Who this page is for
Operators who have chosen how they will launch and now choose the software underneath: founders comparing engines, CTOs weighing licence against build, operators replacing an engine that no longer fits. If the launch model is still open, settle it first on the casino software overview or in the launch models guide.
The short answer: license an engine you configure, unless you have a specific reason to change the ledger, wallet or bonus code yourself. If you do, the choice narrows to a source code licence or a bespoke build. Either way, every change to a certified component goes back through a test lab, and that is the cost buyers leave out.
What sits inside a casino engine
Vendors list similar modules. The last column is where engines differ. GLI-19, the interactive gaming systems standard published by Gaming Laboratories International, defines a critical component as any sub-system whose failure or compromise can cost players their entitlements, cost the state its revenue, or expose the data behind regulator reports. A change to a critical component is a certification event. A change elsewhere usually is not.
| Module | What it owns | What breaks when it is weak | Critical under GLI-19? |
|---|---|---|---|
| Player account management | Identity, KYC status, limits, self-exclusion, account state | A self-excluded player reaching a game through a second vertical | Yes: it stores personal data |
| Wallet and ledger | Every debit, credit and rollback, with round and transaction IDs | Balances that cannot be reconciled with the studios' records | Yes: it holds the state of each wager |
| Game session layer | Launch URLs, sessions, studio callbacks through the casino API | Rounds left open after a disconnect | Yes: a point of entry to the wallet |
| Bonus engine | Rule sets per market, wagering, bonus balances | A promotion that breaks one market's rules because rules are global | Usually, where bonus money touches the wallet |
| Cashier | Deposits, withdrawals, routing across PSPs through the payment gateway | Withdrawals stuck between the PSP and the ledger | Yes: card and account data |
| Risk and reporting | AML alerts, regulator exports, GGR and tax reports | A report the regulator rejects for its format | Yes: it produces the regulator's data |
| Back office and CMS | Staff roles, lobby, content, translations | Staff with more access than their role needs | Roles are audited; content usually is not |
The integration points that decide your roadmap
Five connection points decide whether you can add a supplier without waiting for the vendor's roadmap:
- Wallet contract. Balance, debit, credit and rollback, idempotent on the transaction ID, and the same contract later for sportsbook or poker.
- Event stream. Registrations, deposits, bets and limit changes as real-time events, or only a nightly file. Your CRM and risk team depend on it.
- Front-end API. Your own front end against the engine, or only a themed template.
- PSP and KYC connectors. Added by you, or requested from the vendor.
- Regulator adapters. Reporting per licence as configuration, or a development project per market.
Four ways to hold rights to an engine
The commercial wrapper matters less than what the contract lets you do with the code. Read each column as what you would have on the day the vendor stops supporting you.
| Hosted licence | Licence with escrow | Source code licence | Full IP transfer | |
|---|---|---|---|---|
| Who changes the code | The vendor, on its roadmap | The vendor, unless escrow is released | You, inside the licence's limits | You, without limits |
| Who carries certification | The vendor, for its certified build | The vendor | You, for every change you make | You |
| If the vendor stops | A data export, if the contract has one | A deposit released on the agreed events | The code you already hold | Everything |
| Upstream updates | Automatic | Automatic until release | Merged and re-certified by you | None: you are upstream |
| Where it fits | One operator, standard markets | Same, with a board that wants continuity | A team that must change core logic | A custom build |
Escrow protects you only as far as the deposit can be rebuilt. Escrow agents such as NCC Group test a deposit at two depths: an inventory check that the files are present and readable, and a full compilation that proves the application can be built from it. Release usually follows insolvency of the owner or a material default on maintenance. Ask for full verification, the build scripts and the infrastructure configuration in the deposit, or the code you receive may not run.
Owning the code does not mean you can ship it
GLI-19 requires the platform to check, at least once every 24 hours and on demand, that every critical control program component is an authentic copy of the approved one, using a cryptographic hash of at least 128 bits. The regulator also selects a change management policy, and the test lab evaluates each later modification under it. A risk-based policy sorts changes by regulatory impact so that small ones move faster, but changes still need authorised versions, a record of who changed what, and a tested rollback plan.
So a source code licence moves the certification burden onto you. A changed wallet or bonus engine no longer matches its approved hash until the lab has seen it, and each upstream release has to be merged into your fork and certified again. Lab accreditation matters too: in Curaçao a report counts only when it comes from a test house accredited to ISO/IEC 17025 for online gaming systems and certified by the regulator. Our certification preparation work starts from the component list for exactly this reason.
When owning the engine makes you a supplier
Running the engine for your own brand is one thing. Running it for partners' brands turns you into a B2B supplier in several jurisdictions on this site, with a licence of its own:
- Anjouan has required every supplier to hold a B2B licence or a Recognition Certificate since 1 July 2025, at €9,500 a year.
- Curaçao bills B2B licensees €24,490 a year.
- Finland lets B2C licensees use only software from a holder of a Finnish gambling software licence from 1 July 2028, with applications opening on 1 July 2027.
- Isle of Man uses a Network Services licence, at £52,500 a year, for a platform that accepts partners' players onto its servers.
Plan it before a multi-brand source code deal, not after the second brand asks to join.
Who should not buy an engine licence
- A single brand without a licence, testing a market. The model question comes first.
- An operator without engineers who can read a ledger. A source code licence without a team leaves you holding code nobody can change safely.
- A buyer who mainly wants a large game catalogue. That is an aggregation question for the casino API page.
Where engine projects fail
- The stranded fork. The operator changes core code in year one, stops merging upstream releases, and by year three cannot take the vendor's security fixes without a re-certification project.
- Export without history. The contract promises player data on exit and delivers current balances, not the transaction ledger the next regulator will ask for. Our migration work checks this before it becomes urgent.
- Global bonus rules. The bonus engine holds one rule set, so a second market's restrictions become custom code.
- An escrow deposit that does not build. Nobody tested it, and the release event is the first time anyone tries.
Questions to put to any engine vendor, including us
- Which modules are critical components in your certified build, and which lab certified them, under which standard and version?
- Under the change management policy in my target licence, which changes need the lab and which do not?
- Does the wallet contract stay the same for casino, sportsbook and poker?
- Are player events available as a real-time stream, and on what terms?
- What does the exit export contain: balances only, or the full ledger with round and transaction IDs?
- Is escrow available, at what verification depth, and what triggers release?
- If I license the source code, who certifies my changes and how do upstream releases reach my fork?
- Which reporting formats exist today, and which would be built for me?
We build, configure and integrate the engine through the same five stages as every platform delivery: scoping, licence and corporate, build and integration, certification and test, and launch with hypercare. We answer these eight questions in writing at scoping.
Frequently asked
Is a casino engine the same as a casino platform?
In most vendor language, yes. "Engine" usually means the core that holds accounts, wallet, sessions and bonuses; "platform" adds the back office, cashier, front end and reporting around it. Ask any vendor to list which modules its price covers, because the same word hides different scopes.
Can I replace one module and keep the rest?
Where the engine exposes the module's contract, yes. Wallet, PAM and bonus are the hardest to replace, because every other module depends on them. CRM, CMS and BI are the easiest, provided the event stream exists.
Who needs to hold a supplier licence: the vendor or me?
The party supplying the software to the licensed operator. If you only run the engine for your own brand, that is normally the vendor. If you run it for partners' brands, it can be you, in Anjouan, Curaçao, Finland from 2028 and, for pooled players, the Isle of Man.
How do I compare engines in a demo?
Ask the vendor to run one round with a rollback after the credit, a self-excluded player trying to log in, and a regulator report for a market of your choice. Those three show more about the ledger, PAM and reporting than a lobby tour does.