Gibraltar Licence

1) Overview and positioning

The Gibraltar Gambling Commissioner (GGC) is historically considered one of the most demanding European regulators for iGaming. The license is valued by banks/PSP and leading content vendors, assumes high due diligence standards, live compliance (RG/AML/data/advertising) and mature IT controls. Suitable for international operators and B2B providers with a long growth horizon.

2) Types of licenses and perimeter

2. 1 B2C (operator)

Perimeter: front/back office, cash/payout, KYC/AML, Responsible Gaming, content contracts/PSP/KYC, advertising/affiliates, support, regulatory/fiscal reporting.

2. 2 B2B (supplier)

Perimeter: platform, content aggregation, studios (including live), API/SDK and integrations, hosting, SLA/OLA, export metrics/logs to operators, secure SDLC and release management.

3) Requirements for the applicant: due diligence core

Beneficiaries/structure: transparent ownership chain, Source of Funds/Wealth, reputation.
Key Persons: MLRO/AMLO, DPO, RG-Lead, Heads (Compliance/Platform/SRE/Security/Payments) — опыт и «fit and proper».
Policies/procedures: AML/CTF (risk-based), RG, advertising/affiliates, privacy and incidents, DR/BCP, vendor management.
Contracts: studios/aggregators, PSP/banks, CCM/sanction screeners, hosting/laboratories/auditors (SLA/OLA).
IT architecture: residency/data streams, network segmentation, SDLC/observability/security/DR, anti-abuse measures.

4) Technical standards and IT controls (essentials)

SDLC/releases: staging pipelines, change control, artifact and SBOM signatures, rollback policy, prohibition of "manual" changes in sales, full release log.
Observability: structured logs (without PAN and unnecessary PII), metrics, traces (for example, OTel), SLO/SLI, synthetic "deposit/CCL/output" checks, controlled log retention.
Security: mTLS/segmentation, WAF/bot management, SSO/MFA/PAM, SAST/SCA/DAST in CI/CD, vulnerabilities without expired critical/high, regular penetration test.
Data/privacy: DPIA, minimization and differentiation of access, logging and DSR procedures (access/erasure/portability) in compliance with the deadlines.
DR/BCP: backups, periodic restore tests, targeted RTO/RPO with exercises.
Payments: idempotence, HMAC signatures webhooks, DLQ/replay of events, Time-to-Wallet and authorization monitoring, sanction/PEP screening.

5) AML/KYC и Responsible Gaming

Risk-Based AML/CTF: Customer/Geo/Method Profiles; EDD triggers STR/SAR procedures; sanctions/PEP screening.
KYC: age/identity/address; re-KYC by triggers and periodic; selfies/liveness if needed.
Responsible Gaming: deposit/loss/time limits, timeouts, self-exclusion (including nat. registries where applicable), reality checks, behavioral triggers, and telemetry intervention protocols.

6) Advertising and affiliates

Age barriers, banning misleading creatives, transparent T&C promos, frequency and site controls.
Affiliates: contractual obligations for RG/AML/data, white-list channels, creative audit, stop procedures, traffic traceability.

7) Tax and reporting (high-level)

The fiscal base is built around GGR (with details by vertical and adjustments to bonuses/jackpots), in parallel - regulatory fees.
Regulatory Reporting: Finance, RG Metrics, Complaints/Incidents, Structure Changes/Key Persons, Marketing Violations and Measures.
Reconciliations: reports ↔ game/payout logs ↔ PSP/bank data.

(Specific rates/forms depend on the structure of the business and are refined when preparing the package.)

8) The pros and cons of Gibraltar

Pluses

High recognition from banks/PSPs and leading content vendors.
The strict but predictable practice of audits and Q&A is "less surprises" with a good package.
Suitable for multi-brand/international strategy, enhances capitalization and investor confidence.

Cons

Higher TCO and long preparation compared to "light" modes.
Evidence-first requirements: documents without artifacts (logs/dashboards/DR acts) will not work.
Strict discipline of advertising and affiliates; increased public accountability.

9) When to choose Gibraltar

• We need stable access to the payment ecosystem and top content; focus on the long horizon.
• Multi-licensing/expansion across Europe and beyond is planned.
• The team is ready to maintain a mature SDLC/observability/safety and "evidence-first" culture.

• The goal is an ultra-fast MVP with a minimal budget.
• Target markets/channels do not require a "heavy" license at the start, and you are planning a "light" track followed by an upgrade.

10) Licensing Process: Phases and Timelines

Critical path: Key Persons → "live" policies → SDLC/observability/DR (evidence) → laboratories/audit → Q & A.

11) Readiness checklists

11. 1 Definition of Ready

• Perimeter (verticals/geo/payment methods) defined, payment reality confirmed (PSP/banks).
• Key Persons assigned; collected SoF/SoW and references.
• AML/RG/Advertising/Data/Incidents/DR policies approved; there is a journal of audits and trainings.
• SDLC: signatures + SBOM, release history, "no humans in prod," rollback policy.
• Observability: SLO/SLI-dashboards, synthetic checks "deposit/CCL/output," retention logs.
• Security: pentest/scans closed; no critical/high exceptions expired.
• Content/PSP/KYC/Lab/Hosting Contracts; SLA/OLA agreed.
• Advertising/affiliates: white-list channels, creative audit, stop procedures.

11. 2 Definition of Done

• Regulatory/fiscal reporting included; KPI owners are assigned.
• PSP/onboarden content; webhooks subscribed (HMAC), idempotency and DLQ work.
• RG tools are active; intervention telemetry and a decision log are maintained.
• DR/BCP: restore tests with acts were carried out; RTO/RPO is normal.
• Advertising/affiliates: whitelisting, creative auditing, violation and action log.

12) RACI (example)

13) Risks and how to mitigate them

14) 90-180 Day Roadmap (example)

Month 1-2: gap analysis, Key Persons assignment, SDLC/observability/safety remediation, laboratory booking.
Month 2-3: collection of corporate package/policies, penetration tests/scans, DR acts, contracts with providers.
Month 3-4: submission, preparation for Q & A/interviews, dry-run demonstrations (dashboards, magazines, RG/AML scenarios).
Month 4-6: Q & A/variations, finalization, on-boarding PSP/content, reporting included.

15) FAQ (short)

Do I need local hosting? Different models are possible; key - controlled data flows, security and provability of DR/logs.
Can I combine B2B and B2C? Yes, when separating licenses/processes/journals and managing conflicts of interest.
What is critical of the interview? Real RG/AML/advertising processes, SDLC/observability/DR with artifacts, not just documents.

Summary

Gibraltar's licence is an "entry ticket" into a mature ecosystem of payments, content and partnerships. Price - evidence-first discipline: SDLC with signatures and SBOM, observability and DR, hard RG/AML and controlled advertising/affiliates. If you build an international, scalable brand or B2B portfolio, Gibraltar provides a solid foundation and boosts capitalisation - subject to mature processes and transparent reporting.