What You Still Need

This chapter exists because a turnkey platform is only worth what it saves you, and you cannot price that without knowing where the work stops.

Nothing here is hidden elsewhere in this documentation — each chapter's Scope & Roadmap section says the same things locally. This is the consolidated list.

1. Commercial relationships

The platform cannot take real money without these, and none of them is engineering work:

• A gambling licence, in a jurisdiction you have chosen. The hosting region is still undecided and must be settled against licensing and data-residency obligations first.
• A payment provider contract. Card acquiring for gambling merchant codes is a long process on its own — high-risk merchant account, rolling reserve.
• A game provider contract. No demo catalog is seeded. One self-hosted provider runs end to end with a single slot; OnlyPlay and qooob have run only against staging; BetConstruct and Pragmatic are written and unsigned.
• A sports data subscription. The Odds API poller (sized for its 20,000-credit plan) runs pre-match and in-play without a contract beyond the API plan; LSports' push feed runs on staging but needs your own contract and credentials. Same-game combos need LSports.
• A mainnet crypto processor or custody, if you take crypto — the bundled crypto cashier is testnet-only and refuses production.
• A bank integration. The operator bank's books, surplus check and take-profit flow are built, but the only bank adapter is a simulation, so no real bank money moves until an adapter for your bank is written.
• An identity verification vendor contract.
• Game and RNG certification (GLI, eCOGRA, iTech Labs). The two bundled game engines are not lab-certified, and certification is a licence condition.

2. Compliance — the largest gap

• No standalone AML or transaction monitoring. No structuring or velocity rules, no suspicious-activity flagging, no reporting artefacts. Sanctions/PEP screening and ongoing monitoring are expected from a KYC vendor — the provider seam is built and no vendor adapter ships, so both the adapter and the contract are outstanding.
• Geo-restriction covers country, not VPNs. IP geolocation and a region blocklist are built into signup, login and money actions (KYC). The country comes from a free local database (DB-IP Lite) that the setup wizard downloads, so no vendor contract is needed for that part, but the database must be enabled and kept current, and a server left on the default stub gives every player the same region. VPN and proxy refusal needs an IP-intelligence subscription (MaxMind/IPQS class; VPN data is a paid tier everywhere) and an adapter that is not written. There are still no per-jurisdiction feature toggles. Serving a blocked jurisdiction is the fastest way to lose a licence.
• No regulatory reporting. Nothing produces regulator-shaped submissions — tax returns, player-activity registers, self-exclusion registers, large-transaction reports.
• No national self-exclusion register integration (GAMSTOP, OASIS, ROFUS, SPELPAUS). Self-exclusion is local only.
• No age verification distinct from identity verification.
• No data-retention or GDPR tooling. Gambling record-keeping obligations and the right to erasure genuinely conflict; this needs a documented policy, typically pseudonymisation rather than deletion.
• KYC runs without a vendor, at a cost. The review queue, tiered gating and document upload with manual review are built and need no contract at all — but every case is read by your staff, with no automated screening and no liveness check. What's missing is a vendor adapter and its contract if you want automation, the VPN-detection subscription above, document-expiry re-verification, and a policy decision on freezing wagering when an approved player is later flagged.

3. Security

• Staff multi-factor authentication is optional and off by default. Staff can enrol an authenticator app or a passkey, and a role can require a second factor at sign-in, but no role requires it until you switch it on. Until you do, the people who can move money sign in with a password alone. Turn it on for every role before go-live.
• No maker-checker. Staff roles are configurable, with per-area view or manage access and separate powers for personal data, CSV export, bonus grants, withdrawal approval and balance adjustments, but a role is still a single person's authority. Large payouts wait in a review queue, and one staff approval releases them — there is no two-person sign-off. The shipped roles and their defaults are yours to review against your own separation of duties.
• Audit coverage depends on each call site. The audit log is searchable in the console, expands each entry to show what changed and covers most staff actions, including affiliate, campaign and manual event-status changes, but an action is recorded only if its code path records it. Audit a new workflow before relying on it.
• No secret management. Application secrets sit in a hand-edited file on the host.
• No penetration test and no dependency scanning in the pipeline.
• Rate limiting covers credential and payment endpoints; gameplay and read endpoints are unprotected.

4. Platform engineering

• No infrastructure as code, no continuous deployment, no rollback path. Deploying is manual. make setup configures and starts a server you have already provisioned; it is a first-time installer, not a pipeline, and leaves metrics, the crypto service, ClickHouse, game providers and bundled-database backups as follow-up steps.
• No production environment. What runs today is staging, holding no real money.
• Analytics needs its own host. Backoffice charts, Pulse, the activity heatmap and the popularity pages read an optional ClickHouse copy of the ledger; without it they show "unavailable". It fits the current 2 GB staging server only by pushing other services into swap.
• No backup policy, retention, encryption-at-rest posture, or rehearsed restore. Nothing backs up the queue state at all.
• No network isolation — the database is publicly reachable.
• No load testing. Sportsbook traffic spikes at kickoff and on in-play goals; behaviour at peak is unknown.
• No runbooks for feed outages, stuck rounds, settlement disputes or callback storms.
• Logs are structured and carry a request id, but there is no log search or tracing service bundled, so following one disputed bet across ingest, placement and settlement is still manual.

5. Product gaps

Sportsbook. Cash-out is built but off by default and does not cover same-game combos or boosted bets. Player-prop markets arrive hidden and are settled by hand. No outright (futures) markets. One bookmaker's prices, so no line shopping, no consensus pricing, and no margin-stripping to build your own book. No multi-provider failover. No in-house risk or liability management beyond stake ceilings.

Casino. No live dealer. No provable-fairness surface.

Payments. Disputes and chargebacks can be marked and posted, but there is no representment workflow (evidence packs, deadlines). The Trustly adapter's signing is unwritten, so Transak is the only fiat adapter. No payment-fraud controls — no deposit velocity limits, no name matching, no multi-accounting or shared-instrument detection. No mainnet crypto custody.

Bonuses and loyalty. No bonus-abuse controls despite a full bonus and reward engine — no multi-account linking, no bet-pattern detection. No segmentation beyond saved cohorts (no automated risk or lifecycle segments). Bonus money wagers on the casino only (free bets and bet boosts cover the sportsbook). No tournaments. The reward engine enforces payout limits but has no screen to set them. The loyalty layer is off by default and earns nothing until XP rates, tiers and rewards are configured.

Responsible gaming. Reality checks are stored but never delivered. Limits cover every wallet, but the limits page offers only USD, and bonus-funded wagers do not count toward spend and loss limits. No behavioural risk detection.

Operations. Email is covered: saved cohorts and email campaigns send marketing mail with unsubscribe and complaint handling, but you supply the sending domain and a mail vendor that allows gambling, and campaign delivery statistics need Amazon SES. There is no SMS or push messaging at all, no journey or trigger automation, and no frontend product analytics (a self-hosted tool has been chosen but is not built). Customer support is built — in-product conversations backed by Chatwoot, with a live player context panel for agents — but it needs a Chatwoot account, and two of its features (team routing and that context panel) need a paid plan or a self-hosted install. There is still no full player timeline beyond the context panel's recent activity.

AI assistant. Optional. It needs a model-provider key (Claude, Gemini or OpenAI) and, for its fuller checks, Telegram, Sentry and Chatwoot tokens. It can only read and suggest; it cannot carry out a change.

Content. One brand with six themes (the player can also choose corner roundness) — no white-label or per-operator branding. The player site ships five languages (English, German, Italian, Russian, Simplified Chinese), but the four non-English ones are machine-translated and need native review of money, legal and safety copy. The backoffice is English only. The page constructor composes the home page and lobbies from sections, but there is no general CMS for free-form content pages.

Suggested ordering

Before any real money moves

1. Require multi-factor authentication on every staff role, and review the role set against your separation of duties.
2. Check the staff audit log covers every action you rely on.
3. Backups with a rehearsed restore; network isolation; secret management.

Licence prerequisites

1. Identity vendor and VPN-detection contracts (the provider seam and review queue are built; no identity vendor adapter ships and no VPN-aware geolocation adapter exists, so each needs writing as well as an account behind it).
2. Jurisdiction configuration: the region blocklist, verification thresholds and per-jurisdiction feature decisions.
3. AML screening and transaction monitoring.
4. Regulatory reporting exports.
5. National self-exclusion register integration.
6. Reality-check delivery, and native review of the translated copy.

Before scale

1. Infrastructure as code and a deployment pipeline with rollback.
2. Load testing and runbooks.
3. Chargeback and fraud controls; a second payment provider.
4. Log search and tracing on top of the structured logs.
5. A real bank adapter for the operator bank.

Product competitiveness

1. Bonus-abuse controls.
2. White-labelling, if you intend to resell.