Most operators think of a security audit as something that happens when the regulator asks. The framework taking effect on 30 June makes that posture non-compliant.
The updated technical standards require annual third-party audits across all systems handling payment credentials, authentication data, account balances, and random number generation. The results are not held on file for if you are asked. Major non-conformities must be reported to the regulator proactively, before any request arrives. Reports must be available for submission within seven days of a regulator query.
For operators already certified against the required standard, the compliance overhead is audit coordination and documentation maintenance. The work is known and the scope is defined. For operators without a formal audit programme already running, the 30 June deadline is not theoretical time. It is weeks.
The operators who feel this most acutely are mid-tier platforms without dedicated information security function: the same operators who built payment compliance on PCI DSS requirements and treated security posture outside that perimeter as discretionary. That discretion is now explicitly closed.
The question is not whether to have an audit programme. It is whether the one you have is operating at the scope this standard now requires, and whether the documentation to prove it is ready.
What Elite Members See
The full intelligence record for this event includes the named operators, platforms, and regulatory bodies involved, complete jurisdictional context, board-level strategic implications, and cross-vertical dependency analysis.
- Named operators, platforms, and vendors involved
- Full jurisdictional and regulatory context
- Board-level strategic implications and decision framing
- Cross-vertical impact assessment across all seven TGB research verticals
Access the Full Intelligence Report
The Gaming Boardroom tracks this and 27 other intelligence signals each month across seven industry verticals. Elite membership gives you complete named analysis, full jurisdictional depth, and board-level strategic assessment for every signal, delivered on the first of every month.