Define the permissions, testing and contracts needed to supply gaming software across borders. Licentium’s supplier review covers product classification, origin-country restrictions and destination requirements for businesses working from India, Armenia or South Africa. The proposed scope includes Malta, Great Britain and the restrictions on supply to Brazil.
Software and services within the review
The review is for game studios, platform suppliers, back-office providers and gaming-analytics businesses selling to operators. It covers game engines, random-number generators, remote game servers, transaction records and support services. Each component needs its own assessment, including who maintains it and who controls releases.
A reporting dashboard can perform a different legal function from software that settles bets or maintains the operator’s authoritative gaming records. The product description must identify those differences before an application is selected. British regulatory guidance distinguishes general performance analytics from gambling-specific transaction, outcome and record software. Malta separately identifies critical, material and ancillary supplies. (Gambling Commission, What is gambling software?, “Definition of gambling software”; Gaming Definitions Regulations, S.L. 583.04, reg. 2.)
Classify the functions and the country of supply
Start with the entity that develops, supplies and maintains each component. Record who contracts with players, accepts stakes, controls accounts and decides whether games remain available. A supplier that hosts and operates games can need an additional gambling permission even without accepting bets directly. Affiliate marketing and ordinary infrastructure also need distinct assessments. (Gambling Act 2005, ss. 5, 33 and 41; Gambling Commission, What is gambling software?, “Do gambling software businesses require additional remote operating licences?”.)
The classification memo separates the licensed operator, software supplier, game host, marketing affiliate and ordinary IT provider. It identifies the permission attached to each function and any function the supplier must remove. For the separate decision about taking operator responsibility, see the Armenian platform and Curaçao operating-route analysis.
Origin-country law remains a separate condition:
- In India, section 5 prohibits offering, aiding or abetting the offering of online money games and online money gaming services. A foreign operator’s licence does not provide an Indian export exemption. The review must test whether development, hosting or support assists the prohibited activity. Ordinary business analytics requires examination of its actual use. Where the work falls within the prohibition, that work must stop or change. (Promotion and Regulation of Online Gaming Act 2025, ss. 1(2), 2(1)(g)–(h) and 5; Online Gaming Authority of India, advisory dated 29 July 2026, paras. 4–7.)
- In Armenia, the operative rules reach activities that organise internet gambling, including delegated arrangements that create player participation. Development and operational control must therefore be separated in both the contract and the system permissions. The replacement law has a staged transition tied to the monitoring operator’s appointment; its substantive regime cannot simply be treated as fully operative. (Law HO-1-N, arts. 2, 4 and 5; Law HO-263-N, art. 58(4)–(5); Government Decision N 1155-A of 6 August 2026, para. 1.)
- In South Africa, outcome software requires examination under the gambling-device rules and the relevant provincial requirements. The exception for machines or devices manufactured in South Africa solely for export and possessed in compliance with provincial law addresses specified registration and certification controls; it does not remove the separate authorisation rule for manufacture and supply. A company seeking a national licence applies to the provincial authority where its principal place of business is or will be located. (National Gambling Act 7 of 2004, ss. 1, 9(1) and 38(3)(b); National Gambling Regulations 2004, reg. 8(3)(a)(v).)
Destination permissions and technical evidence
Malta critical and material gaming supplies
For licensable games, Malta requires authorisation for critical gaming supply from Malta, to a person in Malta or through a Maltese entity. The B2B category covers supply and management of material game elements and essential-record software or related control systems. Management includes indispensable ongoing maintenance and support. The review must therefore examine the software and the continuing service together. (Gaming Authorisations Regulations, S.L. 583.05, regs. 3 and 5 and First Schedule, para. 3.)
An applicant for a direct licence must be established in the European Economic Area. Recognition of a foreign authorisation requires an MGA decision. Hosting, cloud, risk-management or fraud-management services can instead fall within material supply, requiring the appropriate certificate or recipient-specific approval. A finding that software is not critical does not complete that assessment. (S.L. 583.05, regs. 10, 20 and 22 and Third Schedule.)
The application workplan identifies the applicant, ownership and funding evidence, relevant key-function holders, technical documents and audit requirements. It also addresses system locations, outsourcing and the approvals or notifications needed for product changes. The supplier provides the technical record; the testing or audit body provides evidence within its approved scope. The MGA decides the authorisation. (S.L. 583.05, regs. 10–11; MGA, Application Process Guidance Note, February 2023, sections 1.1–1.6; Gaming Authorisations and Compliance Directive, Directive 3 of 2018, arts. 4–6, 16–24 and 26–29.)
Great Britain gambling software and game hosting
For remote casino, bingo and betting operators within the rule’s scope, gambling software must come from licensed manufacturers and suppliers. Installation and adaptation must also satisfy the licensed-sourcing requirement. Review game logic, RNGs, bet capture, settlement and detailed gambling records. A licence held elsewhere does not satisfy this British condition. (Gambling Act 2005, s. 41; Licence Conditions and Codes of Practice, condition 2.2.1.)
An overseas company can apply without incorporating in Britain, but it needs a UK address for service. The workplan must address ownership, suitability and applicable personal-management requirements. Hosting games for access through operators can require an additional remote operating licence. Great Britain means England, Wales and Scotland; Northern Ireland requires a separate scope. (Gambling Commission, Operating licences; What is gambling software?, “Do gambling software businesses require additional remote operating licences?”; LCCP, conditions 1.2.1 and 3.1.3.)
The relevant licensee and approved test house must match testing to the actual product, version and integration. Updates that may affect game fairness require the applicable external retesting; minor changes need a justified classification and controlled release records. (LCCP, condition 2.3.1; Gambling Commission, Testing strategy, sections 3 and 8.)
Brazil supply restrictions and closure support
Brazil’s fixed-odds betting regime prohibits the relevant offering, intermediation and advertising, including offshore offerings to people in Brazil. Medida Provisória 1.394/2026 provides for existing authorisations to end 30 days after publication and prohibits new ones. The proposed supply route must exclude support for prohibited gambling. Any claimed court relief requires verification of the order, beneficiary, scope and continuing effect. (Medida Provisória 1.394 of 25 September 2026, arts. 1–7 and 30.)
Earlier certification covered betting systems, games, RNGs and integrations. Those certificates do not authorise a new launch under the prohibition. They remain relevant when checking historical deployments and records. (SPA/MF, Questões Técnicas, questions 69–71 and 100; Medida Provisória 1.394/2026, art. 29, sole paragraph.)
Closure support must preserve the records and reporting needed for outstanding player refunds and regulatory obligations. Separate that work from game availability, new deposits and player acquisition. (Medida Provisória 1.394/2026, arts. 7–11 and 14.)
Operator agreements that match the permitted activity
The contract review should produce an allocation of duties that the product teams can implement:
- Name the permitted operators, player territories, products and contracting entities. Specify who controls access and who checks proposed market changes.
- Assign responsibility for game updates, testing, submissions, deployment approval and rollback. An operator’s commercial acceptance cannot replace a required regulatory step.
- Provide access to records, technical evidence and subcontractor information needed for regulator requests. Confidentiality terms must accommodate legally required disclosure.
- Define incident notification, affected-market suspension, termination and exit assistance, including access to preserved records.
- Address IP rights, permitted sublicensing, service levels and liability. Separate proposed commercial protections from mandatory regulatory terms.
British third-party rules and Malta’s outsourcing rules require specified compliance, information and termination arrangements within their respective scopes. The detailed market schedule, operational deadlines and liability allocation should then reflect the actual product and negotiated responsibilities. (LCCP, social responsibility code provision 1.1.2; MGA Directive 3 of 2018, arts. 26–29.)
Product records needed for the review
Provide a function and architecture description, data flows, hosting locations and an access-permissions map. Include the ownership structure, existing permissions, operator agreement and intended player markets. Engineering should identify product versions, game mathematics and RNG dependencies, test reports, integrations, release history and incident records.
The records schedule should identify authoritative gaming data, required access, applicable retention periods and the handover process. The review also checks whether origin-country export or IP-transfer conditions affect code delivery and licensing. A licence application, product certificate and signed supply agreement each answer a different requirement.
Deliverables and work stages
The proposed engagement has four deliverables:
- A product-function classification memo identifying the supplier’s role, decisive facts and functions requiring a change.
- A destination permission map showing the relevant entities, origin restrictions and conditions for each proposed market.
- An application and certification workplan assigning documents, technical evidence and dependencies to the supplier, operator, local counsel and testing body.
- An operator-contract review addressing market restrictions, releases, records, regulator access and suspension.
Work begins with the product and territory review. Application preparation follows only for routes supported by that assessment. Production supply starts after the applicable origin permissions, destination authorisations and technical requirements are satisfied. The operator must supply evidence of its permissions and responsibilities; specialist counsel and testing bodies must complete the work assigned to them.
Request a supplier classification review
Assess a gaming supplier route with a product description, the supplier’s operating countries, target operators and markets, and the current or proposed supply agreement.