iGaming Platform Architecture: A Framework for Operator Decisions
Every platform decision you make today constrains or enables every commercial outcome you’ll have for the next five years. Not your game content library. Not your marketing spend. Not your affiliate programme. Your architecture. It determines how fast you can enter a new jurisdiction, how much it costs to implement a regulatory change from the UKGC or MGA, whether you can run real-time AML monitoring or personalisation at the player level, and what your total cost of ownership looks like when your PE backers ask for the number in 2027. This piece lays out a practical framework for evaluating architectural approaches, with specific attention to the components, trade-offs, cost structures, and compliance implications that actually matter at the operator level.










Most operators don’t choose their architecture. They inherit it. A white-label deal signed four years ago to get to market fast. A monolithic platform built by an in-house team that has since turned over twice. A “flexible” vendor solution that turned out to be flexible only in the ways the vendor’s roadmap allowed.
The result is a platform that works until it doesn’t. Until the UKGC publishes new affordability check requirements and the compliance team discovers the wallet service can’t expose the data they need without a six-month engineering project. Until the business wants to launch in Ontario and the PAM can’t support multi-jurisdictional player segregation without a rewrite. Until the board asks why it takes fourteen weeks to ship a new bonus mechanic when a competitor does it in three.
Architecture is the root cause of these constraints. It dictates four things that drive commercial outcomes:
Market entry speed. A platform built for single-jurisdiction deployment will fight you every time you try to expand. Player data residency, localised payment methods, jurisdiction-specific responsible gambling tooling: these aren’t configuration changes in most legacy systems. They’re projects.
Regulatory agility. UKGC, MGA, and GGC requirements change on timelines that don’t align with your release cycles. If a compliance change requires touching the same codebase that handles game launches, CRM, and payments, the blast radius of every regulatory update is your entire platform.
Total cost of ownership. The sticker price of a platform build or vendor contract is the least interesting number. What matters is the five-year cost including maintenance, regulatory change, scaling infrastructure, and the opportunity cost of features you couldn’t ship because the platform wouldn’t let you.
Product differentiation. If your platform is architecturally identical to every other operator on the same white-label, your only differentiator is marketing spend. That’s a race you don’t want to be in.
The monolith gets a bad reputation in architectural discussions, often from people selling microservices consulting. The honest assessment is more conditional.
A monolithic architecture means a single deployable unit containing all platform components. One codebase, one deployment pipeline, one runtime. For a single-brand operator in a single jurisdiction with a small engineering team, this can be the right choice. Development velocity is high in the early stages because there’s no inter-service communication to design, no distributed tracing to implement, no service mesh to manage. A team of eight engineers can move fast in a well-structured monolith.
The problems emerge at specific inflection points. When you need to scale the betting engine independently during a Premier League Saturday without scaling the CMS and CRM alongside it, the monolith forces you to scale everything or nothing. When a regulatory change to deposit limit logic requires a deployment that also includes an unrelated CMS update, your risk surface expands unnecessarily. When a database schema change in the wallet touches tables shared with the bonusing engine, you’ve just coupled two teams’ release schedules.
Technical debt in monolithic iGaming platforms tends to compound in predictable patterns. Shared database schemas create hidden dependencies. Business logic migrates into the data layer as stored procedures. The test suite grows so large that CI/CD pipelines take hours, which means engineers start skipping tests, which means production incidents increase, which means the team moves even more slowly.
We’ve seen operators running monoliths built in 2015 or 2016 spending 60% to 70% of their engineering capacity on maintenance and regulatory change, leaving 30% or less for product development. That’s the real cost of a monolith at scale: not the architecture itself, but the opportunity cost it imposes.
If you’re a single-brand, single-jurisdiction operator with under 50,000 monthly active players and a small team, a well-structured monolith is defensible. If you’re operating across jurisdictions, running multiple brands, or planning to, the monolith will become your biggest constraint within eighteen to twenty-four months.
Abstract architectural discussions are less useful than concrete ones. Here’s what specific iGaming microservices look like in practice.
Player Service. Owns player registration, profile management, authentication, and KYC status. Exposes APIs for player creation, profile retrieval, KYC status updates, and session validation. Consumes events from the compliance service (e.g., a KYC verification failure triggers account restriction). Stores data in a relational database because player identity data has strong referential integrity requirements and regulatory retention obligations.
Wallet Service. Handles all monetary operations: deposits, withdrawals, bet stakes, bet settlements, bonus credits, and balance queries. This is the service with the tightest performance and consistency requirements. Every transaction must be atomic. Double-spend prevention is non-negotiable. At Jadex Consulting, we treat the wallet service as the most scrutinised component in any platform build because it’s the first thing regulators examine and the first thing that breaks under load if designed poorly. The wallet exposes synchronous APIs for balance queries and bet placement, and publishes asynchronous events for downstream consumers like the AML monitoring service and financial reporting.
Betting Service. Manages bet placement, bet types, accumulator logic, and settlement. Consumes odds feeds, validates bets against the wallet service, and publishes settlement events. During live betting, this service handles the highest request rates and tightest latency requirements on the platform.
Compliance Service. Orchestrates responsible gambling controls (deposit limits, loss limits, session time limits, self-exclusion), AML transaction monitoring, and regulatory reporting. This service consumes events from the wallet, betting, and player services to build a real-time view of player activity. In UKGC-regulated environments, this service needs to trigger interventions (customer interactions, account restrictions) based on configurable rules that can be updated without a full redeployment.
API Gateway. Sits in front of all services, handling request routing, authentication token validation, rate limiting, and request/response logging. The gateway is also where you implement jurisdiction-specific access controls if you’re operating across multiple markets from a shared platform.
Each of these services has defined API boundaries, its own data store, and its own deployment pipeline. They communicate through a combination of synchronous REST/gRPC calls (for operations requiring immediate responses) and asynchronous event streams via Kafka or similar (for operations where eventual consistency is acceptable).
Database architecture is where iGaming platforms succeed or fail under load.
The wallet service needs ACID-compliant transactions. Full stop. A player’s balance must never reflect a state that didn’t happen. This means a relational database (PostgreSQL, MySQL, or a managed equivalent) with row-level locking, proper isolation levels, and carefully designed schema that minimises lock contention during concurrent bet placement.
Player session data, game history, and analytics sit at the other end of the spectrum. These are high-write, high-read workloads where eventual consistency is acceptable and schema flexibility is valuable. NoSQL stores (MongoDB, DynamoDB, Cassandra depending on the access patterns) handle this well.
Sharding becomes necessary when transaction volumes exceed what a single database instance can handle. For the wallet, sharding by player ID is the common approach: each player’s transactions are co-located, which means balance calculations don’t require cross-shard queries. But sharding introduces complexity in reporting (aggregating across shards) and in operations like bonus campaigns that touch many player wallets simultaneously.
Read replicas offload reporting and analytics queries from the primary transactional database. This is important because a compliance team running a complex SAR query shouldn’t degrade the performance of live bet placement. Replication lag matters here; for real-time AML monitoring, you may need to read from the primary or use change data capture (CDC) to feed a dedicated monitoring data store with near-zero lag.
Connection pooling, query optimisation, and index management are unglamorous but high-impact. We’ve seen wallet service performance issues that traced back to a missing index on a table that grew to hundreds of millions of rows over two years. The database isn’t something you design once and forget.
Results Are Designed, Not Hoped For
Clear Objectives. Tangible Outcomes.
Well engineered software is only part of the equation. True impact comes from aligning technology with commercial intent from the outset.
We define success early, measure consistently and refine continuously to ensure every product delivers meaningful and sustained value.
Architecture for Compliance: Engineering for UKGC and MGA
Regulatory compliance isn’t a feature you bolt on. It’s an architectural property.
The UKGC‘s requirements for customer interaction (formerly known as affordability checks), self-exclusion (including GAMSTOP integration), and AML monitoring have specific technical implications. Customer interaction triggers need real-time access to player deposit, loss, and session data across a configurable time window. If your wallet, betting, and session data live in separate services with no shared event stream or queryable projection, you can’t implement this without building significant infrastructure.
In a well-designed microservices architecture, the compliance service consumes events from the wallet service (deposits, withdrawals, bet settlements) and the player service (session starts, session durations) to maintain a real-time activity profile per player. Rules (e.g., net deposits exceeding a threshold within a rolling 30-day window) are evaluated against this profile continuously. When a threshold is breached, the compliance service triggers an action: a customer interaction, an account marker, or an account restriction.
MGA requirements differ in specifics but share the same architectural demand: the ability to enforce jurisdiction-specific rules without rewriting core platform logic. This means compliance rules need to be configurable per jurisdiction and per licence, not hard-coded into the wallet or PAM.
Self-exclusion integration (GAMSTOP in the UK, equivalent registers in other jurisdictions) requires the player service to check external registries during registration and login. The latency and availability of these external services need to be accounted for: what happens when GAMSTOP is unreachable? Your architecture needs a defined fallback that remains compliant.
Audit logging is a cross-cutting concern. Every state change in a player’s account, every transaction, every responsible gambling limit modification, every customer interaction must be logged immutably with timestamps and actor identification. This isn’t application logging; it’s a dedicated audit trail that needs to survive even if the service that generated the event fails. An append-only event store or a dedicated audit service consuming from the event bus handles this.
At Jadex Consulting, we’ve worked through these decisions with operators at different stages, from those outgrowing their first white-label to those decomposing monoliths that have been running for a decade. The operators who make the best architectural decisions are the ones who treat architecture as a business investment with measurable returns, not as a technical exercise driven by what’s fashionable. The ones who make poor decisions are usually the ones who either avoid the decision entirely (staying on a platform that’s slowly strangling their business) or overcorrect (adopting complexity their team can’t support).
Pick the architecture that matches where you are and where you’re going. Not where you were, and not where a vendor wants you to be.
Frequently Asked Questions
Latest from our blog
Insights & Perspectives
Our insights explore the intersection of technology, commercial strategy and disciplined execution across complex digital environments.



