The due diligence process is a structured investigation that verifies the people, funds, systems, and controls behind an iGaming business, allowing regulators and commercial partners to assess risks with documented facts.
For Nevis gaming license applicants, the due diligence process begins with the company, its directors, and shareholders or beneficial owners who hold over 10% ownership or control. It then extends into source of funds, AML/KYC policies, technology, vendors, and the operating plan. After launch, customer due diligence and transaction monitoring continue throughout the player relationship. Throughout this guide, applicants can learn how these checks fit into the wider Nevis gaming license process.
Purpose, Value, and Diligence Requirements
iGaming involves real transactions, digital identity, gaming technology, and cross-border activity. Accordingly, due diligence helps regulators determine whether an applicant is fit to operate, and it also helps banks, payment providers, platform vendors, and investors evaluate the operator’s exposure to financial crime, fraud, technical failure, and restricted-market activity.
Due diligence applies across several layers. Licensing due diligence examines the applicant and its controllers, while customer due diligence checks players. Counterparty due diligence reviews affiliates, payment providers, and software vendors, and transaction due diligence becomes relevant when a platform or gaming asset is bought or sold.
In an acquisition, the due diligence process typically starts after a Letter of Intent is signed. The due diligence period is usually fixed before closing. Hard due diligence concerns financial data and legal and operational risks; soft due diligence accounts for management and cultural compatibility.
For a Nevis license, due diligence requirements include certified corporate documents, ownership charts, personal forms, identity and address records, professional history, and proper source-of-funds and source-of-wealth evidence. Existing B2C and B2B companies still have to submit financial statements. Applicants also need a signed business plan accounting for ownership, target markets, suppliers, financial projections, and compliance controls.
B2C applicants must also provide KYC, AML, responsible gaming, and underage gaming policies. Nevis requires an independent compliance officer and a local reporting officer who lives in Nevis and is registered with the Financial Services Regulatory Commission (FSRC). These measures are in place to help the Nevis Online Gaming Authority (NOGA) confirm integrity, competence, funding, and legal compliance.
The Due Diligence Process: Step-by-Step Workflow
The iGaming due diligence process follows five steps:
Scope the review. Identify the type of license, ownership structure, products, player markets, payment flows, technology, and people within the scope. Set risk thresholds and assign reviewers accordingly.
Create a secure data room. Organize all corporate, personal, financial, compliance, and technical records. Make sure to keep consistent file names, access controls, version tracking, and a request index.
Review and verify. Compare applications with the registries, identity evidence, screening results, financial records, contracts, platform data, and policies. Determine whether the documentation outlines the real operation.
Interview key people and report findings. Speak with directors, beneficial owners, compliance staff, finance leaders, and technical owners. Record any gaps, contradictions, risks, and remediation steps.
Make and document the decision. Submit the licensing file and decide whether a transaction should proceed. Keep the evidence and reasoning for review.
The diligence process is risk-based. Straightforward files move quickly, while layered ownership, higher-risk jurisdictions, PEP exposure, or unclear funding require enhanced diligence.
Commercial Due Diligence for iGaming
Commercial due diligence determines whether a company's business model matches its documentation. Nevis operators should review product mix, player demographics, acquisition channels, retention, bonuses, affiliates, competitors, and market restrictions.
Validate revenue with platform reports, player-wallet activity, payment settlements, game-provider invoices, bonuses, refunds, and chargebacks. Review player-acquisition claims by geography, affiliate, campaign, and cohort; forecasts based on restricted markets, weak retention, or unapproved affiliates might not survive regulatory or investor due diligence.
In a deal, compare the target company’s metrics with the account-level data. Due diligence should separate deposits from gaming revenue and distinguish registered users from funded, active players.
The four Ps provide a practical framework: people, performance, philosophy, and process.
People: the experience and integrity of owners and managers.
Performance: the verified results.
Philosophy: the operator’s approach to compliance and responsible gaming.
Process: whether decisions and controls are consistent, documented, and repeatable.
Legal Due Diligence Checklist
Legal due diligence for an iGaming operator should cover:
Certificates of incorporation, articles, bylaws, registers, good-standing records, ownership charts, and board resolutions
Gaming applications, licenses, license conditions, regulatory correspondence, policies, audits, and certifications
Platform, game, affiliate, payment, data-feed, hosting, employment, and white-label agreements
Complaints, disputes, investigations, data incidents, enforcement notices, and restricted-market records
Trademark, domain, copyright, software, and other intellectual property records
Confirm that each contract names the correct entity and permits the planned activity. Trace intellectual property from founders, employees, and developers to the applicant or target company; missing software assignments, disputed domains, or expired content agreements can create legal risks and delay licensing.
Legal due diligence should also confirm that the operator’s target markets, advertising, payment flows, and terms follow all applicable local laws.
Tax Due Diligence Essentials
Tax due diligence details where the group is formed, managed, staffed, and conducting business. Review corporate returns, gaming taxes, value-added or sales taxes, payroll, withholding, permanent-establishment exposure, and open audits, and reconcile returns to financial records and payment flows.
Cross-border structures require close review of royalties, service fees, payment agents, related-party charges, and transfer pricing. Qualified advisers should examine local reporting and each country connected to management, employees, customers, or revenue before operators rely on a tax position.
Corporate Finance and Due Diligence
Financial due diligence tests whether an operator has clean funding and enough capital to meet player and operating obligations. Reconcile financial statements to ledgers, bank accounts, processor reports, tax filings, and platform data, then review revenue recognition, bonuses, jackpots, chargebacks, affiliate accruals, debt, cash burn, and projected runway.
Player funds demand focused due diligence. Match all wallet liabilities to player-level balances, withdrawals, and available cash. Carefully review approval limits, account access, segregation practices, processor reconciliation, and unusual transfers. Gaps between recorded balances and accessible funds often point to liquidity or control problems.
For iGaming acquisitions, valuation can use comparable-company multiples, precedent deals, or discounted cash flow. Scenario analyses should reflect retention, payment acceptance, and regulatory outcomes.
Compliance Standards, AML/KYC, and Ongoing Obligations
Applicant due diligence and player KYC address different areas. Operators use customer due diligence to verify players, confirm age and location, evaluate risk, and monitor activity after onboarding.
A risk-based AML/KYC program should account for:
Identity, age, address, and payment-method verification
Sanctions, PEP, adverse-media, and ownership screening
Customer risk scoring and documented review thresholds
Transaction and behavioral monitoring
Source-of-funds and source-of-wealth checks when risk rises
Escalation, suspicious-activity reporting, and record retention
Periodic review and event-driven re-verification
Enhanced due diligence can be triggered by PEP status, higher-risk geography, unusually large or rapid transactions, multiple payment instruments, inconsistent IP locations, or unclear funding. Reviews should explain the evidence collected, the decision reached, who approved it, and when it must be reconsidered.
Customer due diligence should continue after players pass through onboarding. Ongoing due diligence looks for any behavior that changes the risk profile, connecting alerts with clear escalation rules.
Identity providers such as Jumio, Onfido, and Trulioo can automate document, biometric, and database checks. Operators should confirm jurisdiction coverage, match accuracy, privacy, integration, audit trails, alert handling, and cost before choosing a vendor.
Ongoing obligations include annual license renewal, current ownership and corporate records, maintained AML/KYC and responsible gaming controls, accurate transaction and complaint records, and timely responses to regulator requests. Operators should also track all changes to officers, beneficial owners, products, domains, vendors, and policies.
Operational and Technical Diligence Processes
Operational due diligence confirms whether a platform can perform the controls described in its application. Review all system architecture, access management, encryption, transaction logging, vulnerability management, hosting, data retention, and third-party dependencies.
Test payment integrations from deposit through withdrawal, and confirm that rules detect third-party funding, rapid movement, chargeback patterns, and failed transactions. Test KYC integrations for document review, age checks, sanctions screening, manual escalation, account restrictions, and override logs. Where required, review independent RNG certificates and game, platform, or data-feed agreements.
Cybersecurity due diligence should cover penetration tests, data protection, backups, recovery objectives, and incident response. Business continuity plans must prepare for provider outages, cyberattacks, data loss, payment disruption, and key-person unavailability. Exercises and system logs provide better evidence than policy documents alone.
Vendor due diligence verifies security, licensing status, subcontractors, and data access. Payment-partner due diligence should examine settlement, reserves, chargeback handling, and restricted markets, helping assess risks created outside the operator’s direct systems.
Due Diligence Checklist: Realistic Workstreams
Craft a master checklist with corporate, ownership, personal KYC, financial, tax, legal, AML/KYC, responsible gaming, payment, technical, cybersecurity, vendor, and market-access workstreams.
For each request, record the:
Document name, date, version, and data-room location
Applicant owner and specialist reviewer
Deadline, status, and outstanding questions
Evidence received and verification method
Risk score, proposed remedy, and decision impact
Score the probability and the impact separately. High risks require remediation or enhanced diligence, while medium risks need an assigned owner and deadline. Low risks are addressed with routine monitoring and risk management.
A central register prevents separate teams from reaching conflicting conclusions. This should show which due diligence checks are complete, which evidence has expired, and which findings remain open, connecting decision-making to risk management and board oversight.
Managing the Diligence Period
The due diligence period is dependent on the review. Player onboarding can take minutes when automated checks pass, while enhanced due diligence takes days or longer. Vendor reviews often take several weeks, and licensing due diligence can extend across months when ownership is complex or records are incomplete.
Timelines should be shaped by document volume, certification rules, translations, third-party responses, and regulatory questions. Add extension clauses in acquisition documents and vendor negotiations when critical evidence is late. Conditionality terms make closing or activation dependent on licensing, ownership verification, security testing, or remediation.
Who pays for due diligence? An applicant pays for its licensing, advisory, certification, and verification costs. For deals, each party typically pays its own advisers unless the documents allocate expenses differently.
Reporting, Remedies, and Post-Closing Compliance
Findings reports should begin with scope, evidence, limitations, and a red-flag summary. Each finding should state the fact, risk, supporting evidence, severity, owner, recommended action, and deadline.
Reporting needs to distinguish routine due diligence findings from matters requiring enhanced due diligence. It should also record the reason why a reviewer accepted or rejected evidence. Clear due diligence records can help a regulator or auditor reconstruct the decision without relying on staff memory.
For an acquisition, remedies include price adjustments, holdbacks, indemnities, closing conditions, covenants, or targeted warranties. Warranties might address licensing, financial statements, player balances, tax, intellectual property, data security, sanctions, and AML/KYC.
For a license applicant or operating platform, remedies are likely to involve new evidence, policy revision, technical fixes, account restrictions, enhanced due diligence, vendor replacement, or staff training. Track the corrective work at the 30-day, 60-day, and 90-day marks, then move the material controls into quarterly monitoring and annual review.
How Apex Capital Partners Supports the Due Diligence Process
Apex Capital Partners provides Due Diligence & KYC services for gaming operators pursuing a Nevis license. Our team helps applicants scope requirements, form a Nevis company, prepare ownership and personal KYC files, document source of funds and wealth, and align AML/KYC policies with the operating model.
Apex also provides local reporting officer support and discreet, on-island KYC and AML execution. Our involvement continues through application review, vendor selection, reporting, renewal, and post-launch compliance.
Contact Apex Capital Partners to discuss your Nevis license, ownership structure, target markets, and due diligence needs.
