Most operators we work with want a single licensing playbook. The reality is that Brazil's SECAP, Portugal's SRIJ and Malta's MGA do not share a vocabulary — they share an industry. The licensing memo we hand the operator on day one is the same memo three times, with three different controlling clauses.
Brazil's framework, formalised under Lei 14.790/2023 and the SECAP normative acts that followed, is the youngest of the three. The licensing route is national, the testing requirement is delegated to recognised laboratories, and the operator must localise data residency. Our memo carries the SECAP-specific check on integrator-listed games — the operator's RGS partners must be on the recognised list before they go live, regardless of MGA or UKGC status.
Portugal's SRIJ is older and stricter on individual game certification, with each title requiring a Portuguese-jurisdiction certificate even when it carries an MGA one. Our memo carries the operational consequence: the operator's catalogue is split across PT-only and PT-plus-EU titles, and the platform's bonus engine has to honour that split.
Malta's MGA is the most permissive on cross-border catalogue, but it is the strictest on the controller's responsibility. The MGA's player-protection duty is enforceable on the licensee personally — not on the platform. Our memo's final section is always a paragraph that says: "the platform is the data processor; the licensee is the data controller; nothing in this contract changes that."
The licensing memo's job is to make the differences cheap to operate. Three jurisdictions on one platform is fine. Three jurisdictions on three operational playbooks is not.
We do not write the operator's licence application — that's their lawyer's job. We write the platform-side runbook the lawyer needs to point at. Once it's written, the operator can hand it to a regulator and answer the only question that matters: "who does what when something breaks at 02:14 on a Saturday?"