Skip to main content

Compliance and audit

Answer a regulator in minutes, not weeks

Tiered checks decide what a player can do. One stream records what everyone did, and an evidence pack is a report rather than a project.

The Audit Trail screen listing configuration, compliance and authentication events, each row carrying the actor, their role, their city and country, the address they connected from and the browser they used.

Five tiers, configured per brand

Every player sits at a tier from T0 to T4, and the tier decides what they are allowed to do: how much they can deposit, whether they can withdraw, and which checks must clear before either changes. The thresholds are yours to set, brand by brand.

  • Thresholds are set per brand

    A market with strict affordability expectations does not inherit the settings of a market without them.

  • Decided in the account core

    The tier is evaluated in real time rather than through a support ticket, so a player who has just cleared verification is not left waiting.

  • The wallet reads it before money moves

    Compliance and payments behave as one system, so a deposit cannot clear against a standing that changed an hour ago.

The Decisions tab of a player record, filtered by operation and outcome, showing a deposit decision with its amount, its outcome, the tier that applied and the policy that made it.
  • Deposit eligibility
  • Withdrawal eligibility
  • Checks required per tier
  • Thresholds per brand

One stream, not one log per module

Most platforms can tell you what happened inside one module. The question an investigation actually asks is what happened across all of them in the same ten minutes.

A portrait crop of the audit trail table showing the time, event and participants columns for a run of recent platform events.

Player, staff and system in one order

Every action lands in the same append only stream, in the order it occurred, whichever part of the platform produced it.

Who, where and on what

Each row carries the actor, their role, their city and country, the address they connected from and the browser they used.

Append only, so it holds up later

Events are written once and not edited afterwards, which is what makes the record worth producing to somebody outside the business.

Searchable, so an answer takes minutes

Filter to one player, one period or one control instead of raising a data request and waiting for a queue.

Screenshots are captures of the demo tenants MaxBet and LuckyOni. Every figure on screen is demo data.

An evidence pack is a report, not a project

A regulator rarely asks for a dashboard. It asks for the record of one player, one period or one control, assembled and defensible.

What a pack can be built around

  • One player

    Every action on that account, in order, with the actor and the context attached to each event.

  • One period

    A window across the whole platform rather than one module at a time.

  • One control

    What the control actually did and when, rather than a description of what it was meant to do.

  • Actor, role, location and device

    Attached to every row, because that is usually what a question about an action turns on.

  • An export somebody outside the business can read

    Produced in a form that does not require access to the back office to open.

Who produces it

  • Your compliance officer, from the back office

    A report rather than a database query, so it does not start with a ticket to engineering.

  • Inside the working day

    Because the trail is already complete, assembling the pack is retrieval rather than reconstruction.

  • With the reasoning attached

    Decisions carry the reason the reviewer gave, which is the part a follow up question always reaches for.

Read the licence in full

Verify once, and the second launch is shorter

Verification is expensive in the two currencies operators care about: documents and time. Once a person has cleared checks on the platform, that result carries forward, so a second brand or a second company does not restart the same paperwork with the same people.

  • The record travels with the result

    When and how the verification was completed stays attached, so reuse costs the audit trail nothing.

  • Identity stays isolated per brand

    A player on one brand is not a player on another unless they choose to be, even inside a single operator group.

  • A second launch starts further along

    The people who cleared checks for the first venture do not clear them again for the next one.

A player record with status chips for account state, compliance tier, identity verification, anti money laundering screening and two factor login, above the document review tabs with each required document marked as passed.

The checks that run, and where they live

Identity and source of funds checks run through Sumsub. What matters as much as the provider is where the result lands, because that is what decides whether a control holds under pressure.

  • Identity verification at signup

    Document and biometric checks are raised from the player record and returned into it, with the attempt visible while it is still open.

  • Source of funds when it is needed

    Evidence requests are issued against a player and tracked to a decision rather than handled over email.

  • Screening after approval, not instead of it

    Anti money laundering screening runs automatically once a player is approved, so an approval is never the end of the check.

  • Player safety states in the account core

    Freeze, suspend, ban and self-exclusion are states on the account itself, so every other part of the platform has to respect them.

What this page does not claim

Capability, not a compliance opinion

The platform supplies the checks, the tiers, the gates and the record. It does not decide whether your operation is compliant in a given jurisdiction, and nothing here is legal advice. Which markets to accept, where thresholds sit, what evidence each tier requires and what happens to an escalated case are your decisions. We build the platform so that you can make them and prove afterwards that you did.

Where the licence fits

On the White Label route operators trade under Scalara's licence, which is why a new casino goes live only with both platform approval and an explicit operator launch. On the Turnkey Platform route the operator holds its own licence and ours does not apply. The scope, the administrator, the validity window and the public register are set out on licensing.

The decision order we are building

Harm-First Orchestration, the order that puts player harm and fraud ahead of commercial optimisation, is in active development. Everything else on this page is behaviour available today. What that layer is designed to do, and what it does not yet do, is written up on Harm-First Orchestration.

Security is a separate subject

This page is about compliance decisions and the record of them. How the platform itself is built, hosted and defended, including the zero trust rule that every internal system proves its identity on every request, belongs on platform security.

Watch the trail in the running platform

Two recordings from the live product. Nothing here is a mock-up.

Audit

Trace every platform event. Administrative actions, security events and system configuration changes in one stream.

Audit: Trace every platform event. Administrative actions, security events and system configuration changes in one stream.

More about compliance and audit

Every player sits at a tier from T0 to T4, and the tier decides what they are allowed to do: how much they can deposit, whether they can withdraw, and which checks must clear before either changes.

Thresholds are configured per brand, so a market with strict affordability expectations does not inherit the settings of one without. The decision happens in the account core in real time rather than through a support ticket, and the wallet consults the tier before it moves any money.

Yes. Evidence packs are built from the platform wide audit trail and produced from the back office rather than from a database query.

Because the trail records player, staff and system actions in one stream, with the actor, the role, the location and the device attached, assembling the record of one player, one period or one control is a report rather than a project. Your compliance officer can run it without waiting for an engineer to be free.

You are, and we build the platform so that you can be. We supply the checks, the tiers, the gates and the record. You decide which markets to accept, where thresholds sit, what evidence each tier requires and what happens to an escalated case.

On the White Label route we also carry our own obligations as the licensee, which is why a new casino needs both platform approval and your explicit launch. Neither of us can sign that off alone.

Account freeze, suspension, ban and self-exclusion, built into the account core rather than added as a marketing setting. Because they are states on the account itself, every other part of the platform has to respect them: a self-excluded player cannot be reactivated by a campaign, and a frozen account cannot quietly take a deposit.

Deposit and session limits sit alongside them, as do the tiered checks that run before money moves. The controls are ordinary. Where they live is the part that decides whether they hold.

What this page covers in the feature matrix

Each capability below is a row in the platform index, where its tier sits beside the method and the date behind it. Read the full feature matrix.

Tiered compliance engine (T0 to T4)

A five tier trust model per player, with thresholds configurable per brand. Deposit and withdrawal eligibility is decided automatically, not by support ticket.

Full-platform audit trail

Every action by every player, staff member and system lands in one central, tamper evident stream, enriched with location data and fully searchable.

Regulator evidence packs

One click compliance reports built on the always on audit trail, so a regulator's question is answered in minutes rather than weeks of collation.

Verify once, verified forever

A person verified once stays verified for every future venture on the platform. A second casino needs no repeat paperwork from the same people.

KYC and AML verification

Identity and source of funds checks run through a specialist verification provider, and AML screening runs automatically once a player is approved.

Responsible gambling controls

Player safety states are built into the account core rather than added on later: freeze, suspend, ban and self-exclusion.

Identity isolation per brand

Every brand runs its own separated login and account system. Player credentials are walled off between brands, even inside a single operator group.

Bring the last question your regulator asked

We will show you where the answer comes from, how long it takes to assemble, and which person on your team would run it.

Jurisdictional availability and the obligations that come with it are assessed during discovery, alongside the commercial terms.