The Operator's Due-Diligence Checklist for a New Slot Provider

Guides · 2026-08-22 · 8 min read · By CROCO Games

Fifteen checks that turn provider claims into verified facts - licences in official registers, certificates matched to titles and markets, math sheets, operational maturity and exit terms.

Every B2B slot provider deck says the same four things: great retention, certified games, fast integration, dedicated account manager. Some of those decks are true. The way to find out is not a longer meeting — it is a due-diligence pass where every claim is either verified against something outside the provider's own marketing, or written down as unverified and priced accordingly.

This is the checklist we believe operators should run on any new studio, including us. It is organized by what can actually be verified, how, and which answers are disqualifying. Our companion guide on choosing a B2B slot provider covers the strategic fit — portfolio shape, market focus, roadmap. This one is narrower and harder: evidence.

Licences and certificates: verify, never accept PDFs

Certification claims are the easiest to check and the most commonly taken on faith. Three rules make this section short:

Check the register, not the logo strip. Licensing authorities publish searchable registers — the Malta Gaming Authority maintains one at mga.org.mt, the UK Gambling Commission at gamblingcommission.gov.uk. If a provider claims a licence, the company name should be findable by you, without their help. A B2B studio supplying regulated markets holds either its own supplier licence or a documented certification path per market; which one matters for your compliance file.

Match certificates to the exact game and version. Test labs — GLI, iTech Labs, eCOGRA, BMM — certify a specific game build at specific RTP configurations for specific jurisdictions. A lab logo on the website is not evidence that the title you are launching is certified in your market at the RTP you contracted. Ask for the certificate number per title and confirm the details; a serious provider produces this in hours. How RNG certification actually works — what the lab tests, what a certificate covers — is explained in our certification guide.

Dates matter. Certificates reference builds. If the provider ships updates weekly but the certificate is a year old, ask how recertification is handled. A clean answer describes a process; a vague answer describes a risk.

Math evidence: the RTP conversation that separates studios

Every provider states RTP. The due-diligence question is what they can show behind the headline number:

• Per-title math documentation. A real math sheet covers RTP by configuration, volatility, hit frequency including how much of it is below-stake payouts, feature trigger cadence, and max win probability — not just the theoretical ceiling. If the answer to "what share of hits are below stake" is a blank look, the studio does not know its own game the way you need to know it.
• Which RTP configuration you are getting. Most modern titles ship several certified RTP bands (a compliance fact, not a scandal — see the RTP variants guide). Your contract should name the configuration, and your reporting should let you confirm it in production.
• Published claims with methodology. When a studio quotes retention or performance benchmarks, the standard to hold them to is simple: is the metric defined, is the sample described, are the limits stated? A number with a methodology can be challenged and therefore trusted; a number without one is an adjective.

Technical and operational: the questions that predict launch week

The integration itself is covered in depth in our wallet integration guide; at due-diligence stage, five questions predict most of the pain:

1. Sandbox before contract? A provider confident in their API lets your engineers touch a sandbox during evaluation. Demo-only access until signature is a mild red flag.
2. What does the status page look like? Ask for uptime history and the incident process — named channel, escalation times, post-mortems. "We've never had an incident" is not maturity, it is a young logging system.
3. Reporting granularity. Per-transaction, per-round, per-player exports, available via API. You cannot reconcile aggregates.
4. Session and regulatory tooling. Reality checks, session limits, stake limits per market, forced-logout behaviour with open rounds — if you operate regulated markets, these are launch blockers, not nice-to-haves.
5. Who answers at 02:00? Not rhetorically: which timezone is the on-call in, and what is the contractual response time for a wallet-affecting incident?

Commercial terms: read the mechanics, not the headline rate

The revenue share percentage gets the negotiation attention; the mechanics around it decide the actual economics. Our breakdown of slot content commercial terms goes deep, so here only the due-diligence flags: minimum guarantees and their triggers, exclusivity windows and their geography, bonus-cost attribution (who pays for free spins campaigns), termination and game-removal notice periods, and — increasingly relevant — what happens to your data access if the relationship ends.

One structural check worth adding: providers under 50 titles live or die on a handful of games. Ask which three titles produce most of their GGR across their network, and what the plan is when those age. A studio that answers with numbers is managing a portfolio; a studio that answers with a roadmap slide is hoping.

Team, track record, and the reference call

• Named humans. Who runs math, who runs certification, who runs integrations? Studios proud of their team introduce them; studios that only present "the company" are worth a second look on LinkedIn.
• Reference operators. Two or three, ideally in your market tier, ideally not from the provider's own case-study page. The three questions that extract signal: What broke in the first 90 days? How were disputes settled? Would you add their next title without being pitched?
• Corporate basics. Registered entity, jurisdiction, beneficial ownership where your compliance requires it. Five minutes in a company register saves awkward discoveries later.

The checklist

Fifteen checks look heavy. In practice a prepared provider clears the verifiable ones in a single week, because the artifacts already exist: register entries, certificate numbers, math sheets, sandbox credentials, references. The checklist is only expensive for providers who were hoping not to be asked — which is precisely the information you were paying for.

Frequently asked questions

How do I verify a slot provider's licence?

Search the licensing authority's public register yourself — the MGA and UKGC both publish searchable databases — and match the exact corporate entity, not the brand name. For game certificates, ask for the certificate number per title and confirm scope: game version, jurisdiction, and RTP configuration.

What math documentation should a slot provider share?

Per-title sheets covering RTP by certified configuration, volatility, hit frequency including the share of below-stake payouts, feature trigger cadence, and max-win probability. Under NDA, a serious studio shares all of it — the games are certified, so the math exists in exactly this form.

What are red flags when evaluating a game provider?

Certificates that cannot be matched to titles and markets, headline RTP with no configuration detail, benchmarks without methodology, demo-only access until signature, aggregate-only reporting, and references that never materialize. None is fatal alone; two or more is a pattern.

How long should slot provider due diligence take?

About a week of elapsed time for a prepared provider: register checks are minutes, certificates and math sheets arrive in days, references take scheduling. If the process drags past a month, the delay itself is usually the finding.

Key takeaways

• Verify licences in official registers and match certificates to the exact title, market and RTP configuration you are launching — logos prove nothing.
• Demand per-title math evidence including below-stake hit share and max-win odds; a studio that cannot produce it does not know its own product.
• Judge operational maturity by sandbox access, incident process, and per-transaction reporting — the three things you cannot retrofit during launch week.
• Read commercial mechanics (bonus attribution, exclusivity geography, exit terms) harder than the headline revenue-share rate.
• Hold every published benchmark to one standard: defined metric, described sample, stated limits.

Partner with CROCO Games