What is iGaming software?
iGaming software is the full technology stack that runs a real money online casino or sportsbook: the game servers that produce outcomes, the player account platform that holds balances and session state, the payment layer that moves money, and the compliance and security systems that keep all of it inside regulatory rules. No single vendor’s product is “the software.” A live casino in Michigan or New Jersey is usually a dozen integrated systems talking to each other over APIs, several hundred milliseconds at a time.
That’s the part outsiders get wrong. People picture a game. Operators are actually buying a distributed transaction system that happens to render slot reels on the front end.
Core components of the iGaming stack
Four layers do the heavy lifting:
- Game engine / Remote Game Server (RGS) — hosts the game logic and the random number generator, calculates each round’s result, and reports bets and wins back to the wallet. The game client in the browser is presentation; the RGS is the authority on outcomes.
- Platform management (PAM) — the player account management system. Registration, KYC status, wallet, bonuses, limits, self-exclusion flags, game lobby, reporting. This is the operator’s system of record.
- Payment processing — payment gateway connections, tokenized card storage, ACH and pay-by-bank rails, cashier logic, withdrawal approval workflows.
- Compliance and security — geolocation, age and identity verification, AML monitoring, responsible gaming triggers, regulatory reporting feeds, audit logging.
Around those sit the things that make an operation commercially viable: a CRM and bonus engine, a BI and data warehouse layer, and affiliate tracking.
Frontend vs backend systems
The frontend is the casino your player sees: lobby, cashier, game client, account pages, usually a responsive web app plus native iOS and Android wrappers. Modern game clients are HTML5 and WebGL, which is why the same slot runs on desktop and phone without separate builds.
The backend holds everything that must be trusted: wallet balances, bet history, RNG, bonus state, KYC records. A well built platform assumes the client is hostile. Every wager is validated server side, and the frontend never decides an outcome or a balance. When a player’s connection drops mid spin, the RGS still resolves the round and the wallet still settles it, which is why interrupted games can be recovered from a server log.
How iGaming platforms work: the complete system
An iGaming platform works by orchestrating a chain of authenticated API calls: the player registers and is verified, the platform issues a session, the session launches a game on a provider’s RGS, and every bet and win in that game hits the platform wallet in real time while compliance systems watch the whole flow.
Player registration and KYC flow
In regulated US markets, sign up is a compliance event, not a form fill. A typical sequence:
- Registration — the player submits name, address, date of birth, last four of SSN, and contact details to the PAM.
- Identity and age verification — the PAM calls an identity vendor that matches the record against credit header and public data. Most jurisdictions require confirmation the player is 21 or older for casino play.
- Screening — checks against state self-exclusion lists, sanctions and PEP lists, and duplicate account detection.
- Geolocation — a geolocation service (GeoComply is the dominant vendor in US iGaming) confirms the device is physically inside the licensed state before any wager is accepted, then rechecks periodically during the session.
- Account state — verified accounts get full deposit and withdrawal rights. Pending or failed checks are usually held in a restricted state where play or cashout is blocked until documents are reviewed manually.
Where automated matching fails, the flow falls back to document upload with liveness checks. Operators care about the pass rate here because every manual review costs money and drops conversions.
Game launch and session management
When a player clicks a game, the PAM generates a short lived token and redirects the client to the provider’s game URL with that token, the player’s currency, jurisdiction, language, and return URL. The RGS calls back to the operator’s wallet API to authenticate the token and read the balance. From there each spin is a debit call and, if there’s a win, a credit call.
Two wallet models exist. A seamless wallet keeps one balance in the PAM and has the RGS call it for every transaction, which is now the standard because it avoids fund transfers and reconciliation headaches. A transfer wallet moves money into the provider’s own wallet on launch and back on exit. Seamless integration means the provider must handle timeouts, retries, and idempotent transaction IDs correctly, otherwise you get double debits.
Real-time data processing
Every round generates events: bet, win, bonus contribution, jackpot ticket, responsible gaming counters, fraud signals. Platforms stream these into a data layer so several systems can react at once. Bonus engines decrement wagering requirements as bets settle. Responsible gaming modules track deposit, loss, and session limits and can cut a session off when a player hits a self imposed cap. AML monitoring flags unusual deposit and withdrawal patterns. Regulatory reporting jobs aggregate handle and gross gaming revenue for state filings.
The engineering constraint is latency plus durability. A wallet call that takes too long stalls the spin; a wallet call that gets lost creates a financial discrepancy an auditor will find. This is why regulators care so much about transaction logging and why platform certifications spend so much time on it.
Game providers vs aggregators vs platform providers
These three get used interchangeably in sales decks, and they shouldn’t be. Studios make games. Aggregators distribute other people’s games through one integration. Platform providers run the casino itself.
| Type | What it supplies | Integration effort | Examples |
|---|---|---|---|
| Game studio / provider | Individual games, RNG and math models, hosted on its own RGS | One integration per studio, unless reached via an aggregator | Light & Wonder, IGT, Pragmatic Play, Play’n GO, Evolution (live dealer), NetEnt, Everi, AGS |
| Casino game aggregator | A single API exposing hundreds or thousands of titles from many studios, plus unified reporting and free round tools | One integration, then games enabled by configuration | Pariplay Fusion, Relax Gaming’s distribution platform, EveryMatrix CasinoEngine, Hub88, SoftSwiss Game Aggregator |
| Platform provider (PAM / turnkey) | Player accounts, wallet, cashier, bonus engine, CMS, reporting, often bundled content and payments | Largest project; core system of record | Playtech, GAN, Bragg Gaming, EveryMatrix, SoftSwiss, White Hat Gaming |
Game development studios
A studio’s product is math plus art plus an RGS. Its commercial model is almost always revenue share on the net gaming revenue its games generate. For a US operator, the practical question about any studio isn’t how good the games look, it’s whether those specific titles are approved in the states you hold licenses in. A game certified for New Jersey isn’t automatically live in Pennsylvania or Michigan.
Content aggregation services
An aggregator’s value is arithmetic: one API integration instead of forty. You also get consistent game metadata, one reporting format, and cross provider bonus tools like free rounds. The trade off is a thin margin layered on top of the studio’s revenue share, less direct commercial leverage with the studio, and a dependency, because if the aggregator’s service degrades, a large slice of your lobby goes down at once.
Full platform solutions
Operators generally pick one of three routes. A white label means running under someone else’s license and brand shell, fastest to market and least control, and largely not available in US regulated markets where the license holder must be the operator. A turnkey solution means licensing a complete platform while holding your own license. In house builds give full control of roadmap and data but require an engineering team plus the certification burden that comes with it.
RNG certification and fairness testing
RNG certification is an independent laboratory’s confirmation that a game’s random number generator produces statistically random, unpredictable, and unbiased outcomes, and that the game pays out at the theoretical return to player it claims. The lab reviews source code and entropy sources, then runs large scale statistical testing on the output.
How RNG technology works
A modern casino RNG is a cryptographically secure pseudorandom generator seeded from a hardware or high entropy source. Each round it produces numbers that are mapped to reel positions, card values, or wheel results. Two properties matter: outcomes must be unpredictable even with knowledge of prior results, and each round must be independent. Independence is the reason “hot” and “cold” games don’t exist. A slot that hasn’t paid in 200 spins has exactly the same odds on spin 201.
Certification also verifies the game’s math. If a slot is built to 96% RTP, the house edge is 4%, and that 4% is what the operator earns over millions of rounds. It is a long run average, not a session promise, and it does not change because a player is up or down. Volatility describes how the returns are distributed, not how much comes back.
Certification bodies and standards
The main independent test labs in this space are Gaming Laboratories International (GLI), BMM Testlabs, eCOGRA, and iTech Labs. Labs are typically accredited to ISO/IEC 17025 and test against published technical standards, most notably GLI’s standards series, of which GLI-19 covers interactive gaming systems, alongside each state regulator’s own technical requirements. Statistical testing commonly draws on recognized public test suites such as NIST’s statistical test suite for random number generators, plus chi square, runs, and serial correlation analysis.
| Scope of testing | What the lab checks |
|---|---|
| RNG | Entropy source, seeding, scaling, statistical randomness and independence of outcomes |
| Game math | Theoretical RTP matches the paytable and the submitted math model |
| Platform / system | Wallet accuracy, transaction logging, game recovery, bonus handling, reporting |
| Controls | Change management, version control, that only certified builds reach production |
For a deeper walkthrough of how randomness and fairness are verified, see our explainer on RNG and game fairness.
Ongoing compliance monitoring
Certification isn’t a one time badge. Labs issue a certificate tied to a specific software version and its hash, so any code change to a certified component generally requires re-submission. Regulators may also require periodic RTP monitoring, incident reporting, and system audits, and operators keep their own reconciliation reports comparing platform data against provider data daily. Discrepancies get investigated, not smoothed over. Our overview of gaming regulatory compliance covers the reporting side in more detail.
Payment integration and financial systems
Payments are where an otherwise solid iGaming solution most often disappoints, because US gaming transactions get declined at rates card issuers wouldn’t tolerate in other verticals. The fix is redundancy: multiple gateways, multiple rails, and smart routing.
Payment gateway architecture
The cashier sits inside the PAM and talks to a payment orchestration layer that routes each transaction to one of several processors. Card data is tokenized and never stored by the operator, keeping the environment inside PCI DSS scope limits. Typical US rails include debit and credit cards, ACH and pay-by-bank, e-wallets like PayPal and Skrill, prepaid gaming cards, cash at retail options such as PayNearMe, and on property cage deposits for operators tied to a land based casino. Multi currency and multi jurisdiction support matters as soon as you cross state or national borders, since each market has its own approved methods and settlement rules.
Withdrawals need their own workflow: KYC completed, source of funds checks where required, bonus and wagering conditions resolved, and an approval queue with limits on who can release large amounts. Payout speed is a competitive feature, and it’s usually a process problem, not a rails problem.
Fraud prevention systems
Common attack patterns are bonus abuse through duplicate accounts, stolen card testing, chargeback fraud, collusion in multiplayer games, and money laundering through low edge play. Defences layer device fingerprinting, velocity rules, geolocation and IP intelligence, payment risk scoring, and manual review by a risk team. Deposit and withdrawal pattern analysis feeds AML monitoring, which is where the compliance and payment stacks converge.
Regulatory compliance for payments
Licensed US operators build payment controls around a written AML program, transaction monitoring, and suspicious activity reporting obligations under the Bank Secrecy Act as applied to their license type, plus each state regulator’s requirements on segregating player funds and reporting. Practically, that means every deposit and withdrawal must be attributable to a verified player, reconstructable from logs, and reportable on demand. If you want the player facing view of these rails, see our guide to casino payment methods.
Choosing the right iGaming technology stack
Evaluate vendors on certification coverage, integration model, and operational track record before you look at the game lobby. A beautiful lobby you can’t get certified in your target state is worth nothing.
Technical requirements checklist
- Existing certifications and live licences in the states or countries you’re targeting.
- Seamless wallet support with idempotent transaction handling and documented timeout behaviour.
- Documented, versioned REST APIs plus a sandbox you can test against before signing.
- Published uptime commitments, incident history, and a real escalation path.
- Raw data access: can you export bet level data into your own warehouse, or are you stuck with vendor dashboards?
- Responsible gaming tooling built in: deposit, loss and session limits, cool off, self exclusion, reality checks.
- Bonus engine flexibility, including per game weighting and wagering requirement configuration.
- Exit terms: data portability and contract length, because platform migrations are painful and you will consider one eventually.
Cost structure models
Most commercial models combine some of the following, and the mix matters more than any single number:
- Revenue share on gross or net gaming revenue, standard for content and turnkey platforms.
- Monthly minimum or licence fee, which protects the vendor when volumes are low and hurts you at launch.
- One off setup and integration fees for onboarding and custom work.
- Per event or per transaction fees for KYC checks, geolocation pings, and payment processing.
- Certification and testing costs, which are usually billed separately per jurisdiction and per submission.
Model total cost against a realistic revenue ramp, not a best case one. Stacked revenue shares (aggregator on top of studio, platform on top of both) compress margins quickly.
Integration timeline expectations
Timelines vary widely, and the software is rarely the bottleneck. Enabling extra titles through an aggregator you’re already connected to can be a configuration task. Adding a new studio directly is a development project. Launching a new brand in a regulated US state depends on licensing, lab testing, and regulator sign off, which typically runs in months rather than weeks and isn’t something a vendor can compress by promising a faster sprint. Build the certification and approval windows into the plan from day one and sequence the technical work around them.
FAQ
What is iGaming software?
It’s the integrated technology stack behind a real money gambling site: game servers with certified RNGs, a player account management platform holding wallets and session state, payment processing, and the compliance and security systems handling KYC, geolocation, AML and responsible gaming.
How does an iGaming platform work?
The platform verifies and registers the player, issues a session token, launches games on provider game servers, and processes every bet and win through a central wallet in real time while compliance and reporting systems consume the same event stream.
What is an iGaming provider?
It depends on what they sell. Game providers (studios) build and host individual games. Casino game aggregators distribute many studios’ games through one API. Platform providers supply the player account, wallet, and cashier systems the operator runs the business on.
How is RNG fairness certified?
An accredited independent lab such as GLI, BMM Testlabs, eCOGRA or iTech Labs reviews the RNG source code and entropy source, runs large scale statistical randomness testing, confirms the game’s theoretical RTP matches its math model, and issues a certificate tied to a specific software version.
Gambling carries a built in house edge and negative expected value over time. Operators and platform vendors have a duty to make deposit, loss and session limits, cool off and self exclusion tools easy to find and use. In the US, help is available through the National Council on Problem Gambling helpline, 1-800-GAMBLER.