How to Start a Sportsbook

Start with a one-page product classification, not a feature list. Name the contracting operator, every target territory, the customer location rule, the channel, and whether the offer covers real events, virtual events, fixed odds, pools, exchanges, or another locally defined betting activity. In Great Britain, for example, a real-events remote betting license does not also authorize virtual-event betting, and an operator that is party to customer betting contracts needs the relevant operating permission. Malta separately groups fixed-odds betting and pool or exchange products into different gaming types.

Channel classification also needs care. A terminal inside a betting shop does not automatically make a transaction non-remote: the UK Gambling Commission treats self-service betting terminals used to make or accept bets as remote communication. Record how registration, funding, bet placement, acceptance, settlement, and payout occur in each channel instead of labeling the whole business simply “online” or “retail.”

A consumer-facing operating permission and a B2B supply permission answer different questions. The UK Gambling Commission's remote gambling software license covers manufacturing, supplying, installing, or adapting gambling software; the remote real-events betting operating license covers providing betting facilities to consumers. The Malta Gaming Authority likewise describes critical gaming supply as B2B software or material game-element activity. None of those categories should be treated as interchangeable.

Build an accountability matrix alongside the license map. The UK Gambling Commission asks remote applicants for an operational model showing the location and provider or operator of systems and activities, plus an end-to-end diagram from registration through gambling to payout. Use that same discipline whether or not a regulator requests the artifact: it exposes missing owners and supplier assumptions before they become production incidents.

Procurement language often collapses several products into “sportsbook.” Keep the layers separate in the requirements, architecture, pricing schedule, service levels, and exit schedule. A supplier can deliver more than one layer, but a bundle does not remove the interfaces or the need to decide which system has final authority.

The distinction is visible in first-party technical documentation. Sportradar describes its Unified Odds Feed as real-time odds and event messages plus metadata, while its Managed Trading Services exchanges bet tickets and returns risk or acceptance suggestions. Digitain describes its iFrame as a ready-made interface and its bespoke API as the route for an operator-built interface. Those are delivery facts about those products, not proof that any one of them supplies the operator's PAM, wallet, license, or complete compliance operation.

Choose the authoritative record for customer balance, payment transaction, accepted wager, open wager, result, settlement, cashout, cancellation, and manual adjustment. GLI-33 calls for unique transaction data, before-and-after balances, wager records, significant-event logs, and controlled state changes; its external-system flow also uses pending funds until the host acknowledges a wager. The implementation can vary, but every state transition needs a durable identifier and a replay-safe reconciliation path.

Keep internal balance buckets separate from legal classifications. The UK Gambling Commission treats deposits, unpaid winnings, and crystallized bonuses as customer funds for its rules, while open stakes are not customer funds under that specific insolvency-protection framework. For MGA B2C licensees—and B2B licensees managing pooled jackpots—the player-funds report includes open bets and pending withdrawals when assessing coverage. This is exactly why the ledger should preserve components rather than expose one unexplained “wallet balance.”

An event feed is an input, not the operator's rulebook. For every sport and competition, define which events may be offered, the permitted market families, source and rights, event and participant identity, cutoff behavior, official result source, abandonment and postponement rules, dead heats, palpable errors, voids, cancellations, and correction windows. Publish the customer-facing parts in plain language and keep the exact rule version attached to each accepted bet.

Data provenance belongs in the control design. IBIA's Data Standards call for accurate, reliable, transparent, and responsibly sourced data; they also address collector vetting, source method, latency, audit history, quality checks, incident reporting, and restrictions around competitions involving minors. Separately, betting licenses can carry direct suspicious-betting reporting duties. In Great Britain, relevant information must be supplied to the Commission as soon as reasonably practicable and certain information must also go to the relevant sports governing body.

Design account verification, funding, wagering, and withdrawal together. The UK Gambling Commission requires covered remote operators to obtain and verify name, address, and date of birth before gambling and says a withdrawal should not trigger information that could reasonably have been requested earlier. That makes late, payout-only KYC a design defect, not a harmless operations shortcut.

Map who sees payment-account data and who can affect its security. PCI DSS is a baseline for environments where payment-account data is stored, processed, or transmitted, and can also include service providers that affect the cardholder-data environment. Tokenized or hosted checkout can reduce exposure, but the actual integration and assessor or acquirer determination control scope. Separately, a jurisdiction-specific AML risk assessment should explicitly test customer, product, geography, payment-method, source-of-funds, and third-party risks; the UK Gambling Commission identifies open-loop payments and insufficient white-label or supplier due diligence as specific UK risks.

Responsible-gambling controls cannot live only in the PAM if sportsbook behavior is visible somewhere else. The UK Gambling Commission requires covered remote operators to monitor from account opening using indicators that include spend, spend patterns, time, gambling behavior, customer contact, tool use, and account indicators. It expressly keeps the licensee responsible when B2B providers deliver parts of the activity.

Define a cross-system data contract for limits, exclusions, risk indicators, interventions, marketing suppression, and account restrictions. The engine and front end must consume decisions fast enough to prevent a blocked wager, while the operator must retain the evidence needed to evaluate whether interventions worked. Treat controls as state, not as a nightly report.

For Great Britain launches, build against the rules effective on the actual go-live date. The Commission has moved the second phase of RTS 12 changes to September 30, 2026. From that date, operators must offer gross deposit limits, reserve the name “deposit limit” for that type of limit, give it at least equal prominence, and offer it over fixed time frames. This is a dated UK requirement, not a universal product rule.

Classify each party's data role for each processing purpose. A sportsbook supplier may be a processor for account operations, a separate controller for its own regulatory records, or something else under the applicable law; the brand label does not decide. ICO guidance requires controller-processor contracts to define the processing, documented instructions, confidentiality, security, sub-processors, rights assistance, breach support, audits, and end-of-contract return or deletion.

Then draw the security boundaries. Keep payment-account scope, wagering systems, player data, trading access, regulator reporting, and support access explicit. GLI-33 addresses encryption, strong authentication, audit logging, network separation, third-party communications, and defined supplier security responsibilities. The UK Gambling Commission's RTS security requirements apply to specified critical systems. Use those sources as control inputs, then test the exact production configuration and local obligations.

Treat the sportsbook interface as a real-time transaction surface. GLI-33 requires clear selections, customer review and confirmation, changed-price handling, and an unambiguous accepted, partially accepted, or rejected result. It also expects current event and market information, accessible rules and results, and a durable wager record. Test those outcomes at the operator boundary even when the screen is supplied inside an iFrame.

Regulatory testing scope depends on jurisdiction, product, and change. The UK Gambling Commission's testing strategy distinguishes requirements that a licensee can verify from those needing independent third-party assurance; do not claim that every change needs a test house or that internal QA replaces required external testing. For web accessibility, use WCAG 2.2 as a testable baseline while separately confirming the legal standard in each market.

Do not buy retail complexity for an online-only launch. If staffed counters, POS devices, ticket printers, cash, scanners, or self-service terminals are in scope, treat retail as another regulated channel with its own premises, equipment, cash, identity, support, and reconciliation controls. In Great Britain, an SSBT used to facilitate making or accepting bets is treated as remote communication even when it stands inside a shop, so the physical location alone does not settle the license analysis.

Retail also introduces bearer instruments and device operations. GLI-33 addresses unique device records, printed wager information, redemption validation, duplicate-payment prevention, device and attendant records, and secure communications. The exact local technical standard may differ, but these are concrete questions for the requirements and acceptance plan.

Go-live is a controlled change, not the point when operations begins. Before accepting the first bet, assemble evidence that the licensed entities and approved suppliers match production; the event and market catalog is approved; the released configuration is the tested one; customer controls are enforced; opening balances reconcile; reporting owners can produce the required records; and support can suspend wagering at account, market, event, channel, and system level.

Use jurisdiction-specific launch and reporting requirements as hard gates. The Malta Gaming Authority, for example, describes a go-live declaration; monthly B2B compliance reporting; monthly player-funds reporting for B2Cs and B2Bs managing pooled jackpots; suspicious-betting reporting; outsourcing notifications; and information-security incident reporting. Those duties differ by license and market, but they show why regulatory reporting cannot be left as an unnamed post-launch task.

Build sportsbook-specific incident playbooks around authoritative state. A stale feed, ambiguous bet timeout, wrong price, late suspension, settlement correction, wallet mismatch, payment outage, account-control failure, data breach, or vendor outage each needs an immediate containment action, a source of truth, evidence preservation, customer-impact decision, notification owner, and reconciliation before normal service resumes. NIST SP 800-61 Rev. 3 places incident response inside ongoing cybersecurity risk management rather than treating it as a standalone document.

Continuity and exit must preserve financial and regulatory truth. Export customers, verification state, limits and exclusions, wallet entries, accepted and open bets, market and rule versions, results, settlements and corrections, integrity cases, communications, reports, access logs, and configuration. ICO guidance makes return or deletion, sub-processor control, and audit support explicit controller-processor contract topics. Define measurable recovery and export objectives from the operator's obligations and risk analysis; do not copy generic recovery numbers from a sales proposal.