Understanding UKGC B2B Licensing

The UKGC distinguishes between several B2B licence categories. The most relevant for iGaming platform providers is the licence to manufacture or supply gambling software. This covers the core platform software, game content, and technical services that operators use to provide gambling to their customers.

MicroBee holds a UKGC B2B licence under account number 79852, which authorises the supply of sportsbook, casino, and platform software to UKGC-licensed operators. This licence requires ongoing compliance with the Gambling Commission's Licence Conditions and Codes of Practice (LCCP) and Remote Technical Standards (RTS).

Remote Technical Standards (RTS)

The UKGC's Remote Technical Standards are the primary technical compliance framework for B2B providers. The RTS document specifies requirements across multiple domains. These standards are not aspirational guidelines — they are enforceable requirements tied to the licence.

RTS 1: System and Network Security

Platform providers must implement security measures appropriate to the scale and nature of their operations. Specific requirements include protection against unauthorised access to systems processing gambling transactions, network segmentation between gambling systems and non-gambling business systems, intrusion detection and prevention systems with active monitoring, regular penetration testing by qualified independent assessors, and documented incident response procedures.

The UKGC does not prescribe specific security technologies but requires that the measures implemented are demonstrably effective and regularly tested. Platform providers must maintain evidence of security testing and make it available to the Commission on request.

RTS 2: Software Development and Testing

All gambling software supplied to UKGC-licensed operators must follow documented software development lifecycle processes. Requirements include version control for all production software, documented testing procedures including unit testing, integration testing, and user acceptance testing, change management processes that prevent unauthorised modifications to live systems, and rollback capabilities for failed deployments.

The critical requirement is traceability — the ability to demonstrate, for any version of software running in production, the complete chain from development through testing to deployment. This traceability must extend to third-party components, including game content from aggregated providers.

RTS 3: Game and Event Rules

B2B providers must ensure that the rules of every game or betting event are clearly displayed to the customer before participation. For casino games, this means RTP must be published and accurate to the stated figure, game rules must be accessible from within the game interface, and the outcome of each game round must be determined fairly and randomly (verified through independent testing).

For sportsbook platforms, event rules must cover settlement criteria, void conditions, and dispute resolution procedures for every market type offered.

RTS 4: Random Number Generation

This standard mandates that all RNG implementations used in games supplied to UKGC-licensed operators must be tested and certified by a UKGC-approved testing house. The RNG must produce output that is statistically independent and uniformly distributed, unpredictable (no pattern can be identified that would allow prediction of future outputs), and non-reproducible (the same seed does not produce the same output sequence).

Testing must be conducted on the production implementation — not on a theoretical specification. If the same game is deployed in different technical environments (different servers, different hosting configurations), each environment may require separate testing.

RTS 5: Information Display and Interaction

Players must be shown accurate, real-time information about their gambling activity. Requirements include current balance displayed at all times during active gambling sessions, clear display of stake amounts before bets are confirmed, game history accessible for a minimum of 90 days, and time spent gambling displayed or accessible during sessions.

For B2B providers, this means the platform must support these display requirements natively. If the operator's front-end interface does not display the required information, the B2B provider shares regulatory responsibility for the deficiency.

RTS 6: Gambling Transaction Records

Every gambling transaction must be recorded in a manner that prevents alteration and supports regulatory audit. The transaction log must include the date and time of each transaction, the customer account identifier, the type of transaction (bet, win, deposit, withdrawal, bonus), the amount and currency, and the game or event identifier.

Transaction records must be retained for a minimum period specified by the Commission and must be available for inspection. The storage system must prevent retroactive modification — the UKGC requires an immutable audit trail.

RTS 7: Financial Controls

B2B platforms that handle customer funds on behalf of operators must implement controls that protect customer balances. This includes segregation of customer funds from operational funds, reconciliation procedures to ensure platform records match actual balances, and limits on dormant account handling (including notification procedures before funds are forfeited).

Responsible Gambling Technical Requirements

The UKGC places significant emphasis on responsible gambling tools, and B2B providers are explicitly expected to build these capabilities into their platforms. The platform must support operator implementation of the following.

Player-Set Limits

The platform must allow players to set deposit limits (daily, weekly, monthly), loss limits, session time limits, and reality check notifications at configurable intervals. These limits must be enforceable across all products — a deposit limit set by a player must apply to their total deposits across casino, sportsbook, and any other vertical, not per-product.

Critically, limit decreases must take effect immediately, while limit increases must be subject to a cooling-off period (typically 24 hours for daily limits, 7 days for weekly limits). The platform must enforce this asymmetry.

Self-Exclusion

The platform must support self-exclusion periods of 6 months, 1 year, 2 years, 5 years, or permanent. During self-exclusion, the player must be unable to access any gambling product, must not receive marketing communications, and must not appear in any CRM campaign targeting. The platform must integrate with GAMSTOP, the UK's national self-exclusion scheme, to enforce cross-operator exclusion.

Activity Monitoring

The platform should provide operators with tools to identify potentially harmful gambling behaviour. This includes algorithms or rule-based systems that flag players exhibiting risk indicators such as significant increases in deposit frequency or amount, extended session durations, chasing behaviour (increasing bets after losses), and use of multiple payment methods within short timeframes.

The UKGC has increasingly focused on the adequacy of operator interaction with at-risk customers, and B2B providers whose platforms lack the data and tooling for these interactions share regulatory scrutiny.

Data Protection and GDPR

B2B providers processing personal data of UK-based customers must comply with UK GDPR (the UK's post-Brexit adaptation of the EU General Data Protection Regulation). Platform compliance requirements include data processing agreements with all operators defining the provider's role (typically data processor), data minimisation (collecting only the personal data necessary for platform operations), data subject access request (DSAR) handling capabilities, breach notification procedures (72-hour notification to the operator, who is the data controller), and data retention policies aligned with both UKGC record-keeping requirements and GDPR minimisation principles.

The tension between UKGC requirements (retain transaction records for regulatory purposes) and GDPR requirements (do not retain personal data longer than necessary) must be resolved through clear retention policies that satisfy both frameworks.

Reporting Obligations

UKGC-licensed B2B providers have ongoing reporting obligations to the Commission. These include key event reporting (significant system failures, security breaches, regulatory findings in other jurisdictions), annual returns detailing the operators served and the products supplied, suspicious activity reports where the provider becomes aware of potential money laundering or terrorist financing, and changes to corporate structure, key personnel, or ownership.

Failure to report key events on time is itself a compliance breach — and the UKGC has issued sanctions specifically for late reporting, independent of the underlying event.

Compliance Audit and Enforcement

The UKGC conducts compliance assessments of B2B licensees, which may be announced or unannounced. Assessments examine technical compliance with RTS, corporate governance and management competency, financial stability, anti-money laundering controls, and responsible gambling tool implementation.

The Commission's enforcement toolkit includes informal actions (advice letters, warning letters), regulatory settlements (agreed remedial actions with potential financial penalties), licence review (adding conditions to the licence), financial penalties (which can be substantial — multi-million pound fines are not uncommon for serious B2C breaches), and licence revocation (in the most serious cases).

For B2B providers, the reputational impact of UKGC enforcement action extends far beyond the UK market. Other regulators monitor UKGC enforcement decisions, and a finding against a B2B provider can trigger compliance reviews in Malta, Gibraltar, Isle of Man, and other jurisdictions where the provider holds licences.

Practical Compliance Checklist for B2B Providers

Operators evaluating B2B platform providers for the UK market should verify the following.

The provider holds a current UKGC B2B licence (verify at the Gambling Commission's public register). The platform's RNG has been certified by a UKGC-approved testing house within the required period. The platform supports all required player-facing information displays (balance, stake, game history, time played). Responsible gambling tools (limits, self-exclusion, GAMSTOP integration) are built into the platform, not bolted on. Transaction logging is immutable and retains records for the required period. Data processing agreements are in place covering UK GDPR requirements. The provider has documented incident response and key event reporting procedures.

MicroBee's UKGC licence (account 79852) has been maintained through continuous compliance since award. The platform is built to meet RTS requirements natively — responsible gambling tools, transaction logging, game certification tracking, and data protection controls are embedded in the core architecture, not afterthoughts added for regulatory inspections. Combined with MGA licensing (MGA/B2B/203/2016) and 12 years of operational experience across 50+ jurisdictions, MicroBee's compliance infrastructure is designed for the most demanding regulatory environments in global iGaming.

Related Reading

• Licensed Sportsbook Platform: Jurisdiction Guide and Licensing Support

• RNG Certification and Fairness Testing: What B2B Casino Operators Must Know

• Betting Platform Security: Essential Features and Provider Comparison

• Gaming Platform Provider Selection: The Ultimate 50-Point Checklist