How to Start a Sportsbook

Start with a one-page product classification, not a feature list. Name the contracting operator, every target territory, the customer location rule, the channel, and whether the offer covers real events, virtual events, fixed odds, pools, exchanges, or another locally defined betting activity. In Great Britain, for example, a real-events remote betting license does not also authorize virtual-event betting, and an operator that is party to customer betting contracts needs the relevant operating permission. Malta separately groups fixed-odds betting and pool or exchange products into different gaming types.

Channel classification also needs care. A terminal inside a betting shop does not automatically make a transaction non-remote: the UK Gambling Commission treats self-service betting terminals used to make or accept bets as remote communication. Record how registration, funding, bet placement, acceptance, settlement, and payout occur in each channel instead of labeling the whole business simply “online” or “retail.”

A consumer-facing operating permission and a B2B supply permission answer different questions. Great Britain's remote gambling software license covers manufacturing, supplying, installing, or adapting gambling software; the remote real-events betting operating license covers providing betting facilities to consumers. Malta's critical gaming supply category covers B2B software or material game-element activity. None of those categories should be treated as interchangeable.

Build an accountability matrix alongside the license map. Great Britain requires remote applicants to provide an operational model with the location and provider or operator of systems and activities, plus an end-to-end diagram from registration through gambling to payout. Use that same discipline whether or not another regulator requires the artifact: it exposes missing owners and supplier assumptions before they become production incidents.

Procurement language often collapses several products into “sportsbook.” Keep the layers separate in the requirements, architecture, pricing schedule, service levels, and exit schedule. A supplier can deliver more than one layer, but a bundle does not remove the interfaces or the need to decide which system has final authority.

Sportradar's Unified Odds Feed carries real-time odds, event messages, and metadata, while its Managed Trading Services exchanges bet tickets and returns risk or acceptance suggestions. Digitain's iFrame is a ready-made interface, while its bespoke API supports an operator-built interface. Those are delivery facts about the named products, not proof that any one of them supplies the operator's PAM, wallet, license, or complete compliance operation.

Choose the authoritative record for customer balance, payment transaction, accepted wager, open wager, result, settlement, cashout, cancellation, and manual adjustment. GLI-33 covers unique transaction data, before-and-after balances, wager records, significant-event logs, and controlled state changes; its external-system flow also uses pending funds until the host acknowledges a wager. The implementation can vary, but every state transition needs a durable identifier and a replay-safe reconciliation path.

Keep internal balance buckets separate from legal classifications. The UK Gambling Commission treats deposits, unpaid winnings, and crystallized bonuses as customer funds for its rules, while open stakes are not customer funds under that specific insolvency-protection framework. For MGA B2C licensees—and B2B licensees managing pooled jackpots—the player-funds report includes open bets and pending withdrawals when assessing coverage. This is exactly why the ledger should preserve components rather than expose one unexplained “wallet balance.”

An event feed is an input, not the operator's rulebook. For every sport and competition, define which events may be offered, the permitted market families, source and rights, event and participant identity, cutoff behavior, official result source, abandonment and postponement rules, dead heats, palpable errors, voids, cancellations, and correction windows. Publish the customer-facing parts in plain language and keep the exact rule version attached to each accepted bet.

Data provenance belongs in the control design. The voluntary IBIA Data Standards set expectations for accurate, reliable, transparent, and responsibly sourced data and cover collector vetting, source method, latency, audit history, quality checks, incident reporting, and restrictions around competitions involving minors. Separately, betting licenses can carry direct suspicious-betting reporting duties. In Great Britain, relevant information must be supplied to the Commission as soon as reasonably practicable and certain information must also go to the relevant sports governing body.

Design account verification, funding, wagering, and withdrawal together. Covered remote operators in Great Britain must obtain and verify name, address, and date of birth before gambling. Operators should not wait until withdrawal to request information that could reasonably have been requested earlier. Late, payout-only KYC is therefore a design defect, not a harmless operations shortcut.

Map who sees payment-account data and who can affect its security. PCI DSS is a baseline for environments where payment-account data is stored, processed, or transmitted, and can also include service providers that affect the cardholder-data environment. Tokenized or hosted checkout can reduce exposure, but the actual integration and assessor or acquirer determination control scope. Separately, a jurisdiction-specific AML risk assessment should explicitly test customer, product, geography, payment-method, source-of-funds, and third-party risks. In Great Britain, open-loop payments and insufficient white-label or supplier due diligence are specific AML risks.

Responsible-gambling controls cannot live only in the PAM if sportsbook behavior is visible somewhere else. Covered remote operators in Great Britain must monitor from account opening using indicators that include spend, spend patterns, time, gambling behavior, customer contact, tool use, and account indicators. The licensee remains responsible when B2B providers deliver parts of the activity.

Define a cross-system data contract for limits, exclusions, risk indicators, interventions, marketing suppression, and account restrictions. The engine and front end must consume decisions fast enough to prevent a blocked wager, while the operator must retain the evidence needed to evaluate whether interventions worked. Treat controls as state, not as a nightly report.

For Great Britain launches, build against the rules effective on the actual go-live date. The second phase of RTS 12 changes takes effect on September 30, 2026. From that date, operators must offer gross deposit limits, reserve the name “deposit limit” for that type of limit, give it at least equal prominence, and offer it over fixed time frames. This is a dated UK requirement, not a universal product rule.

Classify each party's data role for each processing purpose. A sportsbook supplier may be a processor for account operations, a separate controller for its own regulatory records, or something else under the applicable law; the brand label does not decide. Where the UK controller-processor framework applies, the contract must define the processing, documented instructions, confidentiality, security, sub-processors, rights assistance, breach support, audits, and end-of-contract return or deletion.

Then draw the security boundaries. Keep payment-account scope, wagering systems, player data, trading access, regulator reporting, and support access explicit. GLI-33 covers encryption, strong authentication, audit logging, network separation, third-party communications, and defined supplier security responsibilities. Great Britain's RTS security requirements apply to specified critical systems. Map the applicable controls, then test the exact production configuration and local obligations.

Treat the sportsbook interface as a real-time transaction surface. GLI-33 requires clear selections, customer review and confirmation, changed-price handling, and an unambiguous accepted, partially accepted, or rejected result. It also expects current event and market information, accessible rules and results, and a durable wager record. Test those outcomes at the operator boundary even when the screen is supplied inside an iFrame.

Regulatory testing scope depends on jurisdiction, product, and change. Great Britain separates requirements that a licensee can verify from those needing independent third-party assurance; do not claim that every change needs a test house or that internal QA replaces required external testing. For web accessibility, use WCAG 2.2 as a testable baseline while separately confirming the legal standard in each market.

Do not buy retail complexity for an online-only launch. If staffed counters, POS devices, ticket printers, cash, scanners, or self-service terminals are in scope, treat retail as another regulated channel with its own premises, equipment, cash, identity, support, and reconciliation controls. In Great Britain, an SSBT used to facilitate making or accepting bets is treated as remote communication even when it stands inside a shop, so the physical location alone does not settle the license analysis.

Retail also introduces bearer instruments and device operations. GLI-33 addresses unique device records, printed wager information, redemption validation, duplicate-payment prevention, device and attendant records, and secure communications. The exact local technical standard may differ, but these are concrete questions for the requirements and acceptance plan.

Go-live is a controlled change, not the point when operations begins. Before accepting the first bet, assemble evidence that the licensed entities and approved suppliers match production; the event and market catalog is approved; the released configuration is the tested one; customer controls are enforced; opening balances reconcile; reporting owners can produce the required records; and support can suspend wagering at account, market, event, channel, and system level.

Use jurisdiction-specific launch and reporting requirements as hard gates. Depending on the license and activity, Malta requires a go-live declaration, monthly B2B compliance reporting, monthly player-funds reporting for B2Cs and B2Bs managing pooled jackpots, suspicious-betting reporting, outsourcing notifications, and information-security incident reporting. Assign every applicable duty before launch.

Build sportsbook-specific incident playbooks around authoritative state. A stale feed, ambiguous bet timeout, wrong price, late suspension, settlement correction, wallet mismatch, payment outage, account-control failure, data breach, or vendor outage each needs an immediate containment action, a source of truth, evidence preservation, customer-impact decision, notification owner, and reconciliation before normal service resumes. Under NIST SP 800-61 Rev. 3, incident response is part of ongoing cybersecurity risk management rather than a standalone document.

Continuity and exit must preserve financial and regulatory truth. Export customers, verification state, limits and exclusions, wallet entries, accepted and open bets, market and rule versions, results, settlements and corrections, integrity cases, communications, reports, access logs, and configuration. Where the UK controller-processor framework applies, contracts must cover return or deletion, sub-processor control, and audit support. Define measurable recovery and export objectives from the operator's obligations and risk analysis; do not copy generic recovery numbers from a sales proposal.