Online Casino Investment Due Diligence: A Practical Checklist

Investing in an online-casino operator, supplier or affiliate requires more than checking whether the brand displays a licence badge. The investor must identify the legal entity receiving the money, verify every material market and licence, recon­struct ownership, test reported earnings and quantify regulatory, player-fund and payment risks. This is commercial due diligence, not a guarantee of returns or a substitute for legal and financial advice.

Define the investment and transaction perimeter

Record whether the proposal is equity, debt, a convertible instrument, an asset purchase or a token. Identify the issuer, seller, consid­er­ation, valuation, use of funds, security, share­holder rights, closing condi­tions and every company included or excluded.

A casino brand may be split across an intel­lectual-property owner, licensed operator, platform company, payment entity, marketing affil­iates and local market companies. Obtain a group chart and test each link against registries, accounts, licence records, contracts and bank evidence. Use the filing-to-reality ownership method rather than accepting a presen­tation slide.

Verify licences by entity, domain, product and territory

Search the regulator’s own register using the legal name, trading name and domain. Confirm status, licensed activ­ities, effective dates, condi­tions and enforcement history. The UK Gambling Commission’s public register covers licensed businesses, individuals and regulatory actions. The Malta Gaming Authority’s Licensee Hub provides licence and enforcement searches.

A licence in one juris­diction does not authorise every country reached by the website. Build a market-by-market matrix showing local revenue, customer numbers, domains, permitted products, licence basis, adver­tising restric­tions, tax and respon­sible-gambling oblig­a­tions. Separate regulated, restricted, uncertain and prohibited revenue.

Check B2B suppliers as well as the B2C operator. Malta Media’s inves­ti­gation of Maltese-licensed suppliers serving allegedly unlicensed casinos illus­trates why delivery-chain due diligence matters. Treat the article as a lead and verify licence scope, contracts and regulator rules directly.

Reconstruct ownership, management and funding

Identify share­holders, ultimate beneficial owners, directors, key licence holders, lenders and option or warrant holders. Review historic changes, nominee arrange­ments, trusts, side letters, pledges and veto rights. Screen principals against regulator decisions, insol­vencies, sanctions, litigation and credible adverse reporting, allowing them a fair oppor­tunity to explain material findings.

For Malta-regulated businesses, the MGA’s individual require­ments show that changes involving directors, controlling interests, beneficial owners and funding can require due-diligence and source-of-wealth material. An investor should confirm that trans­action approvals and notifi­ca­tions are condi­tions to closing, not assump­tions.

Normalise the financial statements

Obtain audited and management accounts, bank state­ments, tax filings, processor state­ments and cohort data. Reconcile gross gaming revenue to player stakes and winnings, then bridge to net gaming revenue after bonuses, jackpot contri­bu­tions, charge­backs, payment fees, gaming tax and affiliate commis­sions.

Test cash conversion rather than relying on EBITDA. Quantify restricted cash, player balances, ring-fenced or safeguarded funds, unpaid withdrawals, progressive jackpot liabil­ities, chargeback reserves, tax exposures and minimum capital. Confirm whether revenue is booked gross or net and whether large related-party service charges move profit elsewhere.

Analyse concen­tration by country, brand, game provider, payment processor and affiliate. A profitable operation can lose market access quickly if one licence, payment partner or traffic source fails. Compare the payment archi­tecture with the casino payment-fraud risk framework.

Test compliance in operation

Policies alone are not evidence that controls work. Sample customer files, enhanced-due-diligence decisions, source-of-funds reviews, sanctions alerts, suspi­cious-activity escalation, self-exclusion, afford­ability or financial-risk checks where applicable, bonus terms, complaints and withdrawal handling. Review regulator inspec­tions, internal audit, independent assurance and remedi­ation logs.

Track opera­tional metrics such as blocked accounts, manual withdrawals, average withdrawal time, unresolved complaints, self-exclusion failures, AML alerts and regulatory reporting breaches. Examine whether staff and systems can support the forecast growth without weakening controls.

Review technology, games and data

Confirm ownership or licensing of the platform, domains, source code, trade­marks and customer database. Review uptime, disaster recovery, cyber­se­curity incidents, penetration testing, data-protection compliance and key supplier termi­nation rights.

For games, obtain laboratory certi­fi­ca­tions and change-control records where required. Reconcile the games displayed in sampled countries with autho­rised suppliers and product permis­sions. Do not infer fairness or solvency from a recog­nisable game-provider logo.

Model jurisdiction and exit risk

Stress-test the valuation by removing revenue from markets with weak or disputed legal access, increasing payment and compliance costs, and applying plausible fines, remedi­ation and licence delays. Model customer-acqui­sition payback, churn, bonus cost and lifetime value using raw cohort data rather than blended averages.

If Curaçao-linked entities appear in the group, apply the dual-register and licence-scope checks for Curaçao-linked struc­tures. Perform the same local-law analysis for every material juris­diction.

Make closing protections evidence-based

Translate findings into condi­tions, warranties, indem­nities, price adjust­ments and infor­mation rights. Condi­tions may include regulator approval, verified ownership, repayment of player liabil­ities, resolution of enforcement matters, replacement of a payment depen­dency or delivery of audited accounts.

The final investment memo should separate verified facts, management repre­sen­ta­tions, assump­tions and unresolved red flags. It should name the entity, licence, domain and reporting period behind every material claim. A defen­sible decision may be to invest, reprice, impose condi­tions or walk away—but it should never rest on a licence logo, headline revenue or the general reputation of a juris­diction.