iGaming M&A Due Diligence: What You Must Check Before Buying

Due diligence is the process by which a buyer converts their preliminary interest in an iGaming acquisition into a fully informed decision. It is the most demanding phase of any transaction — requiring simultaneous investigation across financial, commercial, technical, legal, and regulatory workstreams — and it is the phase where the majority of deal-altering discoveries are made.

Generic M&A due diligence frameworks are inadequate for iGaming. The sector has specific diligence requirements that do not appear in standard commercial M&A: gaming licence regulatory correspondence, RNG certification status, responsible gambling compliance history, platform provider agreement terms, affiliate programme compliance, and player data ownership. Missing any of these creates post-acquisition exposure that a standard M&A indemnity structure may not adequately protect against.

This guide provides a complete due diligence framework for iGaming acquisitions — structured by workstream, with the specific items that require iGaming expertise to evaluate correctly, and the red flags that should prompt either a price renegotiation or a withdrawal from the process.

Financial Due Diligence

Financial due diligence in iGaming goes beyond standard P&L verification. The goal is to confirm that the financial performance presented in the CIM and management accounts accurately represents the sustainable earnings of the business — adjusted for non-recurring items, normalised for owner-specific costs, and stress-tested for the sustainability of each revenue line.

Core financial documents to request

• 24 months of monthly management accounts broken down by GGR, bonus expense, NGR, operational cost categories, and EBITDA
• Payment processor transaction statements for 24 months — reconciled against management accounts to confirm revenue integrity
• Bank statements for the operating entity for 24 months
• Tax returns and VAT submissions for the last 3 years — confirming the business has been tax-compliant
• Audited accounts if available — not universal in mid-market iGaming but highly desirable

Key financial due diligence questions

Does the GGR in the management accounts reconcile with the payment processor statements? Any material discrepancy requires explanation — this is where revenue inflation most commonly occurs.

Is the bonus expense as reported accurate and consistent? Bonus manipulation — reducing bonus spend in the months prior to sale to inflate EBITDA, then restoring it post-closing — is one of the most common seller tactics in iGaming. Trend the bonus-to-GGR ratio across 24 months to identify anomalies.

What are the normalised EBITDA figures after adding back non-recurring costs and adjusting owner’s salary to market rate? The normalised EBITDA — not the raw reported figure — is the appropriate base for the acquisition multiple.

Commercial Due Diligence

Commercial due diligence evaluates the quality, sustainability, and growth potential of the business’s revenue and competitive position. In iGaming, this workstream is closely intertwined with the player database analysis and traffic review.

Revenue sustainability analysis

For each significant revenue line — GGR by product vertical (casino, sports betting, poker), by geography, by acquisition channel — assess the sustainability drivers. Is SEO traffic stable (verify in Google Search Console data, not just Ahrefs estimates)? Are affiliate partnerships on documented commercial agreements or informal arrangements? Is VIP player revenue concentrated in a small number of high-value accounts that may not transfer to a new owner?

Competitive position

Where does the casino rank organically for its primary keywords? How has that ranking moved over the last 12 months? Who are the primary organic competitors and what is their investment trajectory? A business whose SEO position is deteriorating pre-acquisition is a warning sign — the buyer may be acquiring a declining traffic asset at a price that reflects the current position rather than the direction of travel.

Market and regulatory trajectory

Is the primary market in which the business operates becoming more or less accessible to unlicensed or lightly regulated operators? A Curaçao-licensed business generating 40% of revenue from German players post-GlüStV is operating in a legally ambiguous position that could be disrupted by enforcement action. Regulatory trajectory of the primary revenue markets is a commercial due diligence item, not purely a legal one.

Player Database Analysis

The player database is the core commercial asset and the one that requires the most iGaming-specific analytical capability to evaluate correctly.

Player data must be provided in GDPR-compliant form — anonymised or pseudonymised for due diligence purposes. Full data transfer occurs post-closing under appropriate data processing agreements. Buyers should confirm that the seller holds the player data (not the platform provider) and that GDPR consent covers the intended post-acquisition data use.

Regulatory Due Diligence

Regulatory due diligence is the most iGaming-specific workstream and the one most frequently inadequately performed by buyers without specialist iGaming experience.

Licence verification

Verify the licence directly with the issuing authority — do not rely solely on the seller’s representation. Check the licence number against the regulatory authority’s public register, confirm the current licence status (active, under review, subject to conditions), and request the full licence documentation including any conditions attached to the licence.

Regulatory correspondence file

Request all correspondence between the operator and the licensing authority for the last 36 months. This includes: annual reporting submissions and the authority’s responses, any compliance queries or information requests initiated by the regulator, any warning letters, fine notices, or sanction decisions (whether resolved or outstanding), and any pending matters flagged for follow-up by the authority.

The absence of a regulatory correspondence file — a seller who claims there has been no correspondence with the authority — is itself a red flag. All active licence holders have ongoing regulatory correspondence. Either the file has not been produced or the business is not operating in a genuinely compliant manner.

Responsible gambling compliance

Review the responsible gambling programme against the standards required by the licensing jurisdiction. For UKGC-licensed businesses, verify: implementation of mandatory player protection tools (deposit limits, time limits, self-exclusion), compliance with GAMSTOP integration (UK self-exclusion register), evidence of customer interaction for at-risk players, and staff training records. Non-compliance with responsible gambling standards is the most common source of UKGC enforcement action and the most likely post-acquisition regulatory liability for UK-facing businesses.

AML and KYC procedures

Review the anti-money laundering programme: the AML policy, the KYC verification procedures, the transaction monitoring system, and the suspicious activity report (SAR) history. iGaming businesses are designated obliged entities under AML regulations in most jurisdictions. Deficient AML compliance creates criminal and civil liability that transfers with the business in a share acquisition.

Technical Due Diligence

Technical due diligence scope varies significantly between white-label and proprietary platform acquisitions. For white-label businesses, the technical review focuses primarily on the platform agreement terms and the integration quality. For proprietary platforms, it encompasses the full technology stack.

For all acquisitions

• RNG certification: request the most recent RNG test certificate from the certified testing laboratory (BMM Testlabs, eCOGRA, GLI). Expired or absent certification creates regulatory compliance risk.
• Game provider licensing: confirm that all game integrations are covered by valid software supplier licences from each provider — these may need to be renegotiated or separately obtained post-acquisition in some structures.
• Uptime and incident history: request 12 months of platform uptime data and a summary of material technical incidents — including payment processing failures, data breaches, and game integrity incidents.
• Data security posture: review the most recent penetration test results, the data security policy, and any history of data breaches that required regulatory notification.

For proprietary platforms (additional)

• Code quality review by an independent technical advisor — assess documentation quality, test coverage, and technical debt
• IP ownership confirmation — verify that all platform IP is owned by the operating entity, not licensed from a third party or held by former employees
• Development team assessment — understand the capability, size, and retention risk of the technical team

Legal Due Diligence

Legal due diligence covers the contractual and corporate legal position of the business. iGaming-specific legal items include:

• Corporate structure: confirm the entity being acquired, its registered office, UBO structure, and that there are no undisclosed related-party structures or nominee arrangements
• Material contracts: review all material agreements — platform provider, key software providers, payment processors, affiliate network agreements, and any exclusivity or non-compete provisions
• Intellectual property: confirm ownership of the domain name, trademarks, and any proprietary technology — and that these are held by the entity being acquired, not a related party
• Employment and contractor arrangements: review employment contracts for key personnel, any non-compete or garden leave provisions that affect post-acquisition operations, and any outstanding employment disputes
• Litigation history: request details of any litigation, arbitration, or regulatory proceedings — current, pending, or in the last 3 years — that the business is or has been party to

Affiliate Programme Review

The affiliate programme is a central revenue driver for most casino acquisitions and a due diligence area that deserves dedicated attention.

• Obtain the full affiliate programme data: total active affiliates, FTD volume by affiliate (top 20 minimum), commission structure by affiliate, and the written affiliate agreements for the top 10 partners
• Assess affiliate compliance: are affiliates marketing in compliance with the licensing jurisdiction’s advertising standards? Responsible gambling warnings, no targeting of self-excluded players, accurate bonus terms — these are the operator’s liability, not just the affiliate’s
• Review the affiliate network platform: is the programme run on a major affiliate platform (Income Access, Affiliate Edge, MyAffiliates) with documented tracking, or on an informal arrangement with manual tracking? The former is a clean, auditable programme; the latter creates liability uncertainty
• Identify any affiliate non-compete or exclusivity provisions that could prevent the post-acquisition buyer from using their own preferred affiliate partners

Payment Processing Due Diligence

Payment processing is a critical operational dependency and a source of material post-acquisition risk if not properly reviewed.

• Request the full list of payment processor and PSP relationships, with processing volumes and approval rates by processor for 12 months
• Review the processing agreements for any change-of-control provisions — payment processors increasingly include provisions that allow them to suspend or terminate a processing relationship on change of ownership
• Assess the chargeback rate history: chargeback rates above 1% of transaction volume indicate player dispute patterns that may signal fraud, responsible gambling non-compliance, or AML issues
• Confirm reserve requirements: many payment processors hold a rolling reserve against future chargebacks. The amount, release schedule, and treatment in the transaction balance sheet must be clearly established

Red Flags That Should Stop a Transaction

Some due diligence findings are deal-ending. The following represent the red flags that experienced iGaming M&A advisors treat as grounds for either immediate transaction termination or a fundamental price and structure renegotiation:

Frequently Asked Questions

Q: How long does iGaming M&A due diligence take?

For a mid-market iGaming acquisition (€1M–€10M enterprise value), comprehensive due diligence typically takes 4–8 weeks from data room access to completion of all workstreams. The primary driver of timeline variance is the speed and organisation of information provision by the seller. A well-prepared data room with pre-organised documentation can reduce the due diligence timeline by 2–3 weeks compared to a seller providing documents reactively in response to individual requests.

Q: What is the most commonly missed due diligence item in iGaming acquisitions?

Based on CasinosBroker’s transaction experience, the most frequently missed or inadequately reviewed item is the regulatory correspondence file — specifically, the history of any compliance interactions with the licensing authority beyond the headline ‘we hold an MGA licence’ representation. Many buyers accept the licence as a given without reviewing the regulatory standing in depth, and discover post-closing that the business has outstanding compliance obligations or an informal warning from the regulator that was not disclosed.

Q: Should a buyer conduct technical due diligence on a white-label casino?

Yes — though the scope is narrower than for a proprietary platform. White-label technical due diligence should focus on: confirming the RNG certification is current, reviewing the platform agreement for assignment provisions and remaining term, assessing the integration quality with game providers and payment processors, and reviewing the platform provider’s own financial stability and market position. Omitting technical due diligence on a white-label acquisition because ‘the platform is someone else’s problem’ misses the operational dependency risks that are specific to this model.

Q: How does a buyer protect themselves against post-acquisition regulatory liability?

The primary protections are: comprehensive regulatory due diligence before closing (identifying known risks); specific regulatory warranties in the SPA (the seller warrants there are no outstanding investigations or compliance issues beyond what has been disclosed); regulatory indemnities covering any pre-closing regulatory acts or omissions that result in post-closing sanctions; and escrow arrangements holding a portion of the consideration for a defined period against regulatory claims. No structure eliminates regulatory risk entirely — the goal is adequate disclosure and appropriate contractual allocation of identified risks.

Q: Can due diligence findings be used to renegotiate the price after the LOI is signed?

Yes — if the LOI includes a due diligence condition or a material adverse change provision (which it should). Findings that materially affect the normalised EBITDA, the regulatory standing, or the operational viability of the business are grounds for price renegotiation. The threshold for price renegotiation versus withdrawal depends on the specific finding and the buyer’s risk tolerance. CasinosBroker advises buyers on how to present due diligence findings constructively to achieve a price adjustment without unnecessarily antagonising the seller.

Q: What warranties should a buyer insist on in an iGaming SPA?

Essential iGaming-specific warranties include: the gaming licence is valid, in good standing, and has no conditions that have not been disclosed; there are no outstanding regulatory investigations, enforcement actions, or compliance breaches; the financial statements accurately represent the business’s performance; all material contracts are valid and enforceable; there are no outstanding employment claims or disputes; the player data is owned by the entity and held in compliance with applicable data protection law; and there has been no material adverse change in the business since the last set of accounts provided to the buyer.

Q: How does a buyer access player data during due diligence without violating GDPR?

Player data for due diligence purposes must be provided in a GDPR-compliant format — typically anonymised or pseudonymised, with personal identifiers removed and replaced with player IDs. The buyer receives the commercial and behavioural data (deposit history, activity frequency, bonus usage, LTV cohorts) without accessing the personal data that would require a legal basis for processing. Full player data transfer occurs post-closing under a data processing agreement that satisfies the applicable data protection framework for the relevant jurisdiction.

Q: Should a buyer engage a specialist iGaming due diligence advisor or rely on a general M&A advisor?

For iGaming-specific workstreams — regulatory review, player database analysis, affiliate programme compliance assessment, and platform provider agreement review — specialist iGaming expertise is essential. A general M&A advisor or law firm without iGaming sector experience will miss items that are standard knowledge for specialists. The regulatory correspondence file review, RNG certification check, and responsible gambling compliance assessment all require familiarity with the specific frameworks of each licensing jurisdiction — knowledge that is not transferable from other regulated sectors.

Q: What happens if the seller fails to disclose a material fact during due diligence?

Failure to disclose a material fact that the seller knew or should have known is a breach of the disclosure obligations in the SPA, giving the buyer remedies that may include: price reduction, specific indemnification for losses arising from the undisclosed matter, or in extreme cases, rescission of the transaction. The enforceability of these remedies depends on the SPA’s warranty and indemnity provisions, the governing law, and the quality of the disclosure process. Warranty and indemnity (W&I) insurance, increasingly available for mid-market iGaming transactions, can protect buyers against the risk of undisclosed liabilities that the seller does not have the resources to compensate.

Q: How does CasinosBroker coordinate due diligence for buyers?

CasinosBroker manages the due diligence process as a standard component of our buy-side advisory mandate. This includes establishing the data room structure and requesting seller documentation, coordinating financial, commercial, technical, legal, and regulatory advisors to ensure workstreams run concurrently rather than sequentially, identifying and escalating material findings to the buyer promptly, and advising on the commercial implications of due diligence findings for price and structure. Our specialist iGaming knowledge means we can conduct the iGaming-specific workstreams — regulatory file review, player database analysis, affiliate programme assessment — directly rather than delegating to generalist advisors who lack sector experience.