its actual use. The operator should retain the game engine, authoritative gaming records, transaction execution and compliance decisions within the appropriately authorised systems. If the operator requires the vendor to perform the proposed regulated functions, the parties must address the full supply model before enabling them.
A direct MGA licence requires the applicant to be established in the EEA. An Indian company should not assume it qualifies through Indian incorporation alone. Any eligible entity must actually perform and control the role described in its application. A contract routed through an EEA company cannot conceal indispensable management still performed by another supplier. A recognition notice is relevant only where the MGA recognises an applicable foreign authorisation. (S.L. 583.05, regs. 9–11 and 22; Directive 3 of 2018, art. 27(1).)
Any proposed funding of the EEA applicant from India needs a lawful route. Subject to its statutory exceptions, rule 19 prohibits overseas direct investment by a person resident in India in a foreign entity engaged in gambling. The rules also require the foreign business to be permissible under Indian and host-country law. The actual B2B business therefore needs classification; its Maltese licence does not settle the Indian investment question. Indian counsel and the designated authorised dealer should resolve this before the resident subscribes for or funds the applicant. (Foreign Exchange Management (Overseas Investment) Rules, 2022, rr. 2(1)(q), 9(1) and Explanation, and 19(1)(b); RBI, Master Direction – Overseas Investment, paras. 3 and 20(1).)
The vendor and operator should complete these steps in sequence:
- The product lead prepares the function, data-flow and access specification. Indian counsel assesses the underlying games, acts performed in India, state connections and payment model. Prohibited functions are removed or declined.
- The operator’s compliance team classifies the retained supply in Malta. For material supply, it obtains certificate evidence or case-specific approval. For critical supply, the responsible supplier secures the required authorisation before supply begins.
- The applicant prepares ownership, funding, operational and technical evidence. The MGA’s application guidance requires technical review and an independent system audit by an approved provider. Any required game or random-number-generator certification must match the actual product. (MGA, Application Process Guidance Note, February 2023, sections 1.1–1.6; Directive 3 of 2018, art. 23.)
- The licensee obtains required written approvals for essential-component changes and critical game-element updates. The urgent-change exception permits only changes strictly necessary to avoid significant interruption of the licensee’s operations. The licensee must notify the MGA forthwith and within 72 hours of the change, and the MGA decides whether the action was warranted. (S.L. 583.05, reg. 16; Directive 3 of 2018, arts. 16(3) and 24.)
- The applicant identifies the B2B key-function holders and follows the approval and notification timetable. Responsibilities cover executive, operational, compliance, legal, applicable privacy, technology and internal-audit functions. The six-month period for notifying remaining functions does not authorise an unapproved individual to perform one. Responsibility rests with directors where no approved holder exists. (S.L. 583.05, regs. 23–24; Directive 3 of 2018, arts. 4–8, particularly arts. 5, 5A and 6(3).)
Hosting must also match the approved architecture. Malta generally requires key technical components in Malta or another EU or EEA state. The MGA can permit another location where the required safeguards are established. Relevant hosting providers must assist MGA checks, and essential regulatory data must have an accessible live or real-time mirror. Indian hosting cannot be assumed acceptable because the supplier already uses that infrastructure. (Directive 3 of 2018, arts. 15–18.)
Production can begin only for the functions covered by the completed legal assessment, permissions and technical evidence. The operator and vendor should retain the release decision with the approved version and access configuration. Subsequent changes reopen the affected assessment.
Make the contract enforce the permitted service
The statement of work should identify the permitted dashboard outputs and data sources. Attach the architecture and access-permissions record. Expressly exclude the functions outside the agreed route: game-result control, balance changes, bet settlement, player contracting, funds handling and authoritative regulatory-record management. If any function is later authorised and lawful in India, add it through a separately approved change.
The agreement should also address:
- Named customer entities, permitted games and player markets, with evidence of the operator’s relevant permissions. Add a process for market changes and technical restrictions where required. A Malta permission does not itself approve every player country.
- The vendor’s Indian operating locations, subcontractors and hosting sites. Changes require reassessment before the affected work moves or begins.
- Each party’s responsibility for regulatory submissions, testing, deployment and rollback. Acceptance testing by the customer cannot substitute for MGA approval.
- Regulatory information, access and assistance, together with exportable records, continuity and exit arrangements. Termination must preserve the operator’s ability to meet its record obligations.
- Suspension of affected functionality when a legal prohibition, licence lapse or unauthorised market use arises. Allocate the operational steps and responsibility for notifying the operator.
- Fees, intellectual property, liability and indemnities appropriate to the actual supply. These are negotiated commercial terms; they do not transfer public-law responsibility away from the relevant person.
For outsourcing that requires no supplier licence or approval, Malta prescribes specific contractual protections. The agreement must require appropriate regulatory conduct and information provision. It must also permit immediate termination for the regulatory breaches and MGA determinations specified in the directive. Additional suspension and change-control clauses should implement the chosen product scope. (Directive 3 of 2018, arts. 26–27(4).)
Before Indian staff obtain identifiable player data, the parties should document the processing roles and applicable international-transfer safeguards. Remote access can itself constitute a transfer even where the server remains in the EEA. The data schedule should address authorised access, security, subprocessors and return or deletion alongside legally required preservation. (EDPB, Guidelines 05/2021, version 2.0, paras. 9 and 15–16.)
The vendor should sign only for functions it can lawfully perform and technically restrict. If the operator insists on prohibited Indian assistance, the service must be declined. If the retained functions are lawful but regulated in Malta, the parties should complete the relevant permission and deployment conditions before supply starts.
Assess the supplier’s actual functions
Assess the supplier’s actual functions with a review of the product specification, data flows, Indian operating locations, target markets and proposed supply agreement. The work should identify the permitted functions, required permissions and contract changes before the parties commit to deployment.