Licensing process and timing

1) Process picture (high-level)

1. Pre-fit & Gap Analysis

2. Package collection and submission

3. Technical checks and certifications

4. Review by regulator

5. Release (often conditional) and commissioning

6. Post-licensing obligations (reporting/audits)

Objectives: to reduce regulatory risks, provide a provable "compliance readiness," speed up go-live without compromising on RG/AML/data.

2) Estimated dates (benchmarks)

The critical path usually goes through: Key Persons → policies/procedures → IT artifacts (releases/logs/DR) → laboratory/audit reports → regulator Q&A.

3) What to Cook in Advance (Pre-fit & Gap)

Strategy and perimeter: target markets/languages/payment methods, verticals (casino/live/betting/poker).
Legal framework: ownership structure, SoF/SoW, register of beneficiaries.
Orgmodel: MLRO/AMLO, DPO, RG-Lead, Security Lead, Release/Platform Lead roles.
Policies: AML/CTF, RG, Advertising/Affiliates, Data Protection (DPIA), Incidents, DR/BCP.
IT readiness: SDLC and change control, staging pipeline, SBOM/signatures, observability (logs/metrics/trails), RG/AML event log, pentest/vulnerability scans.
Providers: draft contracts with game aggregators, PSP, CCM/sanction screeners, laboratories/auditors.

The result of the phase is a gap report with a remediation plan and a calendar.

4) Package of documents: composition and life hacks

Corporate unit: statutory, ownership structure, CV and Key Persons, SoF/SoW references.
Procedures and policies: AML/CTF, RG, advertising, privacy (including DPIA), incidents/breach, DR/BCP.
IT architecture: data lineage, storage areas/residence, SDLC/releases, observability, redundancy and RTO/RPO.
Contract base: aggregators/studios, PSP, CCM/sanctions, hosting, laboratories/auditors, SLA/OLA.
Finance: provisions for payments, insurance (if required), GGR tax reporting plan.

Life hacks of acceleration

Support "evidence-first" storage (release logs, SBOM, scan/pentest reports) - this removes dozens of clarifications.
Use templates for KYC/EDD cases, RG intervention logs, and advertising apps.

5) Technical checks and certification

Gaming software: RNG/RTP lab reports (for content), integration certificates.
Security: penetration tests, vulnerability management, patch policy, secret management/KMS, SSO/MFA/PAM.
SDLC: staging pipelines, image signatures, change control, rollback policy, release log evidence.
Observability: logs without PII/PAN, SLO metrics, OTel end-to-end traces, synthetic deposit/ACC/output checks.
DR/BCP: backups, restore tests, RTO/RPO goals, test reports.
Payments: HMAC webhooks signatures, idempotency, DLQ and event replay, authorization/success percentages, Time-to-Wallet.

Phase output - a set of reports and acts that are attached to the application or presented to the request.

6) Review by regulator (Q&A cycle)

• Clarifying questions on beneficiaries/finances, RG/AML procedures and data.
• Key Persons interview (often MLRO/AMLO, DPO, Head of Compliance).
• Technical demonstrations: showing logs, release artifacts, SLO alerts, RG/AML scripts, DR exercises.
• Variations of conditions: clarifications in contracts, strengthening procedures, additional laboratory reports.

Practice: create a register of regulator requests (SLA of answers, owner, status, date of sending/confirmation).

7) Issue and commissioning

• We publish mandatory information and T&C, include regulatory reporting.
• We are completing the onboarding of PSP/aggregators/KYC, we are conducting a "dry run" of RG payments/interventions.
• Setting up DevPortal/operator dashboards to control KPI (RG, AML, complaints, incidents, Time-to-Wallet).
• We assign a calendar of internal/external audits.

8) Post-licensing obligations

Periodic reporting (GGR by verticals, complaints, RG metrics, data/security incidents).
Control/structure changes - notify the regulator in advance.
Regular pentests/scans, renewal of laboratory certificates, rotation of secrets.
Affiliate/advertising management (channel register, stop lists, creative selections for verification).

9) Parallelization and the critical path

What can be done in parallel

Policies/procedures ↔ technical checks/observability;

Contracts with providers ↔ laboratory tests;

Key Persons preparation ↔ pentest/SDLC remediation.

What creates bottlenecks

Reference and verification of Key Persons, SoF/SoW;

Laboratory/audit slots;

Answers to complex requests of the regulator without pre-collected artifacts.

10) RACI (example for licensing program)

11) Check-list Definition of Ready

• Jurisdiction/verticals confirmed, target markets and payment methods agreed.
• MLRO/AMLO, DPO, RG-Lead assigned; prepared by Key Persons CVs/References.
• AML/CTF, RG, Advertising/Affiliates, Data Protection (DPIA), Incidents, DR/BCP - Approved and in effect.
• SDLC: staging pipeline, artifact signatures, release logs, rollback plan; observability and synthetic checks - included.
• Pentest/vulnerability scans completed; remediation plan closed.
• Draft contracts with aggregators/studios/PSP/KYC/laboratories - agreed.
• Financial guarantees/provisions calculated; SoF/SoW collected.

12) Check-list Definition of Done

• Regulatory reporting included; KPI owners are assigned.
• PSP/KYC onboarding completed; webhooks are signed (HMAC), idempotency and DLQ are in operation.
• RG tools are active (limits, timeouts, self-exclusion), intervention log is maintained.
• Evidence package available: releases (SBOM/signatures), pentest/scans, DR acts, laboratory reports.
• Affiliate/ad control loop works (whitelisting, creative sampling).
• The internal/external audit calendar has been approved.

13) Typical risks and how to reduce them

14) How to speed up the program (without losing quality)

"Evidence-by-default": confirm everything that you declare in the policies with artifacts (screenshots/logs/reports).
Package in one repository: document version, checklists and task statuses.
Uniform templates: for RG interventions, complaints, SAR/STR, advertising apps.
Synthetic scenarios: regular "trial" deposits/CCM/conclusions with reports.
Parallelization: Technical remediation and contracts - simultaneously with package preparation.
Preview environments: demostend for regulator interviews (without PII/PAN), enabled tracing/dashboards.

15) 90-day mini-plan (example)

Weeks 1-2: final choice of jurisdiction, appointment of owners, launch of gap remediations.
Weeks 3-6: Package Collection (Corporate/Finance/Policy), Pentest/Scans, SDLC/Observability Setup.
Weeks 7-10: laboratory tests (RNG/integrations), PSP/KYC contracts/content, DR test reports.
Weeks 11-12: Applying, preparing for Q&A, booking Key Persons interviews.

Brief conclusion

The licensing process is a managed program with clear artifacts and roles. Focus on the critical path (Key Persons → of policy → IT evidence → laboratory → Q&A), parallelize preparation, maintain an "evidence-first" archive and keep the payment/content ecosystem ready for onboarding. So you will turn the timing from an "unknown risk" into a projected schedule for entering the market.