How to Choose an iGaming Platform Provider: 15 Questions to Ask Before You Sign

This guide shows how to choose an iGaming platform provider with 15 questions, a weighted scorecard and an exit-clause checklist. Comparing a platform you own with rented ones? Capermint scopes igaming software development for licensed operators and registered suppliers, and we will put a build option into your scorecard with its assumptions and price band. Request my project scope.

Written by Team Capermint

How we built this: this iGaming vendor due diligence checklist comes from the evidence and contract terms we work through when scoping platform builds (Capermint-reported 650+ customers), with regulatory points checked against the UK Gambling Commission, the AGCO, the Government of Alberta, New Jersey’s Division of Gaming Enforcement, the PGCB, the MGA, GLI and the GDPR. Capermint builds iGaming platforms, so we have a stake in this choice. The scorecard works for any vendor, including us, and ranks no providers. You can review selected iGaming projects before you call.

What does an iGaming platform provider supply?

An iGaming platform provider supplies the core software an online casino or sportsbook runs on: player accounts, wallet and cashier, game and payment integrations, compliance tools and the back office. It does not replace your own operating license. Providers sell the stack as a rented white-label, a licensed turnkey platform or a custom build you own.

Our online casino software page shows the full module view. A white label casino provider rents you a hosted, branded stack it operates; a turnkey platform provider licenses software you run under your own license; a custom build gives you the code. The white label vs turnkey casino guide covers that trade-off. This page is about vetting the vendor.

Can you run under the provider’s license? In most regulated markets, no: each operator needs its own license or registration; some regulators allow white-label arrangements where the licensee stays responsible. Fees and timelines for your own license are in our online casino license cost breakdown.

How do you choose an iGaming platform provider, step by step?

Run the choice as a short procurement project: write a brief, longlist five to eight vendors, cut to three on license fit checked on regulator registers, send the same 15 questions, test each finalist in a sandbox, call references, score them on one weighted scorecard, then negotiate exit, data and SLA terms before price.

1. Write one brief for every vendor. Target markets and your license status in each, verticals, launch window, three-year GGR and peak-traffic forecast, must-have studios, payment and identity vendors, whether you want to rent, license or own, and a budget ceiling. Identical briefs give comparable quotes. Still planning the business? Start with how to start an online casino business.

2. Longlist and license-check. Drop vendors that cannot show approval where you will launch, checked on regulator registers rather than sales decks. For a build you commission, check who will hold the approval. Our softswiss alternatives list is one starting point.

3. Send one question set. Put the questions to ask an iGaming platform provider (below) to every finalist in writing, with one deadline, and request a sample contract, SLA and data export.

4. Test in a sandbox. Run your own journeys, from sign-up to withdrawal and self-exclusion, plus your team’s daily back-office tasks.

5. Check references and score. Call two live operators per finalist, then fill in the weighted scorecard.

6. Negotiate exit, data and SLA first. Then agree price, and have counsel in your jurisdiction review the contract.

Which questions should you ask an iGaming platform provider?

Ask every vendor the same 15 questions in writing, grouped into licensing, cost, data, technology and support. Written answers are comparable and can be attached to the contract. A good answer is specific and documented; a red flag is a verbal promise, a vague range or a refusal to answer.

Which licensing and compliance questions come first?

Ask where the provider is licensed and under which legal entity, which lab certified which version for which market, which compliance tools are built in and who pays when rules change, and which live operators in your markets you can call. A provider without approval where you launch cannot be fixed later with features.

• 1. Where are you licensed, registered or approved, under which legal entity, and have you faced regulatory sanctions? Good: license numbers you can check on each register, ownership details and audited accounts. Red flag: “licensed in many markets” with no numbers.
• 2. Which components and games are certified, by which lab, against which standard and for which jurisdictions? Good: certificate letters naming the version, the lab (such as GLI or BMM) and the standard, such as GLI-19 for interactive gaming systems or GLI-33 for event wagering; see our guide to rng certification. Red flag: a generic “RNG certified” badge.
• 3. Which KYC, AML, geolocation, responsible-gambling and reporting tools are built in for my markets, and who pays when rules change? Good: features mapped to each regulator’s technical standard. Red flag: compliance updates billed as change requests.
• 4. Which live operators in my markets can I call? Good: two or more named references on the same version. Red flag: references only from unregulated markets, or none.

Which cost questions reveal the real price?

Ask for the three-year cost at your own GGR forecast, line by line; how revenue share is calculated and whether it can change; and what changes, integrations and new markets cost. The headline fee is rarely what you pay by year three, so compare vendors on total cost of ownership, not the setup quote.

• 5. What is the three-year cost at my forecast GGR, line by line? Good: every line in the worksheet below. Red flag: only the setup fee in writing.
• 6. How is revenue share calculated, and can it change? Good: the base (GGR or NGR) and deductions defined, tiers fixed at signing. Red flag: ratchets that rise as you grow. Our revenue share vs fixed fee section explains how each fee model scales.
• 7. What do changes, new integrations and new markets cost? Good: a day rate, change control and fixed quotes per market. Red flag: “roadmap items” with no date or price.

Which data and ownership questions protect your exit?

Ask who owns player, transaction and marketing data and how you export it, what exit assistance you get and at what rate, and who owns the code and assets you fund. Your players, balances and history are the business; without ownership and a tested export, switching later is slow and risky.

• 8. Who owns player, transaction and marketing data, and how do I export it during the contract? Good: the operator named as owner, with field-level exports on a schedule. Red flag: a spreadsheet “on request”.
• 9. What exit assistance do you give, for how long and at what rate? Good: a defined post-termination period with named deliverables. Red flag: help “subject to availability”.
• 10. Who owns the custom code, configuration and brand assets we fund? Good: you own them or hold a perpetual license, and escrow is offered where you get no code. Red flag: your custom work becomes the vendor’s product.

Which technology questions test the platform?

Ask which studios, payment methods and identity vendors are live today, how the wallet holds up at peak and what security evidence exists, where servers and player data are hosted, and how often releases ship. Ask what is integrated now, not on the roadmap, then confirm it in a sandbox.

• 11. Which game studios, payment methods and identity and geolocation vendors are live today, and how long does a new one take? Good: a current list with lead times, direct or through an aggregator (see direct integration vs aggregator). Red flag: catalog counts that include content not approved in your markets.
• 12. How does the platform behave at peak, how is it secured, and where is it hosted? Good: load tests at your peak, an ISO/IEC 27001 certificate or SOC 2 report, a recent penetration test, DDoS mitigation, encryption, back-office two-factor login, PCI DSS scope for cards, and hosting that meets each regulator’s location rules. Red flag: “bank-grade security” with no documents.
• 13. How often do you release, and can I see the change log, roadmap and a sandbox? Good: a release calendar, a hotfix process and regression tests per jurisdiction. Red flag: releases you cannot schedule around major events.

Which support and SLA questions matter after launch?

Ask what uptime the provider commits to, how it is measured and what the credits are, and what support hours, severity levels and response times apply. After go-live, the SLA is your main lever when the platform fails on a peak night, so get both answers in the contract, not the proposal.

• 14. What uptime do you commit to, how is it measured and what are the credits? Good: we suggest at least 99.9% a month on player-facing services, with scaling credits and termination for chronic failure. Red flag: 99.5% or less, or token credits.
• 15. What are your support hours, severity levels and response times, and who is my contact? Good: 24/7 severity-one cover, written targets and a named account manager. Red flag: ticket-only support in another time zone at your peak hours.

Put us through the same 15 questions. Include them with your scope request and we will answer in writing, including where we are not a fit, such as supplier licensing in your market. Request my project scope.

What extra checks apply if you add sports betting?

A sportsbook adds risks a casino platform does not have. Ask whether odds and trading are in-house or a managed service, which event-wagering standard the betting engine is certified against, such as GLI-33, how fast in-play bets are accepted, what liability limits apply per event and how settlement is audited.

Standards are listed in GLI’s published standards; for what a betting build involves, see our sportsbook platform page.

How do I check a provider’s certifications and operator references?

Verify every license and certificate at the source, not in the sales deck. Look the entity up on each regulator’s public register, match the license number and legal name to your contracting company, and check that each lab certificate names the product version and jurisdiction. Then call references running the same version.

Where a Capermint build fits: Capermint is a software development studio, not a licensed or registered gambling supplier. We hold no UK Gambling Commission, MGA, US state, AGCO or AGLC licenses or registrations and no lab certificates. We build RNG and game math ready for independent testing by accredited labs such as GLI, iTech Labs or BMM; certification is obtained by the operator or game owner. In markets that license suppliers, we build for the party that holds, or is applying for, the approval and supplies the product under its own name. Score a Capermint build on license fit by who will hold those approvals. If a regulator decides our role needs its own approval, that is settled at scoping, before work starts.

How should you run a reference call?

A reference call is only useful if the operator runs the same platform version in a similar market. Ask the provider for two or three operators, then ask each the same questions about outages, release speed, change-request pricing, fee changes after signing and how the provider behaved during its worst incident.

• How did the platform hold up on your busiest night, and what was the longest outage?
• Did fees, minimums or revenue share change after signing?
• Have you run a full data export with balances, bonuses and self-exclusions?
• Would you sign the same contract again, and what would you change?

How do you compare providers with a weighted scorecard?

Score each finalist from 1 to 5 on nine weighted criteria, multiply by the weight and add up to a total out of 500. These weights suit a first launch in one or two regulated markets. An established operator migrating platforms should move weight from launch speed to data, exit terms and release control.

What does a scored comparison look like?

Here is a hypothetical first launch in one regulated market, comparing a rented white-label, a licensed turnkey platform and a custom single-vertical build. The scores are illustrative, not vendor ratings. At these weights the turnkey option leads with 365, ahead of the custom build (345) and the white-label (330).

Change the weights and the order changes. A buyer planning several markets who sets data and exit to 25, integrations to 5 and time to launch to 5 gets C 370, B 355, A 300. A buyer with a fixed launch date who sets time to launch to 20 and data and exit to 5 gets B 375, A 360, C 315. Every weight set adds up to 100.

When is a custom build worth scoring?

Score a custom build when you plan several markets, need full control of data and releases, or when revenue share at your forecast GGR would exceed a build budget over three years. Rent or license when speed to a single market matters most and the fee stays affordable at your volume; the business-models guide above compares the models in full.

If one option is a Capermint build, our published bands are $35K–$120K for a pre-built (white-label or turnkey) platform delivered to you or your licensed supplier, typically 6–10 weeks of build and configuration; $60K–$180K for a custom single-vertical platform; and $200K–$500K+ for custom multi-vertical. These are build prices; hosting, third-party fees, lab certification and your license come on top, on their own timelines, and final quotes follow a scoping call. For line items, read our online casino development cost guide or try the game development cost calculator.

Scoring a build against a rental? Send us your brief and shortlist, and we will return a scoped turnkey or custom option, with its assumptions, handed over to your licensed entity, for the same scorecard. Request my project scope.

Which exit, migration and data-portability clauses should the contract include?

Write the exit into the contract on day one. It should name you as owner of player and transaction data, fix a field-level export format and schedule, set a notice period and exit-assistance window at agreed rates, keep read-only access after termination, and require the provider to return or delete personal data when service ends.

Use this casino platform exit clause checklist with your lawyer; the figures are our suggested negotiating positions, not market standards.

• Data ownership: you own player, identity-check, transaction, bonus, marketing and configuration data.
• Exports: a field-level schema in CSV, JSON or a database dump on a schedule, a reconciled test export before launch and each year, and delivery within 30 days of exit for a fixed price.
• Player funds and safer-gambling records: balances, pending withdrawals and bonus liabilities reconciled at cutover; self-exclusions and limits migrate and stay in force.
• Term and notice: renewal terms of 12 months or less, about 90 days’ notice, and termination for convenience after the initial term.
• Exit assistance: at least 6 months at a capped day rate, with read-only back-office access for audits.
• Code and IP: ownership or a perpetual license for work you fund, and source code escrow with release triggers where you get no code.
• Third parties and brand: game, payment, identity and affiliate contracts in your name or assignable; merchant accounts and domains registered to you.
• Personal data: return or deletion at your choice when service ends, unless law requires the provider to keep it, plus audit rights. Under the GDPR and the UK GDPR, Article 28(3) requires both in the processor contract.
• Record retention: who keeps the records your regulator requires after you leave.

General information, not legal advice; have counsel in each licensing jurisdiction review the contract.

What should a provider’s SLA cover: uptime, support hours and release speed?

A useful SLA covers availability, support and change. We suggest a monthly uptime commitment of at least 99.9% on player-facing services, with service credits; 24/7 cover and fixed response times for severity-one incidents; and a release calendar with hotfix times and notice before maintenance. Recovery targets and termination rights complete it.

• Measurement and credits: what counts as down, which services count, maintenance limits, credits that scale with the breach and termination after repeated misses.
• Support hours: response and resolution targets per severity, with cover at your peaks, such as US and Canadian evenings and weekend sports.
• Recovery and change: recovery point and recovery time objectives in writing, a tested disaster-recovery plan, freeze windows around major events, and regulator-driven changes delivered before the deadline.

What red flags should rule a provider out?

Rule out any provider that cannot prove licenses or lab certificates for your markets, will not name its contracting entity, owners or live references, prices only the setup fee, refuses to define data ownership or a test export, or pushes you to sign before you have seen the contract, SLA and exit terms in writing.

• Exclusivity that stops you adding game studios or building your own modules.
• Auto-renewal with a long notice period and no termination for convenience.
• Offers to launch where you hold no license, where its own supplier approval is missing, or where your product is prohibited.
• A platform shown only as a demo, with no live operator traffic.

Frequently asked questions