What is the iGaming platform and how it works

Full article

💡 18+. The material is educational. Not a call to play. Observe the laws of your jurisdiction and the principles of responsible play.

1) Basic definition

The iGaming platform is an operating "operating system" of an online casino/bookmaker: a set of services that manages players, balance, content, payments, limits and reporting. The platform connects the front (site, applications) with the back (wallet, bonus engine, risk, KYC/AML) and external systems (game providers, payment gateways, regulators, BI).

Platform vs aggregator vs operator

Content aggregator: gives access to many game studios through a single API, but does not manage wallet/payments/CRM.

Platform: the core of operational processes (wallet, PAM, KYC, bonuses, payments, reporting), usually has integration with aggregators.

Operator: a business layer (brand, license, marketing, support) that "sits" on the platform.

2) Key modules (what "hardware under the hood")

1. PAM (Player Account Management) - registration, authorization, SSO, sessions, device/geo, segments.

2. Wallet (Wallet/Ledger) - accounts, currencies/cryptocurrencies, transactions, holds, refands, two-record accounting.

3. KYC/AML - identity verification, sanctions lists, source of funds, behavioral triggers, SAR/STR reports.

4. Payments (Cashier/PSP Orchestration) - routing via PSP, cascading in case of failures, 3-D Secure, PCI DSS.

5. Bonus engine - deposit bonus, freespins, cashback, missions, vager, game contribution, betting limits.

6. Game integrations - slots, live casinos, crash games, jackpots, tournaments, lotteries; a single Game API and catalog.

7. Commissions and affiliates - traffic tracking (CPA/RevShare/Hybrid), post-backs, anti-fraud by sub-identifiers.

8. CRM/marketing - segmentation, triggers, RFM, fluff/e-mail/SMS, personalization of the lobby.

9. RG (Responsible Gambling) - deposit/loss/time limits, timeouts, self-exclusion, reality checks.

10. Risk and anti-fraud - multi-accounts, shared devices/cards, velocity rules, chargeback defense.

11. CMS/Front Tools - showcases, industrial blocks, banners, pages, localization, A/B.

12. Reporting/Compliance - regulatory reports, tax uploads, audit logs.

13. BI/Analytics - ETL/ELT, data marts, KPI dashboards, LTV/cohorts, attribution.

14. Admin panel (Back-office) - role model, access control, activity log.

3) How the slot rate works: Step-by-step cycle

1. The player logs in (PAM/SSO), the platform captures the device and geo.

2. The deposit goes to the cashier → the orchestrator selects a PSP → 3-DS/check → the wallet is credited.

3. Launching the game: the platform creates a session-token at the provider, checks the restrictions (country/currency/age).

4. Bet: customer → provider → outcome (RNG from the provider) → response with the result and the amount of the win.

5. Settlement: the platform writes off the bet and credits the winnings to the player's account (atomic entry in the ledger).

6. Bonus rules: vager/leftovers update, max bet check, game contribution.

7. RG-control: timers, loss/time limits, reality-check → if exceeded - pause/block.

8. Antifraud: scoring sessions, behavioral anomalies (betting speed, return patterns).

9. Conclusion: request for cashout → repeated KYC/AML assessment → rooting to the payment channel.

10. Logs and analytics: events go to the bus (for example, Kafka) → storage → dashboards.

4) Architecture: what raises SLA and scale

Microservices + event bus: independent services (wallet, bonus, kyc, cashier) communicate through queues; degradation is local.

Cache/rates: Redis for sessions/limits; rate limiting against abuse.

DB patterns: transactional Postgres/Oracle for the ledger, analytical ClickHouse/BigQuery for reporting.

CDN and media: quick delivery of assets/provider demos.

Reliability: asset-asset in two regions, RTO ≤ 30 min, RPO ≤ 5 min, backups + WORM for audit.

Observability: metrics (p95 latency of wallet <150 ms), tracing, SLO alerts, audit log for each crete action.

Security: secrets in HSM/wolf, PAN tokenization, WAF/bot protection, CIS benchmarks, minimum privileges.

5) Payments and orchestration PSP

Routing by geo/bank/check of fraud scoring (selection of the converting channel itself).

Cascading failure → standby gateway without basket loss.

Smart rules: limits on method/card/amount, black/gray lists, 3-DS, velocity.

Crypt and fiat: on-ramp/off-ramp, address monitoring (risk screening), fair course, confirmation webhooks.

PCI DSS: tokenization, prohibition of storage of sensitive data on the operator side.

6) Bonuses, tournaments, jackpots

Bonus engine: states (issued/active/locked/forfeit), xN vager, game contribution, max bet/max cashout, deadlines.

Missions/quests: events (multipliers, spin series, provider missions), personalization by segment.

Jackpots: local/online, fix/progressive, transparent jackpot wallet, anti-collusion.

Tournaments: leaderboard, anti-abuse (minimum bet, cap on tickets), independent verification of results.

7) Responsible play and compliance

Player tools: deposit/loss/bet/time limits, pauses, self-exclusion, reality checks.

Monitoring: behavioral patterns of risk (long sessions, rate escalation), proactive notifications.

Juridics: age barriers, geoblocks, prohibition of offers in inaccessible jurisdictions, regulatory reports, GDPR/local analogues.

AML: sources of funds, activity peaks, transaction tracing, SAR/STR.

8) Delivery options: White Label, Turnkey, API platform

White Label: quickly start under the brand of the operator, a lot of "ready"; less flexibility/control.

Turnkey: core + free front, integration set; balance of speed and customization.

API platform: maximum flexibility, but requires a strong in-house command (prod/integration/DevOps).

9) Platform maturity metrics (what to ask on demo)

Reliability: apptime ≥ 99.95%, p95 wallet <150 ms, fault-tolerant payment cascade.

Data: near-real-time events, KPI showcases (FTD, NGR, ARPPU, Retention D1/D7/D30, LTV), export without "manual magic."

Bonuses: constructor without developers, complex scenarios, A/B tests.

KYC/AML: built-in providers, engine rule, secondary cashout checks.

Affiliates: detailed tracking, anti-fraud on sub-aidi, transparent mathematics of commissions.

RG: full set of limits and reporting on them, API for "brake lights."

Back-office UX: access rights, audit log, player/transaction search <2 sec.

10) Platform selection checklist (RFP skeleton)

1. Licenses/certifications (regulators, RNG laboratories at content providers).

2. Architecture (microservices, queues, DR plan, SLO).

3. Payments (PSP orchestration, cascade, crypt, fraud scoring).

4. Content (how many studios/game types, release speed, demo mode, provider jackpots).

5. Bonus/tournaments (flexibility of rules, restrictions, fairness, audit).

6. RG/AML/KYC (providers, reporting, real-time alerts).

7. CRM/personalization (segments, triggers, omnichannel, suppression rules).

8. BI/data (event stream, storefronts, API/export, SLA updates).

9. Back office and roles (RBAC, audit, promo change log).

10. Technical support/SLAs (release time windows, rollback, 24/7 NOC).

11. Cost of ownership (license, set-up, revshar, over-view, transaction fees/providers).

12. Roadmap and customization (SLA on feature, integration on demand).

11) Red flags

There is no separate ledger and audit log for money.

Payment waiver = "try later," no cascade.

Bonuses are edited manually in the database, there is no historization.

There are no RG limits and reality checks out of the box.

Closed analytics without exporting events.

Long releases without rollback, night downtime without a plan.

12) Platform Player Lifecycle (End-to-End)

Acquisition → Registration (PAM) → KYC (primary) → Deposit (Cashier) → Play (Game Sessions/Wallet) → Bonuses/Tournaments (Bonus Engine) → RG Checks (Limits/Reality) → Within (KYC ²/AML) → CRM (reactivation/cross-sell) → BI (LTV/cohorts) → Compliance Reports.

13) Mini glossary

RTP/Volatility - game parameters at the provider; platform verifies certification compliance.

RNG - random number generator (on the game provider side/laboratory certified).

SLO/SLA - target and contractual indicators of service quality.

ETL/ELT - loading data into storefronts/analytics.

RevShare/CPA/Hybrid - affiliate payment schemes.

The iGaming platform is the operator's "nervous system": it provides fair betting, secure payments, bonus economy, responsible play and regulatory transparency. A strong platform scales without pain, provides real-time data, supports strict RG/AML processes, and allows businesses to experiment with product and marketing without risking the foundation of player money and brand reputation.