Managing Vendor Risk Under MGA: Why Your CRM, Payment Provider and Game Studio Are Your Biggest Risk
The MGA holds operators responsible for the security of their entire supply chain. Your licence, your players' data, and your regulatory standing depend not just on your own security controls — but on the security of every vendor who has access to your systems or your players' data.
Under GDPR, you are responsible for your players' data even when a vendor holds it.
The MGA's Vendor Risk Expectations
The MGA expects operators to conduct due diligence on all critical technology providers, include security requirements in vendor contracts, monitor vendor compliance on an ongoing basis (not just at onboarding), and have documented procedures for responding to vendor security incidents. DORA has codified and strengthened these expectations into legally binding obligations.
Building Your Vendor Risk Programme
A compliant vendor risk programme for MGA operators includes four stages:
- 1. Inventory: List every vendor with access to your systems or player data. Tier them by criticality.
- 2. Assessment: Security questionnaire, certificate review (ISO 27001, SOC 2), public attack surface scan
- 3. Contracting: DORA-required contractual provisions for critical vendors
- 4. Monitoring: Continuous automated monitoring of critical vendor security posture — via Panorays
Frequently Asked Questions
How many vendors do most MGA operators have?
The average MGA-licensed operator with 200+ employees has 15–30 third-party integrations with varying levels of data access. Each one represents a potential breach vector.
What is the minimum vendor risk programme the MGA will accept?
At minimum: documented vendor inventory, security assessment at onboarding, annual reassessment, contractual security requirements, and incident notification obligations. DORA adds continuous monitoring and formal third-party risk management framework requirements.
Build your DORA-compliant vendor risk programme
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.