Malta B2B and UK gambling software licences for a mixed product

The product lead should prepare one inventory covering every module and interface. Record inputs, outputs, read and write permissions, hosting, release control and the consequences of failure. Identify the developer, contractual supplier, installer, maintainer and runtime operator separately. These facts connect the product description to each legal test.

For Malta, essential regulatory data includes required records about players, deposits and withdrawals, gaming transactions and gaming revenues. Critical supply includes material supply indispensable to determining outcomes or processing or managing that data. The categories are alternatives. (S.L. 583.04, reg. 2, definitions of critical gaming supply and essential regulatory record.)

The inventory should distinguish four functions:

• Game engines and random-number generators determine or materially affect results. Identify who controls the mathematics, outcome mapping and deployed version. Maintained outcome components point towards Malta's critical-supply category and British gambling-software treatment.
• Account and transaction systems need a more specific description than player database. A system recording wagers, settling balances or allocating winnings differs from a contact database. For Malta, identify which software generates, captures, controls or processes the required regulatory record.
• Platform controls need assessment by their operational effect. A back-end control system can fall within Malta's express category. In Britain, software that implements gambling transactions or results requires assessment even when sold as platform administration.
• Analytics can remain ancillary where it performs separate, nonessential commercial analysis. A dashboard that starts controlling settlement or supplying indispensable regulatory processing needs reassessment. Read-only access alone does not establish an exemption.

These applications follow the statutory categories and the Commission's published interpretation; the architecture determines which branch applies. (S.L. 583.05, First Schedule, para. 3; Gambling Commission, What is gambling software?, Definition of gambling software and footnote 3.)

Where a package combines a game engine, required transaction ledger and performance dashboard, the supplier can retain a separate analytics module. Its access controls and dependencies must preserve that separation. The operator must still obtain the regulated functions through the authorised route. Removing those functions from the invoice while continuing to provide them does not change the underlying activity.

Malta's territorial rule reaches critical supply from Malta, to any person in Malta, or through a Maltese legal entity. A foreign development team does not remove a connection created by the recipient or supplying entity. The statutory exception for supply solely relating to exempt games must also be checked. (S.L. 583.05, regs. 3(1) and 5.)

The B2B categories cover supply and management of material game elements, essential-record software and the relevant control system. Management means ongoing active maintenance and support indispensable to the gaming service. The legal lead should therefore review the support agreement, deployment permissions and retained engineering responsibilities alongside the code. A one-off development or transfer arrangement needs separate analysis; absence of continuing support should not be treated as a universal exemption from the broader critical-supply rules. (S.L. 583.04, reg. 2; S.L. 583.05, First Schedule, para. 3 and proviso.)

Noncritical supply may still be material. Risk management, fraud management, identity verification, cloud services and disaster recovery appear in the Third Schedule. The receiving authorised business must establish the applicable supplier-certificate or case-specific approval route. An ordinary analytics conclusion therefore requires checking materiality as well as the critical-supply test. (S.L. 583.05, reg. 20 and Third Schedule; MGA Directive 3 of 2018, art. 27(3).)

For a direct licence, the applicant must be established in the European Economic Area. Malta is one possible establishment location. The MGA's January 2024 clarification also describes how a UK entity can qualify through an EU legal person, capital participation, branch or representative office maintaining lasting economic links. That UK-specific clarification should not be generalised to every foreign entity. (S.L. 583.05, reg. 10(1); MGA, Notice of Repeal of the Brexit Guidance Note, 26 January 2024, p. 2.)

The company secretary should identify the proposed licence holder and document its establishment, ownership and actual contractual role. The MGA assesses relevant persons' fitness, sustainable finance, competence and the proposed business. A qualifying interest starts at ten per cent, but the Authority can apply a lower threshold. Shareholding percentages therefore cannot replace a complete control analysis. (S.L. 583.05, regs. 9–11 and 15.)

The finance lead should evidence the €40,000 critical-supply capital requirement using the permitted issued and paid-up capital and share-premium reserves. The funding plan must also address equity restoration. The current policy contains a specific B2B-only negative-equity rule, an earlier-intervention power and new-licensee timing provisions. The minimum capital is not the total launch budget. (MGA, Capital Requirements Policy, ss. 3–5.4 and 7.)

For a direct Malta B2B application, assemble separate evidence files:

• The company secretary provides constitutional records, ownership and control diagrams, shareholder information and entity declarations.
• Relevant individuals provide personal declarations, identity and conduct evidence, financial information and supporting records required for their roles.
• Finance supplies the business plan, funding provenance, capital evidence and three-year financial projections with assumptions.
• Engineering supplies architecture, component and data-flow diagrams, hosting locations, access controls, security, continuity, recovery and outsourcing policies.
• The product and testing teams provide software rights, game rules and mathematics, RNG details, applicable certificates, version records and operator segregation evidence.
• Legal and compliance provide supply, hosting and intra-group agreements, together with the key-function allocation and supporting applications.

These groups should be reconciled against the MGA's current B2B System Documentation Checklist and declaration enclosures. B2B key functions cover executive management, operations, regulatory compliance, legal affairs, applicable data protection, technology and internal audit. The rules concern responsibilities and qualified holders; they do not require seven separate employees in every business. (MGA, System Documentation Checklist, B2B sheet; Entity and Personal Declaration Form enclosures; Directive 3 of 2018, arts. 4–9, especially art. 6(3).)

Section 41 regulates manufacturing, supplying, installing or adapting gambling software in the course of business. Its definition concerns software for remote gambling and excludes software used solely with gaming machines. Merely providing communication facilities used by another person to supply or install software is separately excluded. These limits matter when classifying ordinary infrastructure providers. (Gambling Act 2005, s. 41(1)–(3).)

For the overseas supply arrangement, the operator's licence condition is decisive. Condition 2.2.1 covers remote casino, bingo and betting licences, with specified ancillary and trading-room exclusions. It requires licensed manufacture and final supply, and licensed installation or adaptation. The developer should obtain the customer's actual licence details before applying that condition. It should not treat section 41 as a worldwide offence solely because an overseas contract names a British customer. (LCCP, condition 2.2.1.)

Development contracts also require examination. Under the Commission's guidance, a business buying a finished product from a developer that controls its design normally needs a licensed developer. A business buying staff time while retaining actual design and content control presents a different arrangement. Identify who approves changes, conducts acceptance and compliance testing, owns the relevant intellectual property and bears responsibility. A staffing label cannot replace those facts. The final contractual supplier has its own licensing question, including where an IP company sits between developer and operator. (Gambling Commission, What is gambling software?, Supplying gambling software and Manufacturing and adapting gambling software.)

Installation includes deployment of relevant updates. Maintenance is not a separate statutory verb, but a maintenance task that installs or adapts the software engages the named activities. The release team should classify each task by what it changes. A licensed operator installing its own updates may need its own linked software permission. (Gambling Act 2005, s. 41(1); Gambling Commission, What is gambling software?, Installing gambling software.)

Secure file transfer and downloads point to the remote gambling software licence. Supply by physical media can require the non-remote category as well. A supplier running playable games on its own server for another operator's customers must also examine the relevant host operating licence. The host route requires a software licence and no direct contract with those players; lack of a player contract does not itself remove the hosting issue. (Gambling Commission, Remote gambling software licence, licence scope and Hosts.)

If the developer instead takes responsibility for the customer-facing gambling service, the British operator licensing analysis addresses that separate decision. Software permission alone does not authorise the provision of gambling facilities. (Gambling Act 2005, ss. 5, 33 and 65(2)(i).)

A foreign company can apply without incorporating in Britain, but must provide a UK service address. The Commission assesses the applicant and relevant persons for suitability, including integrity, competence and resources. Specified management offices require personal management licences, subject to the defined small-scale exception and transition rules. Check actual appointments rather than assuming startup status creates an exemption. (Gambling Act 2005, ss. 69(2)(b) and 70–71; LCCP, condition 1.2.1.)

Prepare the British application as its own document set:

• Corporate records, group and ownership charts, existing permissions and the UK service address.
• Management responsibilities, relevant personal management applications or the properly established alternative route, and identity and suitability disclosures.
• Business plan, accounts where applicable, bank statements, funding evidence, loan documents and forecasts appropriate to the applicant.
• An operational model map, system diagrams, equipment and development locations, software delivery arrangements and the allocation of design and release control.
• Policies addressing applicable licence conditions, technical standards and testing, supported by the relevant contracts and technical evidence.

The Commission's checklist has criteria for each document. A new software supplier should explain genuinely inapplicable items and absent trading history. It should not describe player-facing operations it does not conduct merely to populate an application form. (Gambling Commission, What you need to send us when you apply for an operating licence, document criteria.)

The supplier's technical lead and the operator should agree a release record for each product version. It should identify the tested build, RNG and game-engine dependencies, operator integration, deployment environment and person authorised to release it. Evidence from one jurisdiction should be mapped against the other jurisdiction's requirements before reuse.

Malta's application process includes technical review and a system audit. The audit timetable is not a promised licence-decision timetable. Game approvals, technical changes and licence-scope changes remain separate requirements. Adding back-end services to a game-provider permission, or the reverse, requires prior approval. Hosting plans must also address the rules for essential components and regulatory access. (MGA, Application Process Guidance Note, ss. 1.6–1.8; audit-process update, 2 May 2025, s. 1.1; Directive 3 of 2018, arts. 16–24 and 38(2).)

British technical compliance follows condition 2.3.1 and the current Remote Gambling and Software Technical Standards and testing strategy. New games, RNGs and changes affecting fairness require the applicable approved-test-house work and submission of the required reports to the Commission before release. A bug fix can affect fairness. Minor changes still need a recorded classification and controlled deployment. The operator maintains its own games register; annual games and security audits depend on the applicable licence combination and activity. They should not be assigned indiscriminately to every software-only supplier. (LCCP, condition 2.3.1; Gambling Commission, Testing strategy, ss. 3, 4, 7 and Annex A.)

Platform requirements can also change after initial certification. British deposit-limit changes took effect on 30 September 2026. Where the product supplies these controls, its specification must support the current gross-deposit-limit requirements. A previously accepted build may need further work. (Gambling Commission, RTS 12B; Implementation extension for new deposit limit requirements, 26 May 2026.)

The operator retains responsibility for its gambling permission, customer relationship and applicable player-protection duties. Outsourcing software does not transfer those obligations. The supplier remains responsible for its own authorised activities. The contract and system permissions should preserve the agreed allocation, including authority over accounts, withdrawals, exclusions and settlement. (MGA Directive 3 of 2018, arts. 26–28; LCCP, social responsibility code 1.1.2.)

British third-party terms must address equivalent compliance for work undertaken on the licensee's behalf, information provision and prompt termination rights, subject to contractual dispute-resolution provisions. Malta has express contractual requirements for outsourced services that do not themselves require a licence or approval; other categories have their own authorisation and responsibility rules. Keep those mandatory requirements distinct from the parties' additional commercial protections. (LCCP, social responsibility code 1.1.2(2); MGA Directive 3 of 2018, arts. 26–27, especially art. 27(4).)

The proposed supply agreement should then specify:

• Approved customer entities, licensed activities, products and player markets, with review before onward supply or territorial expansion.
• Approved versions and configurations, responsibility for testing and submissions, deployment approval, rollback and emergency changes within applicable regulatory rules.
• Operator and regulator access to records, audit evidence, subcontractor information and technical explanations.
• Data instructions, permitted purposes, access locations, security, subprocessors, retention and export or deletion on exit.
• Notice of licence restrictions, suspension, revocation and material changes to control, hosting or services, followed by suspension of affected supply where required.
• Exit assistance that preserves required records and permits lawful transition without continuing prohibited gaming activity.

Where the supplier processes personal data for the operator, the applicable processing agreement must address the required controller-processor terms. Access from another country needs its own transfer assessment. Remote support by a separate overseas company can constitute a restricted transfer even if the server remains in Britain. Put any required transfer mechanism in place before enabling that access. A gaming permission does not supply the data-transfer mechanism. (EU GDPR, arts. 28, 32 and Chapter V; UK GDPR, arts. 28, 32 and Chapter V; ICO, Are we making a restricted transfer?, steps two and three.)

The recommended sequence begins with the component inventory, customer licence evidence and a map of operating countries. The legal lead must identify the rules applicable where development, support, hosting and supply actually occur. If those activities are prohibited or require an origin-country permission, the activity must change or the permission must precede it. A new Maltese or British company does not relocate work performed elsewhere.

Then choose between three routes:

1. A Malta-first deployment supports preparing the direct MGA application first where the supplier meets establishment requirements and its material-game or essential-record functions require that permission. Prepare British software and any hosting applications before the British deployment; the Malta licence does not satisfy condition 2.2.1.
2. A Britain-first deployment supports prioritising the Commission application for the relevant software and hosting activities. For subsequent Maltese supply, test recognition before committing to a second full application. The MGA's January 2024 notice permits consideration of UK safeguards under regulation 22. Recognition still requires an application and a positive MGA decision covering the actual services.
3. A genuinely ancillary-only release can proceed through the ordinary software route only after confirming the absence of regulated functions and satisfying applicable material-outsourcing, origin-law and data requirements. Keep game, essential-record and operating controls outside that release until their permission conditions are met.

The recognition file needs the certified foreign licence, entity and director records, regulator good-standing evidence and a certified professional opinion. That opinion addresses territorial rights, supervisory coverage and comparability with Malta's licensable services. A British software licence that does not cover a Malta-critical record function cannot simply be treated as covering it. (S.L. 583.05, reg. 22; MGA, Recognition Notices, application documents and legal-opinion requirements; Notice of Repeal, 26 January 2024, p. 2.)

For simultaneous commitments, prepare both sets of evidence together once the supplier entities and functions are settled. Authorise each deployment only when its origin-law position, supplier permission, operator permission, technical acceptance and contract controls are satisfied. Use the first customer's actual dependency to set the order, rather than an unsupported assumption that one regulator will decide faster.