Compliance Guide · 2026

Who are you supplying? Operator due diligence for B2B iGaming suppliers

For years B2B suppliers were judged mainly on their content. That is changing: regulators, shareholders and the press now ask where that content appears. In October 2026 trade press reported on a racing data supplier’s past contract with an operator of unlicensed brands, and the reaction from its shareholders. Whatever the outcome of that case, the lesson for every supplier is the same: know who you supply, and where.

Why it matters now

NEXT.io and Gambling.com reported on 1 October 2026 that the data supplier SIS had signed a contract in 2022 with Curaçao-based Santeda to supply unlicensed brands, and that one of its shareholders, Entain, had raised concerns. SIS said its customers must only offer its products where it is legal and that it would take corrective action where needed. The case shows how a supplier’s client list can become a shareholder and licensing issue.

Before onboarding

• Licence: number, regulator, markets covered, expiry.
• Entity and owners: legal entity, ultimate beneficial owners, group structure.
• Brands and domains: every brand and URL the content will appear on.
• Payments and KYC: payment providers and verification process.
• Target markets: where the operator will actually market and accept players.

In the contract

• A list of permitted markets and an obligation to geo-restrict all others.
• A duty to notify new brands and domains before content goes live on them.
• Audit rights, including access to launch and player-location logs.
• Suspension and termination rights if content appears where it should not.

Enforced in the technology

Clauses work best when the integration enforces them. With the IGP casino API, each game carries the markets it is certified for, the jurisdiction is checked on every launch, and launches are logged. Our guide to jurisdiction controls covers the details.

After onboarding

Due diligence is not a one-off. Re-check licences on renewal, watch for new brands and domains, and review where traffic and players actually come from. A change in an operator’s markets should trigger a review of what content it may use.

Frequently asked questions