A clause is not a control: who checks what your suppliers say?
Operators keep outsourcing more of the stack while the licence stays exactly where it was. Martin Crowe, founder of Nexa Compliance, explains how to test whether supplier controls actually work, what reassuring paperwork really tells you, and why accountability cannot always be contracted out.
Between June and July 2026, the Gambling Commission published outcomes against three B2B suppliers in quick succession. Lawyers at CMS described it as a regulatory shift towards scrutiny of B2B suppliers.
On 12 June, Spribe received a warning for operating without the appropriate licence between May 2021 and October 2025, having hosted games without a host licence. On 25 June, Stakelogic agreed to pay £122,835 after 16 of its games ran faster than the 2.5 second minimum spin interval set by RTS 14D. Its timing checks had been carried out with a manual stopwatch, and the games had been offered to GB players through several licensed operators' sites. On 23 July, Evolution agreed to pay £4.75 million after the Commission found its anti-money laundering risk assessment did not adequately consider third-party risk. John Pierce, the Commission's director of enforcement, said there was "a significant gap between the controls on paper and their effectiveness in practice".
The pattern is not confined to Great Britain. In May, Ontario's regulator fined Relax Gaming and Arrise Solutions CA$40,000 each after their games appeared on unregulated sites accessible to Ontario players.
None of this moves the licence. In Great Britain, social responsibility code provision 1.1.2 makes licensees responsible for the third parties they contract with, and requires those third parties to act as if bound by the same licence conditions. Operators can outsource the platform, the aggregator, the safer gambling tool and increasingly the AI layer. The question is who checks that any of it works.
Martin Crowe is founder of Nexa Compliance, who hold named compliance and MLRO roles for licensed operators. We asked him what verification looks like in practice, and where the industry gets it right.
Paper, certificates and proof
Gaming Eminence: When an operator brings a new platform, aggregator, safer gambling tool or other third-party technology into its stack, what should it actually be doing to verify that the controls work as described?
Martin Crowe: "Start with the paper. A contract gives you legal protection, but a term in a contract is not the same as reality. In enforcement cases we've seen gaps between paper and reality many times over. People think once it's written down, you're grand. It's a step, not the only step.
Certification is a step up, because an independent party has had a look.
Then your own QA starts with understanding what the product is supposed to do in the first place. You'd be surprised how often that's missing. We asked one operator how they were getting on with account linking. "We have a third-party tool for that." Great, how does it work? Nobody could explain it. So you've paid for a black box. I went to the vendor, and the vendor wouldn't tell me either, because it's proprietary.
I understand proprietary. But if nobody can explain what it does, how do you test that it's doing it? How do you know the output is right? How do you explain your controls to a regulator? You are the licence holder. Lean on third parties all you like, but "I'll have to check with the vendor" is not an answer in an assessment.
The good news is that testing doesn't always mean new processes. It can be folded into the ones you already run. You should be doing QA on player accounts anyway. If your review finds two accounts that are obviously the same person and the linking tool never flagged it, that's your test result right there, and now you've something concrete to take back to the supplier. Some suppliers play ball with that, some don't, and how they respond tells you plenty.
And it's not one and done. Products update, people change, controls change. The operators who do this well retest, and many bring in an outside set of eyes now and again as belt and braces, because an internal function that's been told everything is fine for two years stops looking. It sounds like a boring answer, but it's the honest one."
Where the gaps open up
Gaming Eminence: Where do you see the biggest gaps between what suppliers say their technology does and what operators have independently verified? What tends to get missed?
Martin Crowe: "Most of the time the technology does exactly what it says on the tin. In most of my dealings, suppliers have been upfront and helpful.
Where it goes wrong, it's often in the workflow. I've seen a demo show slick player management, then you go live and half the processes turn out to be manual. I've watched agents reviewing a twelve-month-old player account have to pull it down month by month in separate spreadsheets: payments in one file, gambling activity in another, linked accounts on other brands downloaded all over again. You only find that by properly testing the workflows before you sign, not after. You find things by trying to break them.
Acquisitions are similar. There have been cases where skeletons were found after the fact, which affects the price and sometimes the decision. That's why buyers increasingly get someone independent to look under the bonnet before the money moves.
AI has changed the shape of it too. With rules-based tools you know what you're getting: the rules are the rules. With AI it's more of a black box, and the answer can change each time. It brings efficiency, no argument, but efficiency with more QA attached, and a human in the loop on both sides.
But the biggest gap usually isn't in the technology at all. It's between what the tool can do and what the operator can execute. A vendor says it will improve your rates by a certain amount, and it probably can, but it takes two to tango. If the setup on the operator side is a mess, no third-party software fixes that. The tool sends the alert; someone still has to act on it.
I've seen operators paying serious money for solutions they're getting half the value from, with both sides frustrated, because the operation underneath wasn't ready. That's what tends to get missed. A clean setup is in the supplier's interest as much as the operator's, because it makes the supplier's product look better too."
Evidence that reassures, and evidence that works
Gaming Eminence: What evidence should give an operator confidence that a supplier control is genuinely effective? And what can look reassuring on paper but tell you relatively little?
Martin Crowe: "It depends, but how a supplier handles your questions tells you a lot. If a supplier doesn't answer them, or evades them, that's a red flag. The ones who anticipate your questions and can point you to a clear, comprehensive FAQ, that's the green flag. Beyond that, keep the technology and the solution as simple as possible. It reduces the potential for things to go wrong and stops you becoming overly dependent on a single supplier.
There are handy ways to build that evidence without inventing new processes. Some cases go to human review anyway, so a blind comparison between what the tool concluded and what your reviewer concluded is QA you get nearly for free. If you want to know whether a tool actually changed anything, compare the period before it went in with the period after.
The paper that reassures but tells you little is everything portable: certificates, vendor attestations, demo environment results, a warranty clause. Certification tells you a version of the product passed a test somewhere, once. It says nothing about your configuration, your players, or what's changed since.
And watch vendor numbers. "Improved detection by thirty per cent" sounds great until you ask whether you're both measuring the same thing the same way. A small difference in definition makes a wild difference in results."
Who carries it when it breaks
Gaming Eminence: As operators depend more on third-party technology and automated decision-making, how should responsibility be divided when something goes wrong? Does regulatory accountability always remain with the operator?
Martin Crowe: "Generally, your licence makes you responsible for the third parties you contract with, and the contract has to bind them to behave as if they held your licence conditions. So you can contract out the activity, but not always the accountability. Recently, in the UK and Canada, we're seeing regulators apply more of that pressure on the B2B side as well.
It does vary by jurisdiction and by failure. A faulty game can sit with the B2B supplier where they're licensed for it, while the operator still carries reporting obligations and has to put the player back in the position they'd be in if the error had never happened. One, the other, or both.
In most of the jurisdictions I've worked in, the general principle is that where a game fault occurs, the player should be restored to the position they would have been in had the fault not happened. In practice, the B2C operator must make any underpaid player whole, even if that means a loss for the operator. Those obligations typically come directly from regulatory requirements that faults are rectified as soon as possible, investigated and, where applicable, reported to the regulator. It doesn't apply everywhere, as requirements vary between jurisdictions, but it's generally the approach in more tightly regulated markets.
It's not straightforward, which is exactly why incident response has to be agreed between operator and supplier before anything breaks. The worst outcome is two versions of the same story arriving at the regulator."
*Editor's note: the Stakelogic case shows the incident side in practice. The Commission's public statement lists, as aggravating factors, that the first non-compliant game stayed live for two days after discovery and that a review of the wider portfolio only followed Commission enquiries.
Robust process or paper exercise
Gaming Eminence: If you were assessing the supplier assurance practices of a large operator, what would distinguish a genuinely robust process from one that is largely a documentation exercise?
Martin Crowe: "A documentation exercise reviews documents, not realities.
I'd look at the whole life of the relationship, not just the review. Due diligence before the contract, proportionate to the risk: there's a balance between overbearing and non-existent.
Protective terms in the contract itself. Then ongoing monitoring.
That's where some operators struggle in a particular way. The same people ask the same vendors the same questions year after year. It gets monotonous, and monotony becomes assumption. Controls drift while everyone assumes they're in place.
Then separation. The people doing the work don't check their own work. The compliance team that built the controls wants the controls to look right. Internal audit is more independent, but still in the same building. External assurance sits outside all of that. It's a layer cake."
The regulator appears to have reached the same conclusion about layers. As part of its settlement, Evolution agreed to a new licence condition requiring an independent audit of its relevant policies, procedures and controls within 12 months. Assurance from outside the building is now, in at least one case, a licence requirement rather than a nice-to-have.
For operators, the practical lesson from Martin's answers is that most of the testing they need already sits inside work they do anyway: account QA, human review, before and after comparisons. The harder part is treating each supplier relationship as something that changes over time, and being able to explain every control to a regulator without phoning the vendor.
This is the first in a series with Martin Crowe on accountability as operators come to depend on suppliers and automated systems. The next instalment asks where AI should stop in player protection.
Martin Crowe is founder of Nexa Compliance (nexacompliance.io).
