How to Choose an iGaming Platform Provider: 8 Criteria to Score

Every platform demo looks great, and every account manager says yes to everything. The gaps show up after signing: the "24/7 support" that's a chat window nobody answers after 6pm CET, the 99.9% uptime that turns out to be a target rather than a contract term, the exit clause that needs 12 months' notice. iGamingHub tracks 44 platforms (September 2026), and the spread between them on the things that matter is wide. Of those 44, 26 sell an API-first integration, only 5 let you run your own frontend, 23 publish an uptime SLA, and 30 price on revenue share.

Last reviewed: September 2026

Below are the eight criteria to score a platform on, in the order they usually kill a deal, each with the questions to ask, the pass bar, the red flag, and what the catalogue data shows. The summary matrix and weighting table at the end turn it into a shortlist score.

Contents

1. Licences and markets
2. Architecture: API-first and headless
3. Content and aggregation
4. Payments
5. Uptime SLA and support
6. Commercial model: revshare, hybrid or fixed
7. Migration and lock-in
8. Compliance tooling
9. Summary matrix
10. How to score a shortlist

Licences and markets

Start here because nothing else matters if the answer is wrong. A platform vendor needs a B2B supplier authorisation in every regulated jurisdiction you plan to serve. If the vendor doesn't hold one from your target regulator, you can't legally run on their stack there, however good the product is. The Malta Gaming Authority issues a separate Critical Gaming Supply licence for exactly this, the UK Gambling Commission requires a gambling software licence from anyone supplying remote gambling software, and Curaçao's reformed regime under the Curaçao Gaming Authority now expects B2B suppliers to register in their own right. The glossary entry on supplier licences covers the mechanics.

Two different questions hide inside "are you licensed":

• Does the vendor hold the supplier authorisation itself? That's what lets you use their software under your own operator licence, the turnkey model.
• Can the vendor operate you under their licence? That's the white-label model, where you're a skin on their approval and their compliance function. Cheaper and faster, but you don't own the licence relationship and can't take it with you.

In the iGamingHub catalog, Brazil is now the most frequently listed authorisation (25 of 44 platforms), ahead of MGA (23) and Curaçao (20), which tells you how fast vendors have chased the SPA market since federal licensing opened. Only five list UKGC: BetConstruct, Digitain, Pariplay, Gamingtec and Trueigtech. Nine list at least one North American approval (New Jersey, Pennsylvania, Michigan, Ontario and others), a group led by Amelco, White Hat Gaming, Oryx, Bragg and Aristocrat Interactive. If your plan says "Europe now, US later", you're often looking at two vendors, not one.

Questions to ask. Which regulator issued your supplier authorisation, and what's the licence number? Which of your live operators run under it in my target market? If I move from your licence to my own later, what changes in the contract?

Pass bar. A verifiable authorisation number in each of your launch markets, plus at least one named operator reference there.

Red flag. "We support that jurisdiction" without a licence number. Support is not authorisation. A vendor that blurs the two is asking you to carry compliance risk they haven't priced.

Architecture: API-first and headless

Five years ago, buying a platform meant buying a bundle: player accounts, wallet, game lobby, CMS and a frontend that looked suspiciously like every other site on the same vendor. Today the serious conversations start with the wallet API, the game launch API and the bonus API, and increasingly the operator declines the vendor's frontend altogether. That's the headless model, and whether a vendor can genuinely deliver it is now a selection criterion on its own.

The terms get muddled, so here's the split. API-first means the platform exposes its core functions through documented APIs you can build against, even if you keep the vendor's frontend. Headless goes further: the vendor runs everything stateful and regulated (PAM, wallet ledger, KYC status, bonus engine, game transactions, reporting) and you build and own everything the player sees. Modular describes the backend, with PAM, bonusing, aggregation and payments as separately swappable services, which is the subject of the modular PAM guide. The strongest 2026 stacks are modular behind the API and headless in front of it, but you can adopt either without the other.

An operator consuming a headless platform works with four API families:

• Player and session APIs: registration, login, profile, responsible gambling settings, session tokens your frontend passes to games.
• Wallet APIs: balance reads, deposits, withdrawals, history. This is the ledger of record. Your frontend never holds money state, it renders it.
• Game APIs: lobby catalogue feeds, launch URLs, jackpot tickers, tournament state. Behind these sit the aggregation layer and each studio's remote game server.
• Marketing APIs: bonus balances, free spin grants, loyalty points, segmentation hooks for your CRM.

Slots were always "headless": a Pragmatic Play or Hacksaw title runs on the studio's own RGS inside an iframe. What changes is everything around the iframe. In a bundled platform the vendor's lobby decides how games are discovered and ranked; in a headless setup your frontend calls the aggregator catalogue API and applies its own ranking. Same games, far more control over merchandising, one of the few levers that genuinely moves casino revenue. Wallet pattern matters too: serious headless deployments use a single-wallet API, one ledger for every game session, not transfer wallets that shuttle funds to each provider.

Why operators are moving this way. Content is commoditised: your competitor has the same 30,000-plus games and the same Evolution tables, so differentiation has become a frontend problem. On a bundled platform your registration-flow test ships when the vendor's release train ships, often quarterly; a headless team deploys daily. Multi-brand groups get one backend contract and N frontends, and real localisation (mobile-money cashiers, PIX-first deposits, right-to-left layouts) needs structural frontend changes, not string files. The proof point at the top of the market is KingMakers, the group behind BetKing, which runs its own frontend and product layer on EveryMatrix's CasinoEngine, a deal SBC News covered when it went live.

What the catalog shows. Of the 44 platforms, 26 are flagged API-first, but only 5 are flagged as supporting a fully operator-owned frontend: SOFTSWISS, EveryMatrix, GR8 Tech, Amelco and Kambi. The other 21 API-first vendors, including NuxGame, Slotegrator, BetConstruct and Digitain, expose APIs you can integrate against but expect you to run their frontend or a customised version of it. Plenty of vendors have bolted "API-first" onto products that are still bundles with an API tacked on, so the flag starts the conversation rather than ending it. The SOFTSWISS vs EveryMatrix comparison goes deeper on the two most-cited headless stacks.

The honest trade-off. Headless doesn't remove frontend work, it transfers it to you, permanently. A realistic minimum team for a single-brand headless frontend is 4 to 8 people (frontend engineers, a backend-for-frontend engineer for the orchestration layer, design, QA, a product owner who understands casino UX), roughly €300K to €700K a year in payroll before tooling. The first production build against a well-documented API typically runs three to six months and about €150K to €400K. Those are market estimates, not vendor quotes. Below roughly €500K monthly GGR, that payroll eats the margin differentiation was supposed to create, and a bundled turnkey with a customisable template is the better call. First-time operators should launch bundled and treat headless as a graduation; if your edge is affiliates, bonusing or local payment access rather than product, a bespoke frontend is an expensive vanity project.

Questions to ask. Can I see the full API documentation and a sandbox before signing? Which features of your own frontend run on private APIs you don't expose? Is the wallet single-ledger across every studio? Does pricing change if I drop your frontend?

Pass bar. API docs, a working sandbox, single-wallet coverage for every integrated studio, and an SLA on API uptime and latency written into the contract.

Red flag. "API-first" in the deck but no sandbox access until after the contract is signed.

Content and aggregation

Content drives GGR. Players come for slots, live tables and crash games, not the platform UI, and a thin library shows up as churn within weeks. The question isn't "how many games" but how the content reaches you and on what terms.

There are two supply routes. The vendor either runs its own aggregator with direct studio contracts, or resells a third-party aggregation feed. The difference shows up in which studios are actually live for your licence and market, how fast new releases go live, and what margin sits between the studio's price and yours. A platform that routes everything through a single aggregator with no direct studio relationships has weaker terms, and that flows straight into the game-side revenue share you pay. The aggregator comparison covers the standalone hubs in detail.

Catalogue library sizes vary enormously: BetConstruct lists around 45,000 titles, SOFTSWISS and Slotegrator around 40,000, Digitain about 23,500, NuxGame about 17,500 and Hub88 about 12,000. All are vendor-reported and include duplicates across studios, so treat them as an order of magnitude. Forty of the 44 platforms list a sportsbook, 31 list live casino and 15 list crash games. What matters more than the headline count:

• Tier-one coverage for your market. Evolution for live casino is effectively non-negotiable. Pragmatic Play, Play'n GO, Nolimit City and Hacksaw are the studios players search for by name.
• Certified for your jurisdiction. "Integrated" doesn't mean certified for Ontario, Sweden or Brazil. Ask for the per-market list.
• Release lag. A week between a studio's launch and the game going live on your lobby is good; a quarter means the vendor batches integrations.
• Extra integration fees. Some vendors charge per studio activation on top of the platform fee. Get the list in writing.

Questions to ask. How many studios are direct contracts versus sub-aggregated? What's the game-side revenue share, and does it differ by studio? Which studios are certified for each of my launch markets?

Pass bar. Direct contracts with the top-ten studios for your market, a per-jurisdiction certification list, and a single blended content revenue share you can model.

Red flag. The vendor can't tell you which studios are sub-aggregated. Either they don't know their own supply chain or they'd rather you didn't.

Payments

Payment acceptance rate sets your conversion rate more directly than any lobby design. A 10-point gain in card acceptance is worth more than most bonus campaigns, and it's decided by the acquirers, local methods and fraud tools the platform brings.

Look for at least three acquiring relationships on different banking rails, because high-risk acquirers get switched off without warning. Local methods for each launch market are non-negotiable: PIX in Brazil, UPI in India, mobile money across Africa, Interac in Canada, iDEAL in the Netherlands. Crypto rails (BTC, ETH, USDT at minimum) matter in grey markets and increasingly in regulated ones; 25 of the 44 platforms list crypto support. Fraud scoring should be integrated or at least pluggable.

Vendor-reported payment-method counts in the catalogue run from 4 to about 500: BetConstruct lists about 500, SOFTSWISS about 200, EveryMatrix about 180, GR8 Tech and Pronet Gaming about 160, SoftGamings and Slotegrator about 150. A big number isn't the goal; coverage of your market is. Pronet Gaming's Africa-first positioning around mobile money is worth more to a Nigerian operator than a 500-method list built for Europe.

The hidden cost is the markup. Many platforms sit between you and the PSP and add 1 to 2 percentage points to the merchant discount rate without disclosing it. Ask for the actual MDR you'll pay by method and market, and ask whether you can bring your own PSP contracts. A vendor who won't answer the first is hiding the markup; a vendor who says no to the second is telling you payments are a profit centre for them.

Questions to ask. What's your average card acceptance rate across operators in my market? Which acquirers do you work with, and what happens when one drops us? Do you mark up processing fees above cost? Can I integrate my own PSP?

Pass bar. Three-plus acquirers, every local method your launch market needs, disclosed MDR by method, and the right to bring your own PSP.

Red flag. Undisclosed processing markup. It compounds on every transaction for the life of the contract.

Uptime SLA and support

A casino that goes down at 22:00 on a Saturday during a live jackpot loses real money every minute, and the players who hit the error page don't come back. The question isn't whether the vendor says "high availability" but what the contract promises and what it costs them to miss it.

Get the arithmetic straight: 99.5% availability allows almost 44 hours of downtime a year, 99.9% about 8.8 hours, 99.95% about 4.4 hours, 99.99% under an hour. A vendor quoting 99.5% is telling you a working day and a half of outages a year is acceptable to them.

What the catalog shows. Twenty-three of the 44 platforms publish an uptime SLA; 21 don't. Among those that do:

• 99.999%: SOFTSWISS
• 99.99%: Groovetech, Sportradar
• 99.96%: GR8 Tech
• 99.95%: EveryMatrix, Soft2Bet, Amelco, Kambi
• 99.9%: NuxGame, BetConstruct, Slotegrator, Hub88, Digitain, SoftGamings, Pariplay, Oryx Gaming, Pronet Gaming, Altenar
• 99.8%: EvenBet Gaming, Comtrade Gaming
• 99.5%: GammaStack, Salsa Technology
• 99%: Inbet Games

So 99.9% is the modal commitment, eight vendors go above it, and five sit below. Treat a published figure as the opening position. What you need in the contract: the measurement method (whose monitoring, which endpoints, whether scheduled maintenance is excluded), the penalty schedule (service credits are standard; a termination right after repeated breaches is worth negotiating), and the 12-month historical uptime log. A vendor who can't produce that log either isn't measuring or doesn't like the number. For headless deployments the SLA has to cover API latency as well as availability, because your site is now only as fast as their slowest endpoint.

Support is the other half. Thirty of the 44 platforms list 24/7 support and 21 list a dedicated account manager. Ask what "24/7" means in practice: staffed engineering escalation, or a ticket queue read in the morning? Get P1 first-response and resolution SLAs (15 minutes and 4 hours are reasonable asks), a named escalation path, and two operator references.

Questions to ask. What's your measured uptime for each of the last 12 months? How is availability measured and by whom? What's the credit for a breach, and after how many breaches can I terminate? What's the P1 first-response SLA overnight on a weekend?

Pass bar. 99.9% or better in the contract, defined measurement, financial penalties, a 12-month log, and named 24/7 escalation.

Red flag. No 12-month uptime log, or an SLA that lives in a sales deck rather than the contract.

Commercial model: revshare, hybrid or fixed

Commercial terms set your unit economics for three to five years. A five-point difference in GGR share is worth a great deal of money at scale, so this criterion deserves as much diligence as the licence.

Three models dominate:

• Revenue share. You pay a percentage of GGR or NGR, typically after content costs. Low upfront, aligned incentives, expensive at scale. Common in white-label deals, where 30% to 50% of GGR isn't unusual for a full package.
• Fixed fee. A setup fee plus a flat monthly licence, with content and payments billed separately. Predictable and cheaper once volume grows, but you carry the risk of a slow launch.
• Hybrid. A lower revenue share paired with a monthly minimum or a fixed component. Most turnkey deals with serious vendors land here.

What the catalog shows. Of the 44 platforms, 30 list revenue share as their primary model, 7 list hybrid and 7 list fixed. The hybrid group is SOFTSWISS, GR8 Tech, BetConstruct, EvenBet Gaming, Comtrade Gaming, Salsa Technology and Sportradar. The fixed group is Slotegrator, Digitain, SoftGamings, Amelco, GammaStack, Altenar and Inbet Games. The revshare list runs from EveryMatrix and Kambi down to small white-label shops, so the model alone says little about tier; it says a lot about how the vendor wants to be paid. The white-label vs turnkey cost breakdown puts numbers on the crossover point between the models.

Whatever the model, negotiate the starting share and its volume tiers, the setup fee, the minimum monthly guarantee (cap it or remove it), contract length and renewal terms, and whether the share is on GGR or NGR, because bonus cost, jackpot contributions and payment fees can move the effective rate by several points. Going headless is grounds for a share reduction, since you're no longer consuming the vendor's frontend. And if you're talking to three vendors, say so. Vendors expect it.

Questions to ask. Is the share on GGR or NGR, and what's deducted? What are the volume tiers? What's the minimum monthly, and does it apply from day one? Can the share change at renewal?

Pass bar. A written share schedule with volume tiers, a capped or waived minimum, and all content, payment and support fees itemised in one document.

Red flag. A single headline percentage with content, payment and add-on fees "to be agreed". The headline is never the number you pay.

Migration and lock-in

Your needs in year three won't match your needs at launch, so the platform has to grow with you and let you leave if it doesn't. Most operators only read the exit clauses when they're already unhappy, which is the worst time to discover a 12-month notice period.

Platform migration is expensive and risky whichever direction you go, so the first job is to reduce how much of your business is trapped:

• Data portability. You must be able to export the full player database, transaction history, KYC documents and bonus state in a documented format, with a defined cost and timeline. "We'll assist with migration" means nothing without a schedule.
• Notice periods. 90 days is fair. 12 months is a trap, and more common than you'd expect.
• Exclusivity. No clause that stops you running another brand on another platform, or using a third-party aggregator alongside the vendor's.
• Change of control. What happens to your contract if the vendor is acquired, or loses the licence you're operating under?
• Frontend ownership. If you go headless, own the code, and put an orchestration layer between your frontend and the vendor's APIs. If you switch vendors you then rewrite adapters, not the whole site.

One migration is much less scary than the others. Going headless on your existing vendor doesn't move player data; the backend, wallet ledger and accounts stay put. Audit the API surface first (bundled vendors sometimes run their own frontend on private APIs they don't expose), then route a 5% and then 20% traffic slice to the new frontend before cutting over. Six to nine months is realistic; anyone quoting three is skipping the orchestration layer. The launch timeline in how to open an online casino shows where platform selection sits in the wider sequence.

Questions to ask. What's the documented process, cost and timeline to export my full player database? What's the termination notice period? Is there any exclusivity? What happens if you're acquired or lose your licence?

Pass bar. Documented data export, 90-day notice, no exclusivity, a change-of-control clause that protects you.

Red flag. Migration "handled case by case". That means priced when you're desperate.

Compliance tooling

Compliance failures cost licences, and regulators in the UK, Ontario, Sweden and the Netherlands sanction operators for tooling gaps as much as for intent. The platform has to make compliance manageable rather than leave it to your ops team and a spreadsheet.

The minimum set:

• KYC and identity. Integrated verification (Sumsub, Jumio or equivalent) with configurable rules per market, plus the ability to bring your own provider.
• AML monitoring. Transaction monitoring with tunable thresholds, source-of-funds triggers, and case management that produces an audit trail.
• Responsible gambling. Deposit, loss and session limits, reality checks, time-outs and self-exclusion, wired to national registers where they exist (GamStop in the UK, Spelpaus in Sweden, CRUKS in the Netherlands).
• Regulatory reporting. Automated reports in the format each regulator wants, not a CSV you reformat by hand every month.
• Certification. Game certification is the studio's job, but the platform carries its own certifications and should help you through the technical audit on your licence application. Forty-one of the 44 catalogued platforms list RNG certification.

In a headless deployment this gets sharper. Responsible gambling displays, reality checks and session information live in your frontend, and in regulated markets they may need testing against local technical standards. The vendor's compliance team should be able to tell you which UI elements carry regulatory requirements per market. If they can't, they haven't shipped a headless operator into that market before.

Questions to ask. Which KYC and AML providers are integrated, and can I use mine? Which national self-exclusion registers are connected? Which regulators' reporting formats do you generate out of the box?

Pass bar. Pluggable KYC/AML, native register integrations for your markets, automated reporting, and a written per-market list of certification scope.

Red flag. Compliance described as "the operator's responsibility". It is, legally. The platform still has to give you the tools.

Summary matrix

Two tables. The first summarises what to demand on each criterion and where the 44 catalogued platforms fall. The second shows how a set of named vendors line up on the fields the catalog records; every figure comes from the vendor's listing and should be confirmed in contract.

How to score a shortlist

Take three vendors through the eight criteria and rate each 1 to 5. Weight them. The weights below reflect how often each criterion is the reason an operator replatforms within two years; adjust for your situation (a US-bound operator should move more weight to licences, a product-led group more to architecture).

Architecture gets a low weight on purpose. For most operators it's a tie-breaker, not a gate: a bundled turnkey with a customisable template beats a headless stack you can't staff. A multi-brand group with an engineering team should move it to 15% and take the weight from payments and content.

Four questions eliminate most unsuitable vendors before you build the scorecard: What's your supplier licence number in my market? What was your measured uptime each month for the last year? Can I speak to two operators you've launched there? What's the documented process and cost to export my player database? A vendor who stumbles on any of these isn't a partner, whatever the demo looked like.

Platform selection isn't procurement, it's a partnership decision. The right vendor earns more when you earn more and would rather keep you with good service than with a 12-month notice period. Ask hard questions, demand references, and read the contract with a lawyer before the account manager. The platform catalog lets you filter the 44 listed vendors by licence, market, model and integration timeline before you book the first call.