iGaming affiliate payments: due diligence, contracts, payouts and red flags

Why affiliate payments draw attention

An affiliate payout run sends money to many third parties at once, often in several currencies and countries, based on figures generated by the operator's own tracking system. From a compliance point of view, that combination needs careful handling. The operator is paying people it may never have met, the amounts are set by internal data, and the recipients are often small companies or sole traders in a wide range of jurisdictions.

Regulators also hold operators responsible for the marketing done on their behalf. If an affiliate advertises to minors, makes misleading claims, or targets players in a market where the operator is not licensed, the regulator will look to the operator. Payment providers know this, so they treat the affiliate programme as a window into how seriously the operator takes its obligations.

A well-run affiliate programme is easy to recognise. Affiliates are vetted before they are paid, contracts are signed and enforced, payouts tie back to reports, and problem partners are removed. When those controls exist, affiliate batches become routine.

Commercial models and how they affect payments

Affiliate deals in iGaming generally fall into a few models, and each produces a different payment pattern.

• Revenue share. The affiliate receives a percentage of net gaming revenue from the players it refers, usually paid monthly. Amounts vary from month to month and can be negative in some months if players win. Contracts should say whether negative balances carry forward.
• CPA. The affiliate receives a fixed fee for each referred player who meets qualifying criteria, such as a first deposit of a minimum amount. Payments track acquisition volumes rather than player losses.
• Hybrid. A combination of a lower CPA and a lower revenue share.
• Fixed fees. Flat payments for placements, sponsorships or listings, regardless of results.

A provider reviewing affiliate payouts will want to know which models the operator uses, because that tells it what pattern to expect. A large fixed fee paid to an affiliate with no tracked traffic would look odd under a revenue share programme. The same payment might make sense as a disclosed sponsorship deal. Context is what turns a questionable payment into an ordinary one.

Affiliate due diligence before the first payment

Due diligence should happen before an affiliate starts sending traffic, and certainly before the first payment. A sensible baseline covers the following.

1. Identity. For companies, collect the certificate of incorporation, registered address, directors and beneficial owners. For individuals, collect identity and address documents.
2. Screening. Screen the company, its owners and directors against sanctions lists and for politically exposed persons and adverse media.
3. Payment details. Confirm that the bank account or wallet belongs to the contracting affiliate, and record it. Payments to third-party accounts should be refused unless there is a documented reason.
4. Traffic sources. Ask how the affiliate generates traffic: websites, search, social media, email, paid advertising, streaming or other channels. Review the main sites and channels.
5. Target markets. Confirm which countries the affiliate targets and check that the operator is licensed in each one.
6. Tax information. Collect tax forms or numbers required in the operator's jurisdiction and the affiliate's.

Higher-value affiliates deserve deeper checks. An affiliate that will earn a large share of the monthly budget should be reviewed in the same way as a significant supplier, including a call with its principals and a review of its other operator relationships.

Contracts that protect the operator

The affiliate agreement is the operator's main control. It should be written for the markets and regulators the operator deals with and should include, at a minimum:

• the commercial terms, including the definition of net revenue, qualifying criteria for CPA, carry-forward rules and payment dates;
• the markets the affiliate may target, and an express prohibition on marketing to any other market;
• compliance with the advertising rules of each licensed market, including restrictions on bonus promotion and content that appeals to minors;
• a ban on unsolicited email and messaging, brand bidding where the operator prohibits it, and misleading claims;
• a right for the operator to audit traffic and marketing materials;
• a right to withhold or claw back commission earned through fraud, prohibited markets or breaches;
• a right to terminate immediately for serious breaches.

A contract is only useful if it is enforced. Operators should be able to show cases where they have withheld commission or terminated affiliates for breaches. Evidence of enforcement is persuasive to payment providers, because it shows the contract terms are real.

Payout schedules and batch files

Most operators pay affiliates monthly, a few weeks after the month end, once revenue figures are final and any adjustments have been made. Some pay CPA deals more frequently. A predictable schedule helps everyone: affiliates know when to expect money, finance teams can plan currency needs, and payment providers can see that each batch matches the expected pattern.

The batch file itself should be clean. Each line should show the affiliate's legal name, account details that match the onboarding record, the amount, the currency and a reference that ties back to the affiliate platform statement or invoice. Round-sum payments with no reference, or payments to names that do not match any affiliate record, are the sort of thing that halts a batch.

As an illustrative example, an operator might close its affiliate statements on the fifth business day of the month, approve them internally by the tenth, and send a batch on the fifteenth with separate files for EUR, USD and GBP payments. The batch total would reconcile to the affiliate platform's commission report for the previous month, and the reconciliation would be filed alongside the payment confirmation.

Screening at payout, not only onboarding

Screening at onboarding is necessary but not enough. Affiliates change ownership, sanctions lists are updated, and bank details get changed. A payout batch should be screened every time it runs, against current sanctions lists and the operator's own records.

Changes to an affiliate's payment details are a particular risk. Fraudsters sometimes impersonate affiliates by email to redirect payments, and affiliates themselves may ask to be paid to a third party. Operators should verify any change of bank details through a separate channel, such as a call to a known contact, and should treat requests to pay a different name, a personal account for a company affiliate, or an account in a third country as warning signs.

Payment providers screen too. When a batch arrives, the provider screens each beneficiary and may hold payments that match lists or appear inconsistent with the operator's stated programme. Operators who screen properly before submitting a batch rarely see payments held, and when they are held, they can answer the provider's questions quickly from their own records.

Red flags, including rogue affiliates

Some affiliate behaviour should prompt an immediate review. Common warning signs include the following.

• Traffic from unlicensed markets. Players arriving from countries the operator does not serve, or a sudden surge from a market with strict local rules, suggest an affiliate is marketing where it should not.
• Rogue affiliate behaviour. Sites that copy the operator's branding, pose as the operator, use fake reviews, spam messaging channels or promote bonuses that do not exist. These affiliates damage the operator's reputation and can create regulatory exposure.
• Bonus abuse and fraud. Referred players who deposit the minimum to trigger CPA and never play again, or clusters of accounts sharing devices and payment methods.
• Undisclosed connections. An affiliate linked to the operator's owners, staff or other affiliates in a way that was not declared.
• Payment requests that do not fit. Requests to split payments across several accounts, to pay in cash-like instruments, or to pay entities in jurisdictions unconnected with the affiliate.

When red flags appear, the operator should suspend payments to the affiliate while it investigates, document what it found and act on the result. Paying an affiliate despite clear evidence of misconduct is hard to defend to a regulator or a payments partner.

Related-party affiliates and large partners

In some groups, the largest affiliate is a company owned by the same people who own the operator, or by their relatives or business partners. This is not prohibited, and there can be good commercial reasons for it. It does need to be disclosed and priced on terms that can be justified.

Payment providers look closely at concentration. If one affiliate receives a large share of monthly payouts, the provider will want to know who owns it, what traffic it delivers, and whether its commission rates are in line with the rest of the programme. A related-party affiliate on far better terms than unrelated partners can look like a way to move revenue out of the licensed entity.

The best approach is openness. Identify related-party affiliates in the application, provide their ownership details and contracts, and explain the commercial rationale. A provider that learns about a related party from its own research, rather than from the operator, will reasonably ask what else has not been mentioned.

Records to keep

Good records make affiliate payments easy to defend. Operators should keep, for each affiliate, the onboarding file and screening results, the signed agreement and any amendments, monthly commission statements, invoices where the affiliate issues them, payment confirmations, records of bank detail changes and how they were verified, and notes of any compliance reviews, warnings or terminations.

These records should be retained for at least as long as the operator's licensing and AML rules require, which in many jurisdictions is several years after the relationship ends. They should also be retrievable quickly. When a provider queries a payment, being able to send the contract, statement and invoice within a day is the difference between a short delay and a long one. See our glossary for definitions of terms used in affiliate agreements.

General information, not legal advice

This article is general information about affiliate payments in licensed iGaming. It is not legal advice, and advertising and affiliate rules vary between licensing authorities and markets.

CCYFX handles affiliate batch payouts for licensed operators in multiple currencies, alongside supplier payments and settlement conversion. Read about our international payments service to see how batches are submitted and reconciled.