iGaming Due Diligence Checklist for Buyers and Sellers

The short answer

Due diligence on an iGaming business is the buyer’s check that the revenue, licence, players and traffic described in the CIM are real, and that they will survive a change of owner. It starts once an LOI is signed. For a small affiliate site it can take two weeks; for a licensed operator with its own payments stack, four to eight weeks is more realistic.

Generic business-sale checklists ask for leases, equipment lists and stock counts. An online casino has none of those. Its value sits in things a third party can switch off: a licence held by a regulator, payment accounts held by PSPs, a platform contract held by a provider, and rankings held by Google.

Good iGaming diligence tests each of those dependencies, not just the P&L. Below is the checklist we work through on casino, sportsbook and affiliate deals, grouped into seven areas. Not every line applies to every asset: an affiliate site has no player wallet, and a white-label casino does not own its licence. We note where that matters.

When diligence happens, and what is shared at each stage

Information is released in layers. A seller who hands over back-office access before an NDA, or player data before closing, takes a risk that brings nothing in return.

Two rules keep this safe. Read-only accounts should be time-limited and removed if the deal stops. Individual player data moves only when there is a lawful basis to transfer it, which usually means at or after closing.

1. Licence and regulatory

The licence is usually the largest single driver of value and the item most likely to fail to transfer. Start here, because a negative answer ends the deal before any other work is wasted.

• Licence number, holding entity, jurisdiction, issue date and renewal date, checked against the regulator’s public register
• Who actually holds it: the seller’s own licence, a white-label provider’s licence, or a sub-licence. With a white label, the buyer is acquiring a brand and a contract, not a licence
• Change-of-control rules: whether a share sale needs prior approval or only notification, fit-and-proper checks on the new owners, and the realistic timeline
• Compliance history for the last three years: regulator correspondence, warnings, fines, licence conditions, audit reports
• Licensed markets against where deposits actually come from. Revenue from markets outside the licence scope is a risk, and buyers usually discount it
• AML and responsible gambling policies, and who holds the MLRO and compliance roles
• Game and RNG certification, or the aggregator’s certification if content is supplied through one
• Regulatory changes announced in the key markets that could affect revenue after closing

Jurisdiction matters. A UKGC or MGA licence held by the selling company generally stays with that company, so it only travels in a share deal, and then with the regulator’s approval. Curaçao licences now sit under the post-2023 LOK regime, so check whether the licence is a new direct licence or a legacy arrangement. Rules change often; confirm the current position with the regulator or local counsel before relying on it.

2. Financials: reconcile GGR and NGR to source

Every revenue figure in the CIM should tie to three independent sources: the platform’s back-office reports, the PSP settlement statements and the bank statements. When all three agree, the numbers are credible. When they don’t, the buyer will assume the worst until the gap is explained.

GGR is stakes minus winnings. NGR is GGR minus bonus cost and, depending on the definition used, payment fees, provider fees and gaming taxes. Definitions differ between platforms and contracts, so the CIM should say exactly which deductions are included.

• Monthly GGR, NGR, deposits and withdrawals for 24 months (36 if available), split by product (casino, live, sports) and by market
• Back-office export for the same period, reconciled month by month to the P&L
• Bonus cost as a share of GGR by month. Watch for promotions cut shortly before a sale, which flatters NGR for a few months
• Sportsbook margin by month. One strong month can distort a trailing-twelve-month figure
• Chargeback and refund rates by PSP, and any rolling reserves held
• Platform or white-label fees, game provider fees, affiliate commissions and gaming taxes. Revenue-share commissions owed to affiliates continue after the sale
• Player balances owed at closing, and how those funds are held
• Evidence for every add-back used to reach SDE or EBITDA
• For affiliate assets: revenue by operator programme, the programme payment reports, and their reconciliation to the bank. Note the revenue-share and CPA split, and any negative carryover

The output of this section is a normalised earnings figure the buyer believes. That is the number the multiple is applied to, which is why it gets more attention than anything else.

3. Players, KYC/AML and data

For an operator, the player base is the business. The buyer needs to know how many players are really active, how much revenue rests on a few of them, and whether the database can legally move to a new owner.

• Depositing active players and first-time depositors by month, with retention cohorts
• Lifetime value by acquisition channel, so cost of acquisition can be judged against it
• Concentration: the share of GGR from the top 10 players and the top 1%. Heavy VIP dependency is one of the most common reasons for a price cut
• KYC completion rates, unverified accounts holding balances, and source-of-funds checks on high depositors
• Self-exclusion and responsible gambling tools, open player complaints and ADR cases
• Lawful basis for transferring the database. For EU players this is a GDPR question, so check what the privacy policy says about a sale of the business
• Marketing consents for email and SMS. A list without valid opt-ins may not be usable by the buyer

Dormant players have some value for reactivation, but buyers rarely pay much for them. Price the business on active players and treat the dormant base as upside.

4. Payments stack

Payment accounts rarely move with the business automatically. Most PSPs treat a new owner as a new merchant and run onboarding again, and some review the account after a share sale too. A business that cannot take deposits on day one after closing has lost most of its value.

• Every PSP and payment method in use, by market, with contract terms and fees as a share of deposits
• Whether each account can be assigned, or whether the buyer must onboard from scratch, and how long that takes
• Rolling reserves held by each PSP, and whether they are released to the seller or passed to the buyer
• Concentration: how much of deposit volume runs through a single PSP
• Account closures, frozen funds or disputes in the last three years
• For crypto: which wallets and custody providers are used, how balances will transfer, and on-chain verification of the volumes claimed

5. Platform, technology and contracts

The platform model decides what the buyer actually owns. With its own platform, the buyer acquires code and infrastructure. With a turnkey or white-label setup, the buyer acquires a contract, and that contract’s assignment and change-of-control clauses can make or break the deal.

• Platform model: own technology, turnkey, or white label
• For white label and turnkey: contract term, assignment and change-of-control clauses, termination rights, revenue share, and who owns the player data and the domain
• Game provider and aggregator agreements, and whether providers must approve the new owner
• For own technology: source code ownership, IP assignments from every developer and contractor, open-source licences, documentation and hosting
• Domains: registrar, registered owner, expiry dates; trademarks for the brand
• Security: incidents in the last three years, penetration tests, access controls
• Third-party tools such as CRM, KYC provider, affiliate software and email platform, and whether each can be transferred
• People: who runs the business day to day, which roles depend on the owner, and who will stay after closing

6. Traffic and marketing

For an affiliate site, traffic is the asset. For an operator, it is the cost line that decides whether growth is profitable. Both need checking against the source data, not against screenshots.

Affiliate assets

• Read-only Search Console and Analytics access for at least 24 months, with traffic by country, page and query
• Traffic plotted against the dates of Google core and spam updates, to see how the site reacts to each
• Manual actions in Search Console, and a backlink review for paid links, private blog networks and toxic domains
• Content: who writes it, how it is produced, and when it was last updated
• Revenue concentration by operator and by page
• Operator programme terms: whether accounts can be transferred, or whether the buyer must open new ones. Revenue-share players tracked to the old account may not move

Operators

• Acquisition by channel (affiliates, paid, organic, CRM) with cost per first-time depositor
• Affiliate agreements that continue after the sale, and commissions owed at closing
• Bonus and promotion terms checked against the licence’s marketing rules
• Ownership of social media accounts and email lists

7. Legal and corporate

What this section covers depends on the deal structure. In a share deal the buyer inherits the company’s history, so the corporate and tax work is deeper. In an asset deal the key document is the exact list of what is being transferred and what stays behind.

• Share deal: incorporation documents, share register, UBO register, board minutes, existing shareholder agreements
• Asset deal: a schedule listing every domain, database, content library, contract and IP right being transferred, and what stays with the seller (often the licence)
• Litigation, player disputes, regulator proceedings and tax audits, current or threatened
• Tax: gaming tax filings, corporate tax returns, VAT on B2B services, and where any historic liability sits after closing
• Liens, pledges or security over the shares or assets
• Employment and contractor agreements, including IP assignment and confidentiality clauses
• Existing broker mandates or exclusivity arrangements that could create a competing fee claim

Tax treatment, licence transfer and the choice between share and asset deal all need a lawyer or tax adviser in the relevant jurisdiction. We give the commercial view; they confirm the legal one.

Preparing for due diligence as a seller

The best time to run diligence on your own business is before the teaser goes out. Problems you find yourself can be fixed or explained on your terms. Problems the buyer finds become price reductions.

1. Build the data room before marketing starts, with folders that mirror the seven areas above.
2. Run your own reconciliation of platform, P&L, PSP and bank figures, and write a short note explaining every material variance.
3. Document each add-back with invoices or statements, so the normalised earnings figure holds up.
4. Ask your licence holder, white-label provider, PSPs, game providers and affiliate programmes how they handle a change of owner. Get written answers where you can.
5. Set up read-only accounts for the back office, Search Console and Analytics, ready to switch on after the LOI.
6. Name one person to answer diligence questions, and aim to reply within 48 hours.

The issues that most often stall or end iGaming deals at this stage:

• Revenue figures that do not tie to PSP and bank statements
• A traffic drop, Google penalty or algorithm hit that was not disclosed
• Revenue from markets the licence does not cover
• A licence, white-label contract or PSP account that will not transfer, or a change of control the regulator does not approve
• A PSP closing the account during the process
• Revenue concentrated in a handful of players or a single operator

Our median time from signed mandate to closing is 90 days, and a data room that is ready on the day the LOI is signed is one of the things that keeps a deal on that timeline. If you want an outside view before going to market, our due diligence service runs this checklist on your business first.

FAQ

How long does due diligence take on an online casino?

Usually four to eight weeks for a licensed operator, and as little as two weeks for a small affiliate site. The main variables are how quickly the seller supplies documents and how long PSPs and licence holders take to confirm their position on a change of owner.

What is the difference between GGR and NGR in due diligence?

GGR is stakes minus winnings. NGR deducts bonus cost and, depending on the definition, payment fees, provider fees and gaming taxes. Buyers value on a normalised NGR or earnings figure, so the deductions must be stated and reconciled.

Can a buyer see my player database before closing?

The buyer should see aggregated player data, such as actives, cohorts, LTV and concentration, after the LOI. Individual player records should move only at or after closing, and only where there is a lawful basis to transfer them.

Does a white-label casino licence transfer to the buyer?

No. The licence belongs to the white-label provider. The buyer takes over the brand and the white-label contract, which only works if the provider agrees to the change of owner.

Who pays for due diligence?

Each side pays its own advisers. The buyer pays for its lawyers, accountants and technical reviewers; the seller pays for preparing the data room and any pre-sale review.

What happens if due diligence finds a problem?

The usual options are a price adjustment, a change of structure (more paid through escrow, a holdback or an earnout), a specific indemnity in the purchase agreement, or the buyer walking away. Problems disclosed early are far cheaper to resolve than problems found by the buyer.

Prefer Telegram? Join iGaming professionals on @igamingdealflow