Due diligence fails when it is one person's tacit knowledge. This is written to be delegated: each item says what to ask for, and whether you should verify it yourself or take it as given.
- Five sections. Do them in order; the first two eliminate fastest.
- “Verify” means check against a source that is not the supplier.
- “Collect” means hold the document; you may need it later.
1. Corporate
- Legal entity name and registration number. Verify on the companies register of its jurisdiction. Everything else keys off this.
- Registered address and country of incorporation. Collect.
- Ultimate beneficial ownership. Collect. Where the jurisdiction publishes a UBO register, verify.
- Group structure. Collect. Note which entity will sign, which holds the licence and which owns the technology. They are often three different companies.
- Most recent filed accounts. Collect where filing is public. A supplier you depend on operationally is a counterparty risk.
2. Regulatory
- Licences held, by market. Collect the licence number and issuing regulator for each. Verify on the regulator's register where one exists.
- The activity each licence covers. Verify — registers publish activity types, and the activity is what determines what they may do for you.
- Licence status and expiry. Verify. Active, suspended, pending and surrendered are different answers.
- Regulatory actions. Verify. Most regulators publish enforcement separately from the register; check both.
- Which entity holds each licence. Verify against section one.
Where a regulator publishes nothing — the common case — collect the licence instrument itself: a certificate, gazette notice or decision with a number and a date.
3. Technical
- Certificates, with standard, version and date. Collect the documents, not the claims.
- Which products are certified in your market. Collect the list in writing.
- Integration documentation. Collect before signing.
- Hosting and data location. Collect. Several regimes require local hosting; check yours.
- Security posture. Collect ISO 27001 or equivalent, plus the date of the last penetration test.
4. Commercial
- Revenue share or fee structure, and what it is calculated on. Gross gaming revenue net of what, exactly.
- Exclusivity, in both directions. Are they exclusive to a competitor in your market; are you being asked for exclusivity.
- Term, notice and exit. What happens to your players mid-session on termination.
- Who bears regulatory change. If your market changes its rules and the product needs rework, who pays.
- Liability and indemnities, particularly for a supplier failure that costs you a licence condition.
5. Operational
- Support hours in your timezone, and escalation path.
- Uptime commitment and how it is measured. Measured against what, excluding what.
- Incident history. Ask for the last significant one and what changed after it.
- Named operators in your market you can reference.
- Roadmap and release cadence, if you are depending on future functionality.
Applying it proportionately
A jackpot supplier taking a slice of every stake needs all five sections. A single game licensed through an aggregator you already contract with needs sections two and three, briefly. Judge by what breaks if the supplier fails: money, licence, or a slot in the lobby.
Keep the file
Whatever you collect, keep it with the date you collected it. Regulators increasingly expect operators to show they checked their supply chain, and “we asked” is a weaker answer than a dated folder. It is also what makes the next review cheap: you are updating a file rather than starting one.
Licence records with numbers, tiers and register links for the suppliers we cover are on each company profile.
