The iGaming licence business plan that a regulator assesses is not the same document you hand to investors. Most operators miss that distinction, and it explains a large share of the information requests that surface during licensing reviews. An investor plan sells an opportunity. A regulatory plan proves you understand the specific operation you are asking to licence. When operators submit one where two are needed, the regulator usually replies with questions.
One operator submitted a Malta application with a plan their corporate advisors had polished to a high standard. Revenue curve in year two, platform scalability narrative, market sizing built on global iGaming projections. The Malta Gaming Authority returned an information request three weeks later. Which markets, specifically. Which payment methods for each market. How player acquisition would work in practice. What compliance would cost, line by line. The document had answered the investor questions and skipped the regulator ones. Those are different questions.
This guide covers what an iGaming licence business plan needs to contain in 2026 for Malta and Curaçao, and where operator submissions consistently fall short.
Key takeaways
- The plan a regulator assesses is different from an investor deck. It must prove you understand your specific operation, not sell an opportunity.
- The market section must name actual target markets, the regulatory context of each, and a real player acquisition strategy. Global market sizing carries no weight.
- Financial projections are judged on coherence, not ambition. Show the assumptions behind the revenue: player value, acquisition cost, conversion, and retention.
- Realistic compliance cost for a mid-sized MGA-licensed operator typically exceeds €150,000 a year. Budgeting below €50,000 damages credibility before the financial review.
- The market section and the AML section must tell the same story about who the players are and how they pay. Inconsistencies trigger information requests.
- The same plan often feeds the banking application, so write it so both a regulator and a bank compliance officer can follow it.
Why the iGaming licence business plan is not a standard business plan
An investor business plan answers four things: the market opportunity, the competitive advantage, the revenue projections, and why this team. A regulator assessing a licence application asks a different set of questions.
Is the business model coherent and commercially sensible. Does the operator understand their specific risk profile, meaning their actual target markets, actual payment methods, and actual player demographics. Is the compliance budget realistic against what the framework costs to maintain. Are the financial projections grounded in plausible player acquisition assumptions rather than a percentage carved out of a global market figure.
The investor document and the regulatory document share some content. The framing, the emphasis, and the operational specificity differ enough that an online gaming licence business plan written only for investors generates information requests on every regulatory-specific section.
What the business plan is actually used for
The regulator uses the business plan to assess three things: the viability and coherence of the proposed operation, the operator’s grasp of their own compliance obligations, and whether the financial model supports a business that can sustain its compliance infrastructure. A plan that shows strong revenue alongside a compliance budget that would barely cover key function staffing creates a credibility problem. Either the revenue is overstated or the compliance cost is understated.
The market and player base section
The market section in most plans describes a global or regional iGaming market and then claims a share of it. Regulators are not assessing the global market size. They are assessing whether you know your own market.
Specific, sourced evidence grounds this section credibly. Figures on internet penetration, mobile connectivity, and financial inclusion for the markets you actually target, drawn from sources such as the World Bank’s internet usage data, carry far more weight than a headline market projection. What the regulator wants to see is which player markets you target, which regulatory framework governs gaming in each, and whether you have a realistic acquisition strategy for each one.
Geographic specificity matters. An operator who says “we target European recreational players” is describing several hundred million people across dozens of markets with different rules. An operator who says “we target recreational players in Germany, Sweden, and the Netherlands” is describing a specific regulatory challenge, three nationally regulated markets, each with its own licensing assessment. The second operator either understands that challenge or does not, and the plan shows which.
Player demographic specificity
The AML risk assessment has to describe the actual player demographic. The business plan has to show that you know what that demographic is. A plan that describes “mass market online casino players” while the AML framework claims a crypto-native audience creates a consistency problem across the submission. Inconsistencies get flagged. The market section and the AML section should tell the same story about who the players are, where they are from, and which payment methods they use. When the two sections diverge, information requests follow.
The financial projections section
Financial projections in a licensing application get assessed for coherence, not ambition. The regulator is not deciding whether to invest. They are deciding whether you understand what you are building.
Projections that show revenue climbing from zero to €50 million in year one raise questions about the player acquisition assumptions behind them. Not because the figure is impossible, but because the regulator wants to see the calculation: average player value, acquisition cost, conversion rate, retention. If those inputs are not in the document, the regulator asks for them. A gaming licence business plan that shows the numbers without the assumptions is a plan that invites a follow-up.
The compliance cost line operators underestimate
The compliance cost line is the section that most often misstates what the operation will actually cost. Key function staffing, with five roles required under the MGA framework, each needing a qualified professional, is a significant recurring cost. Add the annual independent compliance audit, RNG and platform certification that recurs as game libraries update, and the MGA compliance contribution that scales with gross gaming revenue. These are structural costs of operating a licensed gaming platform, not optional extras.
A plan that shows total compliance cost at €30,000 per year has not done the calculation. This is especially true when the same plan describes an MGA-licensed operation with meaningful revenue.
For a mid-sized MGA-licensed operator, total annual compliance cost usually exceeds €150,000. This includes key functions, audit, certification, the compliance contribution, and legal and advisory support. As GGR grows, this cost also rises.
A licensed iGaming operation that budgets compliance below €50,000 creates a credibility problem. The regulator may question the figures before the financial review even starts.
The plan should also reconcile with the headline Malta figures. The MGA application fee is €5,000. The annual licence fee for a B2C licence is €25,000. In addition, the B2C compliance contribution starts at €25,000.
The AML and compliance framework section
The Malta Gaming Authority’s assessment specifically evaluates whether the business model described in the plan is coherent with the compliance framework submitted alongside it. The two documents need to tell the same story.
The AML section of the business plan differs from the standalone AML policy. It needs to explain how you understand your specific AML risk. Not gaming AML risk in general. Your risk, shaped by the markets you target, the payment methods you accept, the player demographic you expect, and the money laundering typologies relevant to those characteristics. A generic line such as “the company will maintain a comprehensive AML programme in accordance with applicable regulations” generates a request for specificity every time. The AML requirements that the plan has to reflect are covered in iGaming AML compliance in 2026.
Responsible gaming in the business plan
A plan that does not address responsible gaming at all is a gap in Malta applications. The MGA expects the operator to treat player protection as an operational requirement. The plan should show how you implement the tools and integrate responsible gaming monitoring with the commercial operation. The treatment does not need to be extensive. It needs to be present and consistent with the standalone responsible gaming policy submitted alongside it. A mismatch between the plan and the policy creates questions. The absence of any reference creates a finding.
The corporate structure section
The business plan needs to describe the corporate structure clearly. It should state which entity holds the licence, how the ownership chain works, how the group is organised, and where the key functions sit.
For operators with holding entities in other jurisdictions, the plan should explain the rationale. A Bulgarian holding company above a Malta operating entity, for example, is a structure the regulator will want explained, not justified on tax grounds but accounted for as a deliberate design choice. An unexplained complex structure raises more questions than a clearly explained one, even when the structure is entirely legitimate.
The key function reporting lines need to be clear. The Compliance Officer reports to the board, not to the commercial director. The MLRO holds independent filing authority. The org chart in the plan should show these reporting relationships rather than leaving them buried in the key function submission. How to build a structure that works for the licensing application, and why structures built for other purposes create documentation problems, is covered in iGaming corporate structure in 2026.
The business plan and the banking application
The plan submitted to the licensing regulator is often also the foundation of the banking application. Banks assessing gaming operators want the business model in plain language: who the players are, how deposits flow, how the operator generates revenue, and what compliance infrastructure exists.
A plan written for a regulator, using regulatory terminology and compliance framework language, is not the same document a bank compliance officer needs. That officer usually does not work in gaming and needs the model explained clearly. The underlying content stays the same, though. The market, the player base, the revenue model, and the compliance programme carry across both documents. Operators who build the iGaming operator business plan with both audiences in mind produce something that works for both. Operators who build it only for the regulator, then wonder why the bank version does not land, create extra work for themselves. How this content intersects with what banks assess is covered in opening a bank account for an iGaming business in 2026.
What operators consistently get wrong
Four issues appear in almost every business plan that generates information requests. Not always all four, but consistently some combination of them.
Revenue projections without player acquisition specifics. How does €20 million GGR in year two translate into a specific number of active players, at a specific average value, with a specific acquisition cost. Without that calculation visible, the projection is just a number.
Compliance cost understated against the described operation. Either the operator does not understand the real costs, or someone without iGaming sector experience wrote the plan. Either reading damages credibility.
An AML narrative that is generic rather than specific to the actual business. This remains the single most common cause of AML-section information requests.
A market section that describes the global iGaming total addressable market instead of the operator’s specific target markets, player demographics, and the regulatory context for each. The global market is not your market. Your market is the one you target.
The full compliance checklist behind an application is in the iGaming compliance checklist in 2026. How the plan fits within the wider application process, and what else is required alongside it, is in the iGaming licence application guide in 2026. And how the licensed gaming business plan sits within the full casino launch sequence is in how to start an online casino in 2026. For the regulator’s own application guidance, see the Malta Gaming Authority applications hub.
Frequently asked questions
How is an iGaming licence business plan different from a standard business plan?
The emphasis and the required specificity differ. An investor plan answers market opportunity, competitive advantage, revenue projections, and team quality. A regulatory plan answers those and also states which specific markets you target, which framework applies in each, which payment methods you accept, what AML risk each method carries, how the compliance budget reflects the real cost of a licensed platform, and how the projections support the player acquisition assumptions. Generic market narrative and optimistic revenue figures without underlying calculations generate information requests that delay the application.
What financial projections does a gaming licence business plan need to include?
Three-year projections covering revenue by player segment and market, costs including compliance at realistic levels, and the player acquisition assumptions behind the revenue. The assumptions matter as much as the numbers: how many active players, at what average revenue per player, at what acquisition cost, with what retention. Projections without visible assumptions generate requests for those assumptions. Compliance costs need to reflect the real cost of running a licensed operation, covering key function staffing, audits, certification, and regulatory fees, not the lower figures a startup budget might hope for.
Does the business plan affect banking applications as well as licensing?
Yes. Banks assessing gaming operators want the business model in plain language: who the players are, how deposits flow, how the operator earns revenue, and what compliance infrastructure exists. The plan that satisfies the licensing regulator covers the same ground the bank’s compliance officer needs. Operators who build the document for both audiences, with regulatory precision and a plain-language commercial explanation, produce something that works for both applications rather than needing two separate documents.
What is the most common reason a gaming licence business plan generates information requests?
An AML narrative that describes a generic online gaming operator rather than the specific business applying. The risk assessment section needs to describe the target markets, payment methods, player demographics, and monitoring approach, and show how the operator calibrates that approach to the actual business model. Generic compliance language, such as “the company will maintain adequate AML procedures,” generates a request for specifics every time.
How detailed does the market section of a gaming licence business plan need to be?
Specific enough to name the target player markets, explain the regulatory context in each, and describe the acquisition approach for each. Global iGaming market sizing is not useful to a regulator. The specific markets you target, why those markets, and how you plan to reach players in them is what the regulator needs to assess the coherence of the proposed operation. If the market section and the AML section describe different player demographics or geographies, inconsistency flags follow.
How should compliance cost be represented in the business plan?
Accurately. For an MGA-licensed mid-sized operator, total annual compliance cost typically exceeds €150,000 per year, covering key function staffing, the annual independent compliance audit, RNG and platform certification, the compliance contribution that scales with GGR, and legal and advisory support. Plans that show much lower compliance costs create a credibility problem before the financial review starts, because they suggest either that the operator does not understand the costs or that someone outside the sector prepared the plan.
What is the minimum share capital for a Malta iGaming licence business plan?
For a B2C licence, the MGA requires minimum share capital of €100,000, and €25,000 for a B2B licence. The plan should show this as paid-up capital and keep it separate from player fund protection, which is a distinct ring-fenced requirement. Conflating the two is a common gap that surfaces at the go-live stage rather than at submission.
Can the same business plan support a Malta and a Curaçao application?
The core content carries across, including the market, player base, revenue model, and compliance programme, but each framework needs its own treatment. The plan has to reflect the Malta Gaming Authority’s key function and contribution requirements for a Malta application, and the Curaçao Gaming Authority’s post-LOK substance and corporate requirements for a Curaçao one. Submitting an identical document to both regulators without adjusting for each framework generates information requests in the sections that differ.
Written by the DD Consultus advisory team. DD Consultus advises iGaming operators on licensing, corporate structure, banking, and compliance across Malta, Curaçao, and other jurisdictions. Regulatory fees in this article were verified against the Malta Gaming Authority on 26 June 2026. For a licensing consultation, contact contact@licencegaming.com or +356 99408536.