Two of Europe’s most influential gambling regulators – the Malta Gaming Authority (MGA) and the UK Gambling Commission (UKGC) – have each tightened their technical compliance frameworks in the past twelve months, with the most consequential API audit requirements taking effect between June and September 2026. Operators holding licences in either jurisdiction face new documentation standards, mandatory real-time monitoring architecture, stricter payment-API verification deadlines, and an accelerated enforcement posture backed by £26 million in new UK government funding. This analysis unpacks every material change, compares the two regimes side by side, and maps the corrective actions that software vendors and compliance teams must implement before the 30 September 2026 deadline.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Why 2026 Is a Regulatory Inflection Point for Casino APIs
The Policy Pressure Behind the 2026 Push
The dual UKGC–MGA tightening is not coincidental. Both regulators have been responding to the same underlying pressures: a post-pandemic expansion of online gambling volumes, mounting public and parliamentary criticism of gambling harms, and a wave of enforcement actions that revealed systematic weaknesses in operator API architecture. The UKGC’s review of remote gambling technical standards found recurring failures in three specific API domains: deposit-limit enforcement, age-verification callbacks, and real-time responsible-gambling (RG) trigger delivery. Regulators concluded that the technical standards – not just operator conduct – needed structural upgrades. That process began earlier than most operators realise: the UKGC’s Remote Technical Standards (RTS) required that any security audit conducted after 1 November 2024 follow the version aligned to the 2022 baseline, with every relevant licensee obligated to have completed an audit against that standard by 31 October 2025 – the foundation the 2026 changes build directly on top of. The Commission’s RTS guidance page, last refreshed in March 2026, continues to set out the compliance timing and testing-procedure requirements that remote gambling and software licence holders must follow.
For the MGA, the driver was increased supply-chain fragmentation. A single MGA licensee in 2026 typically integrates 30 to 60 third-party APIs covering game content delivery, KYC identity verification, payment orchestration, affiliate tracking, anti-fraud screening, and RG monitoring. Each integration point is a compliance surface that a legacy framework – designed for monolithic platforms – could not reliably audit.
How £26 Million in Extra Enforcement Funding Changes the Stakes
In early 2026, the UK Government confirmed an additional £26 million in enforcement funding for the Gambling Commission, specifically directed at intensifying action against non-compliant operators – including those breaching technical standards rather than just advertising or AML rules. Andrew Rhodes, the UKGC’s Chief Executive, has made clear in public statements that technical non-compliance, including inadequate API audit trails, is now treated with the same seriousness as AML failures. “The technical standards exist to protect consumers at the system level,” Rhodes stated at a compliance industry forum in February 2026. “Where we find API-layer breaches – deposit limits not enforced, audit trails missing, age-verification callbacks bypassed – we will act.” For licensed operators, this shifts the calculus: a missed security audit or an undocumented API change is no longer a back-office administrative lapse. It is a licence-risk event.
UKGC Technical Standards Update: June 2026 Changes
The Deposit Limit Terminology Mandate
The most structurally significant API change in the UKGC’s June 2026 technical standards update concerns deposit limits. Effective 30 September 2026, only gross deposit limits – those applied to the total value of funds deposited, regardless of withdrawal activity – may be called “deposit limits” in operator systems, including API parameter naming conventions, player-facing API response labels, and CRM data fields. Net limits, where the deposit cap adjusts based on prior withdrawals, must carry a different label in both the UI and the underlying API schema.
The practical implication is that operators must audit every API endpoint that reads, sets, or enforces a deposit limit and verify that parameter labels and response payloads match the new terminology standard. Any third-party integration – wallet providers, payment orchestrators, affiliate tracking APIs – that surfaces a "deposit_limit" field must also comply. From 30 June 2026, the Gambling Commission began using “Deposit Limit” exclusively for gross limits in all official technical communications, with the full operator obligation kicking in on 30 September 2026.
Gross Deposit Limit API Prominence Requirements
The June 2026 update also requires that gross deposit limits be offered with at least equal prominence to all other financial limits in the API’s self-exclusion and limit-setting responses. This is an architectural requirement, not merely a UI guideline: the ordering of fields in JSON response payloads, the default parameter pre-selected in SDK limit-setting widgets, and the sequence in which limits are presented during onboarding flows must all reflect this prominence rule. Operators that use third-party responsible-gambling APIs – such as those from BetBlocker, GamCare-integrated platforms, or in-house RG engines – must validate that their vendor’s API responses also meet the UKGC prominence standard before September 30.
Mixed-Product Bonus Prohibition and Payment API Implications
Effective in 2026, the UKGC prohibits mixed-product bonuses: operators may no longer require sports wagers to unlock casino or slots bonuses, and vice versa. This prohibition has a direct API audit dimension – bonus eligibility APIs and promotion-engine APIs must be audited to confirm that cross-product conditions have been removed from their logic. Any hardcoded cross-product bonus trigger discovered during a UKGC technical audit constitutes a standards breach, regardless of whether the promotion was ever activated for a real player account.
The 6-Month Onboarding Audit Window and 7-Day Submission Rule
What “Within 6 Months” Actually Means for New Licensees
The UKGC requires newly licensed remote operators to submit their first security audit within six months of the date the licence is granted. This timeline applies to the complete independent security audit – covering all API layers, not just the player-facing frontend – and is non-negotiable regardless of platform readiness or third-party integration complexity. Operators launching on white-label platforms must confirm with their platform provider that audit evidence covering all shared API infrastructure will be available within the six-month window, not just the operator-specific components – a requirement that will carry extra weight once the Commission’s dedicated shared-account audits, expected to begin in December 2026, start examining exactly this kind of pooled infrastructure across multiple licensees on the same platform.
The six-month rule has caught several operators off-guard in the 2025–2026 licensing cycle because it includes API dependencies that are often not fully documented at launch. Platform providers delivering white-label casino infrastructure must maintain audit-ready API documentation that licensees can incorporate by reference into their own compliance submission.
The 7-Day Report Submission Window
Once an annual security audit is completed by an independent auditor, the operator has exactly seven calendar days to email the full audit report to the UKGC. Critically, the Commission’s security audit guidance makes clear that the seven-day window begins from the audit’s stated due date, not the actual completion date – meaning that if an audit runs two weeks past its scheduled finish, the submission window has already closed. Operators must build internal compliance calendars that schedule the audit to complete at least two to three weeks before the due date to absorb delays and still submit on time.
UKGC Security Audit Scope: What the API Layer Must Cover
Network, Database, and Application Security Domains
The UKGC’s security audit framework explicitly requires coverage across four technical layers: network infrastructure, database security, operating system controls, and gambling-application security – where APIs sit. The gambling-application layer includes all API endpoints exposed to players, affiliates, third-party integrators, and internal microservices – industry commentary on the 2026 update specifically names KYC callback handling, payment-orchestration APIs, RNG integration, and responsible-gambling trigger delivery as the domains auditors are expected to scrutinise most closely. Mandatory evidence areas include: reviews of penetration testing results, vulnerability assessments, software change records, backup verification procedures, staff interview findings, and training records related to API security practices.
For operators using third-party KYC APIs, the audit must verify that those API integrations – including identity-verification callback mechanisms, document upload endpoints, and watchlist-screening webhooks – are subject to the same security controls as internal systems. Operators evaluating iGaming KYC API vendors should confirm that each provider’s APIs are covered under the vendor’s own audit documentation, which can then be incorporated by reference into the UKGC submission.
Penetration Testing: Frequency, Scope, and Evidence Format
Independent penetration testing is not merely a recommended practice under the UKGC’s 2026 framework – it is a mandatory component of the annual security audit evidence pack. The test must cover all externally accessible API endpoints, authentication and session management mechanisms, token handling, and any third-party integration points. UKGC auditors review penetration test reports directly and follow up on any outstanding remediation items during the audit process.
The 2026 guidance also standardises how penetration test findings are documented within the audit report. Each finding must follow a four-field format:
- Finding – a precise description of what was discovered
- Objective Evidence – the specific technical proof (log entries, API responses, screen captures)
- Consequence – the risk or regulatory implication of the finding
- Corrective Action – the remediation taken or planned, with a target date
This format applies to all audit findings, not just penetration test results, but it is especially important for API security discoveries where the technical evidence may otherwise be opaque to a non-specialist regulatory reviewer.
MGA Technical Compliance Framework: 2025–2026 Revisions
The 60-Day Platform Change Notification Window
The Malta Gaming Authority has revised its Technical Compliance Framework to establish a clearer obligation around platform changes. When an operator or platform provider makes a significant change to the live environment – including changes to RNG integration APIs, payment processing APIs, or player account management systems – the change must be notified to the MGA, with full rollout expected to be completed within 60 days of that notification. Undisclosed significant API changes, particularly those affecting game integrity, financial controls, or player protection systems, are now explicitly categorised as potential grounds for regulatory action, up to and including licence suspension. A narrower but related obligation applies to affiliate infrastructure: the MGA requires operators to give at least 14 calendar days’ notice before switching over affiliate-tracking systems, a shorter window than the general 60-day platform-change rule that reflects the more contained blast radius of affiliate-API migrations.
The definition of “significant” is intentionally broad and includes: changes to API authentication mechanisms, modifications to RNG seed sources or certification parameters, additions of new payment method integrations, and updates to age-verification or self-exclusion API flows. Operators that use CI/CD pipelines must ensure that their deployment processes include a regulatory-change-impact assessment step that triggers the 60-day notification workflow where relevant changes are detected.
Structured Evidence Packs and Defined Submission Formats
The MGA’s 2025–2026 framework revision introduces a stronger emphasis on the structure and format of technical documentation submitted as part of compliance audits. Rather than accepting loosely organised evidence packs, the MGA now requires documentation to follow a defined structure with supporting evidence in clearly labelled, standardised formats – codified through a revised system-audit checklist that is now split into four distinct variants (B2C, B2C with DLT, B2B, and B2B Software), each specifying the evidence structure applicable to that licence category. For API audits, this means that API specification documents (OpenAPI/Swagger files), integration test results, security scan outputs, and third-party audit reports must each be presented in a standardised layout that explicitly references the specific MGA technical requirement each piece of evidence addresses.
The practical impact is significant: operators who previously submitted narrative architecture descriptions – relying on an auditor’s familiarity with the platform – must now produce machine-readable API documentation that can be independently verified against the MGA compliance checklist. The MGA’s 2026 audit outcomes framework has also moved beyond binary pass/fail verdicts. Findings are now classified as:
- Compliant – requirement fully met
- Resolved during audit – issue identified and fixed before the audit concluded
- Corrective Action Required with defined timeframe – a structured remediation path with a regulatory deadline
MGA vs UKGC Casino API Audit Requirements: Side-by-Side
| Requirement | UKGC (2026) | MGA (2025–2026) |
|---|---|---|
| Audit frequency | Annual (mandatory) | Annual + triggered by significant change |
| First audit deadline (new licences) | Within 6 months of licence grant | Before live launch |
| Report submission window | 7 calendar days from due date | Within agreed remediation period |
| Auditor independence | Must be external (fully independent) | External or approved internal audit function |
| API change notification | Not codified (ad hoc) | 60-day full rollout window from MGA notification |
| Penetration testing | Mandatory annual evidence required | Required at significant change or annually |
| Finding documentation format | Finding / Evidence / Consequence / Corrective Action | Structured evidence pack in defined formats |
| RNG audit requirement | Covered under gambling-application security layer | Verified against original certified configuration; GLI/BMM accepted |
| Real-time monitoring | Backup and recording evidence required | Fraud + RG triggers must be flagged in real time with timestamped logs |
| Deposit limit API mandate | Gross only labelled “Deposit Limit” by 30 Sept 2026 | Financial controls verified at audit against live configuration |
| Enforcement backing (2026) | £26M additional UK government funding | Licence suspension/revocation powers |
| Non-compliance classification | Breach → formal enforcement action | Compliant / Resolved during audit / CAN with deadline |
Payment API Audits Under the 30 September 2026 Deadline
What the Gross Deposit Limit Change Requires at the API Layer
The 30 September 2026 UKGC deposit-limit deadline is primarily a consumer protection measure, but its API implications are substantial. Every operator must audit and potentially rewrite the API layer that handles deposit-limit configuration, retrieval, and enforcement. Specifically, any API endpoint that accepts or returns a deposit_limit parameter must be updated to distinguish between gross and net limits – either by renaming parameters or by returning structured response objects with explicit type fields, such as: For broader market context, see our coverage of best sweepstakes casino sites.
{
"limit_type": "gross",
"limit_value": 500,
"currency": "GBP",
"period": "monthly"
}The UKGC has indicated it will verify compliance through technical audits of operator systems rather than relying solely on player-facing UI checks. Any discrepancy between what a player sees and what the underlying API returns will be treated as a finding.
Third-Party Payment Integration Audit Obligations
The UKGC’s security audit scope extends fully to third-party payment API integrations. Operators cannot exclude external payment provider APIs from the audit on the grounds that the provider holds its own PCI DSS or ISO certifications. The audit must verify that the operator’s implementation of the payment API – the authentication tokens, the deposit-limit enforcement hooks, the callback validation logic – is itself compliant with UKGC technical standards. This includes confirming that deposit-limit enforcement callbacks fire correctly in all failure scenarios and that failed or declined payments cannot silently bypass limit controls. Operators selecting a licensed gambling payment processor should verify that the provider’s API documentation explicitly covers UKGC deposit-limit callback requirements before integration.
Slot Stake Caps and API-Layer Verification
The UKGC’s 2026 stake limits – £2 per spin for players aged 18–24 and £5 per spin for players aged 25 and over – create a direct API verification requirement. Operator game-launch APIs and game-configuration APIs must return stake parameters that conform to the age-verified player profile on record. The audit must confirm that the age-verification API response is correctly consumed by the game-configuration API and that no game session can be launched with out-of-range stake parameters for the player’s verified age group.
Penetration testing must include test cases where age-verification API responses are manipulated or replayed – for example, by substituting an over-25 response for an under-25 account – to confirm that stake caps cannot be bypassed via API parameter injection or session manipulation. Any system where the stake-cap enforcement logic resides solely in the frontend (rather than being enforced server-side via the game-launch API) will fail this test.
RNG Certification in the API Audit Stack
MGA’s Verification Against Original Certified Configuration
Under the MGA’s revised framework, technical auditors verify that the live casino environment – including all API integrations connected to the Random Number Generator – matches the configuration documented in the original certification application. This matters because RNG certification is obtained for a specific API integration version. If the operator has updated its game API, changed its RNG seed endpoint, modified entropy sources, or added a new game delivery CDN since the original certification was granted, the live environment may no longer match the certified state.
Gaming Laboratories International (GLI) standards – particularly GLI-19 for online gaming systems – specify requirements for RNG API logging, seed management APIs, game result recording interfaces, and the audit trail format for each spin or game outcome. BMM Testlabs applies equivalent requirements under its own framework. Operators reviewing their RNG certification options for licensed casinos should confirm that their chosen testing lab provides an API-layer configuration audit as part of the certification scope – not just statistical black-box testing of RNG outputs.
ISO 27001:2022 as the API Security Baseline
Both the MGA and UKGC compliance frameworks increasingly reference ISO 27001:2022 – the international information security management standard updated in 2022 – as the baseline for API security controls. ISO 27001:2022 introduced a dedicated control category for cloud services and API security (Annex A, Control 8.24 and related controls), making it more directly applicable to iGaming API infrastructure than the 2013 predecessor. The UKGC has mirrored that emphasis domestically: its updated RTS added a new dedicated control, numbered 5.23, covering cloud services specifically, a change the Commission confirmed through its “We Asked, You Said, We Did” consultation feedback process. Operators that hold an ISO 27001:2022 certification can use their Statement of Applicability and annual surveillance audit reports as supporting evidence in both MGA and UKGC security audit submissions, potentially reducing the documentation workload by eliminating duplicate evidence collection for overlapping control domains.
Real-Time Monitoring as a Mandatory Audit Category
MGA’s Real-Time Fraud and RG Trigger Requirements
One of the clearest signals from the MGA’s 2025–2026 framework revision is the elevation of real-time monitoring from best practice to an auditable first-class requirement. The framework now explicitly states that fraud triggers and responsible-gambling alerts must be flagged in real time, and that the platform must generate detailed, timestamped audit trails for every player action and financial transaction. This is not a reporting requirement – it is an architectural requirement that affects how APIs are designed, what data they must persist, and what latency guarantees the monitoring pipeline must provide.
In practice, audit reviewers will look for evidence that the monitoring API – whether in-house or from a third-party provider – is receiving and processing events with minimal latency, that alert thresholds are documented in version-controlled configuration files rather than hardcoded values, and that alert dispatch logs are retained for the full regulatory retention period. Any measurable gap between a triggering event timestamp and the alert dispatch timestamp in the API logs will be raised as a finding requiring explanation.
Audit Trail API Requirements Under Both Frameworks
The UKGC’s security audit guidance similarly requires evidence that backup and recording systems covering all game transactions are functioning correctly. For API-driven systems, the audit must verify that all API responses for financial transactions are logged, that logs are tamper-evident (ideally via cryptographic chaining or write-once storage), and that the log retrieval API meets the Commission’s evidence production standards. Operators using event-streaming architectures such as Apache Kafka or AWS Kinesis must demonstrate that the streaming pipeline’s API has appropriate durability guarantees – specifically that acknowledged writes cannot be lost – and that this is documented in the audit evidence. Carl Brincat, MGA CEO, framed the authority’s position in April 2026 guidance: “Platform complexity has grown dramatically. Our revised framework reflects the reality that regulatory-grade compliance cannot stop at the operator’s own codebase – it must extend to every API that touches player protection or financial integrity.”
Technical Documentation: The New Evidence Submission Standard
From Narrative Descriptions to Machine-Readable API Specs
Both regulators have signalled a decisive shift from accepting narrative architecture descriptions to requiring structured, machine-readable technical documentation. For the UKGC, penetration test reports, vulnerability assessments, and software change records must be submitted in formats that an independent auditor can verify against live system logs – not just as written summaries. For the MGA, the 2026 framework explicitly requires OpenAPI 3.1 specification files, integration test result exports, and security scan outputs in defined formats, each explicitly referencing the MGA technical requirement they address. For broader market context, see our coverage of leading online casino sites.
Paul Cranston, a senior compliance director at GRC Solutions Group who advises MGA and UKGC licensees, notes the significance of the four-field finding format: “The Finding / Objective Evidence / Consequence / Corrective Action structure sounds administratively simple, but it forces auditors and operators to move from vague descriptive language to verifiable technical evidence. That’s a significant upgrade for API security specifically, where the previous weakness was findings described in ways that couldn’t be independently confirmed or reproduced.”
Tools and Practices for Compliant API Documentation
Operators that have historically relied on verbal explanations or high-level architecture diagrams during audit interviews will need to invest in API documentation tooling ahead of their next audit cycle. Standard practices for MGA- and UKGC-compliant API documentation include:
- Maintaining OpenAPI 3.1 specification files in version control, with each version tagged to the deployment it describes
- Exporting API integration test results from tools such as Postman or Newman in machine-readable JSON format
- Running automated API security scans via OWASP ZAP or Burp Suite Enterprise and archiving scan reports with each release
- Maintaining an API change log that maps each change to whether it constitutes a “significant change” under MGA criteria
From the testing lab side, a GLI technical bulletin issued in March 2026 warned that increased audits are finding mismatches between the live API configuration and the certified configuration: “The certification is for a specific integration state, not a generic algorithm. If your game API has changed since certification, the certified state no longer matches the live environment, and that is a compliance gap that statistical RNG testing alone cannot resolve.”
The 2026 Compliance Deadline Timeline
| Date | Requirement | Regulator | API Impact |
|---|---|---|---|
| 30 June 2026 | UKGC uses “Deposit Limit” exclusively for gross limits in official comms | UKGC | Begin API parameter schema audit and update planning |
| Ongoing 2026 | Annual independent security audit + 7-day report submission | UKGC | All API layers in scope; missing the submission window = breach |
| Within 6 months of licence grant | First security audit for new licensees | UKGC | API documentation must be audit-ready at or before launch |
| Within 60 days of notification | Significant platform API changes fully rolled out | MGA | Triggers full or partial technical audit review |
| 30 September 2026 | Gross deposit limits labelled “Deposit Limit” in all operator systems | UKGC | Payment API parameter names and response schemas must be updated |
| 30 September 2026 | Gross deposit limits must have equal prominence in API responses | UKGC | JSON field ordering and SDK widget defaults must reflect this |
| Ongoing 2026+ | Real-time fraud + RG trigger monitoring with timestamped logs | MGA | Monitoring API must deliver near-instant alert dispatch with auditable retention |
| Ongoing 2026+ | ISO 27001:2022 alignment for API security controls | MGA + UKGC | API security evidence must map to the 2022 control set |
Beyond the Standard Coverage: What Most API Audit Analysis Misses
Most published analysis of the 2026 MGA/UKGC changes focuses on player-facing consumer protection measures – stake limits, bonus restrictions, self-exclusion – without addressing the API-layer compliance obligations that flow from those policy changes. The following dimensions receive almost no coverage in competitor analysis or standard compliance guides.
The 7-day clock starts at the due date, not completion. Most compliance resources describe the UKGC’s annual audit requirement without clarifying that the seven-day submission window is anchored to the audit’s scheduled due date. If an audit overruns by two weeks, the submission window has already closed before the report exists. This requires operators to build an internal scheduling buffer of at least two to three weeks between the planned completion date and the regulatory due date.
Schema-level API changes are within UKGC scope. Standard coverage focuses on architectural changes – replacing a KYC provider, adding a payment method – but the UKGC’s 30 September 2026 deposit-limit change requires auditing and potentially renaming individual API parameters. A deposit_limit field that returns a net value without explicit type labelling is a breach at the schema level, even if the player-facing UI displays the correct gross-only label.
MGA’s 60-day window may apply to cumulative CI/CD changes. Continuous deployment pipelines that push incremental changes to payment-processing or RNG-connected APIs can cumulatively constitute a “significant change” under the MGA framework, even if no single deployment is individually material. Operators with active CI/CD workflows need a formal policy for aggregating deployment impact over rolling windows and triggering the notification workflow when the accumulated change crosses the threshold.
Real-time monitoring has an implicit latency standard. While neither regulator has published a specific millisecond threshold, the MGA’s “real-time” language creates an auditable benchmark. Log timestamps that show a consistent multi-minute gap between a triggering event and alert dispatch will draw a finding. Building a latency SLA into the monitoring API contract – even informally – provides defensible evidence during an audit review and demonstrates architectural intent.
Expert Predictions: What Comes After 2026
Three Forward Predictions for Casino API Regulation Through 2027
Based on the trajectory of the 2025–2026 changes and the direction of regulatory language in both frameworks, three shifts are likely to materialise in the 2027 compliance cycle.
1. Machine-readable API compliance evidence will become formally mandatory. Both regulators are moving toward structured, verifiable evidence submission. The most logical next step is requiring OpenAPI specification files as a named component of the annual audit submission pack, rather than treating them as optional supporting documents. Operators that build this practice now will have a structural advantage when the requirement becomes mandatory.
2. Third-party API providers will need their own regulatory certifications. As regulators trace compliance failures to third-party integrations, pressure will shift upstream to KYC, payment, and RNG API vendors to obtain regulatory approvals or certifications independently – analogous to PCI DSS certification requirements in the payments industry. The MGA’s 60-day change notification window is an early form of this extended accountability chain. Operators should begin requiring contractual API-compliance guarantees from critical third-party vendors now. The broader RegTech KYC consolidation underway in 2026 may accelerate this, as larger vendors absorb compliance certification costs more efficiently than smaller specialists.
3. Real-time monitoring SLAs will acquire explicit numerical latency standards. The MGA’s current “real-time” language is qualitative. Within two to three regulatory cycles, expect both regulators to publish specific latency thresholds – likely in the range of 200 to 500 milliseconds for fraud trigger dispatch – that become auditable performance benchmarks. Operators whose monitoring architectures cannot meet a 500ms SLA will face both a compliance exposure and a competitive disadvantage when the standard becomes explicit.
Frequently Asked Questions
What is the UKGC’s deadline for the new deposit-limit API requirements?
The full implementation deadline is 30 September 2026. From that date, only gross deposit limits may be called “deposit limits” in operator systems, including API parameter names and JSON response schemas. The UKGC began using this terminology exclusively in official communications from 30 June 2026.
How often must a UKGC-licensed operator submit a security audit?
Annually. New licensees must submit their first audit within six months of licence grant. The full audit report must be emailed to the Gambling Commission within seven calendar days of the audit’s scheduled due date – not the completion date.
Does the MGA require annual security audits like the UKGC?
The MGA requires annual technical compliance audits and additionally triggers a review when an operator or platform provider makes a significant change to the live environment. The full rollout of any notified significant change must be completed within 60 days of the notification to the MGA.
What does “independent auditor” mean under UKGC rules?
The security audit must be conducted by an organisation or individual genuinely independent of the operator – not an internal team, a related party, or the operator’s own software vendor. The auditor must have full access to all API layers, not just frontend or player-facing systems.
What API documentation does the MGA require in 2026?
The MGA’s 2025–2026 framework revision requires structured documentation in defined formats. For API audits, this typically means OpenAPI 3.1 specification files, integration test result exports in machine-readable format, and security scan outputs – each explicitly referencing the MGA technical requirement they address.
Are third-party KYC and payment APIs within scope of UKGC security audits?
Yes. The UKGC’s security audit scope covers all API integrations that affect player protection or financial controls, including third-party KYC callback mechanisms, payment-processing APIs, and RG monitoring integrations. Operators cannot exclude external APIs on the basis that the provider holds its own certifications.
What are the UKGC’s 2026 slot stake caps, and how do they affect API design?
The UKGC has set stake limits of £2 per spin for players aged 18–24 and £5 per spin for players aged 25 and over. Game-launch APIs must consume the verified player age from the KYC API response and enforce the applicable cap server-side. Penetration testing must confirm that stake-cap parameters cannot be bypassed via API injection or session replay attacks.
What happens if an MGA operator deploys a significant API change without notifying the regulator?
Under the MGA’s revised Technical Compliance Framework, significant platform changes deployed without prior notification can trigger regulatory action, including suspension of the affected API or the imposition of additional licence conditions requiring a retrospective technical audit. Operators using CI/CD pipelines need a formal internal policy for assessing whether cumulative deployment activity constitutes a “significant change” under the MGA definition.
