A Licence Is a Piece of Paper Without Banking

Thirteen years ago, a shell company and a single bank account were enough to launch an iGaming or payments business. Curaçao ran sub-licences without asking who actually operated behind them, and “compliance” was mostly a formality between the platform and its lawyer.

That model is gone. Curaçao rebuilt its licensing regime from the ground up, MiCA brought crypto under EU-wide supervision, and the licence itself stopped being the finish line — for most operators today, it's the easy part.

We spoke to Roman Baranovskyi of SBSB Fintech Lawyers about what decides whether a regulated business survives its first year, and where founders still get it wrong.

iGaming News: Let's start with the basics — please tell as about yourself and what SBSB do day to day across iGaming, fintech and crypto.

Roman Baranovskyi: My name is Roman, and I lead the iGaming and Investment Practice at SBSB Fintech Lawyers. We've worked as a legal advisory partner for iGaming, fintech, digital assets and payments businesses for over thirteen years now, and the work always comes down to the same three things: licensing, corporate structuring across jurisdictions, and building financial infrastructure that actually survives contact with a bank's risk department.

On the iGaming side, we take operators through fast, agile frameworks like Anjouan or Tobique when speed matters, and through the more demanding onshore routes — Malta's MGA, the UK — when an operator needs the credibility that comes with them. Curaçao used to be the quick option in between; since its 2024 reform it now asks for a local office and a resident director the same way Malta does, so today it's a cost-and-tax play more than a speed one.

In crypto and Web3, we handle CASP licensing under MiCA for the EU market and VASP registration in jurisdictions outside it, and we structure tokenomics and smart-contract mechanics so they hold up under FATF's Travel Rule. In fintech and investment, we do the same work in Cyprus, Labuan, the UAE — wherever the client's target markets point us.

But the licence is never the point on its own. A licence without a bank account behind it is just a document. A large part of what we do is the unglamorous part: ring-fencing entities, opening segregated accounts, setting up EMI and PI structures, building crypto on-ramps and off-ramps that a compliance officer will actually approve.

iGaming News: You describe SBSB's approach as “A to Z.” What does that look like for a client who's starting from nothing?

Roman Baranovskyi: It means we stay with a client from the first structural decision to the day money actually moves. Jurisdiction selection, incorporation, the licence application itself, and then banking and payment processing — we don't hand any of that off.

The legal work is never generic. For a brokerage, that means MiFID-compliant risk disclosures and best-execution policies written for that specific business. For a gambling operator, it means AML/KYC protocols and RNG verification packages built to survive an actual regulatory audit — the kind that goes deeper than looking complete on paper.

We also sit in on the technical side, because regulators check it. If a platform's MT4/MT5 integration or its gaming servers don't meet the data security standards a regulator expects, that platform fails its audit regardless of how clean the legal documents are — so we review the stack before it becomes a problem.

And then there's payments, which is where most of these projects actually stall. A licence doesn't accept a deposit. We use our banking network to open corporate accounts, set up segregated client-money accounts for brokers, and connect operators to high-risk PSPs and crypto gateways that will still be there in a year.

iGaming News: With thirteen-plus years in the market, how have you seen regulation around iGaming, payments and crypto evolve?

Roman Baranovskyi: Thirteen years ago a licence was close to a formality — check a box, get a certificate, open a bank account, done. What we've watched since then is the professionalisation of the whole model, market by market.

Curaçao is the clearest example. Under the old system, one master licence covered an unlimited number of sub-licensees, and nobody was checking who actually ran what. The new LOK framework ended that: direct regulatory oversight, mandatory local substance, documented AML audits. That's also what opened the door for Anjouan, Nevis and Tobique — operators who wanted speed without Curaçao's new bureaucracy had to go somewhere, and those jurisdictions built clean, modern frameworks to catch that demand.

The same shift happened in fintech and investment — tighter capital requirements, stricter marketing restrictions, client fund segregation enforced across Europe, Latin America and Asia at roughly the same time. Servicing a global client base from one entity stopped being viable, so we spent years moving clients into multi-jurisdictional group structures instead.

Payments and crypto changed the most, though. As Tier-1 banks pulled back from one high-risk vertical after another, EMIs, PIs and specialised high-risk PSPs went from a niche workaround to the actual backbone of the industry. And crypto stopped being an unregulated frontier: MiCA and the FATF Travel Rule now hold crypto processing to the same AML, KYC and source-of-funds standard as a traditional bank.

iGaming News: When a client approaches SBSB today, what jurisdictions or business models are they usually looking at?

Roman Baranovskyi: It splits by stage. Startups and fast-moving operators who need to launch quickly go for Anjouan, Nevis, Tobique or Costa Rica — predictable timelines, accessible capital requirements. Established, well-funded brands go the other way, toward Curaçao under its new framework, Kahnawake, or Malta — more capital, mandatory local substance, longer approval cycles, but the institutional weight that comes with them.

In fintech, investment and crypto, almost nobody wants a single entity anymore. Clients want an onshore hub that builds trust with banks and payment processors, paired with an operational entity that can scale internationally.

And across all of it, the real demand is the same: banking. A licence is half the job. Clients come to us to connect it to multi-currency EMI accounts, high-risk PSPs and MiCA-compliant crypto gateways — because without that, the licence doesn't do anything.

iGaming News: How do you structure a company that wants to run iGaming, fintech and crypto under one roof?

Roman Baranovskyi: The rule is segregation. A regulator won't let one entity hold customer deposits for a fintech product and run an online casino at the same time — mixing those risk profiles in a single company makes banking nearly impossible and creates exposure no bank wants to underwrite.

So we split the business into purpose-built layers: the customer-facing iGaming platform sits under its own licensed entity in the right gambling jurisdiction, fintech services and payment gateways sit in their own regulated structure, and a holding or IP company sits above both to protect the brand and the technology from operational liability.

What makes that work is that every interaction between those entities — a payment gateway routing funds, one company licensing software to another — runs through a proper Service Level Agreement and documented intercompany pricing. When a regulator or a partner bank looks at the group, they need to see a clean, traceable flow of money between separate, compliant entities, each operating under its own licence.

iGaming News: What are the key differences between mature markets like the EU or UK, and emerging jurisdictions?

Roman Baranovskyi: It comes down to trust versus speed. An MGA licence or an EU financial services authorisation officially runs around six months, but for a first-time applicant the real timeline often stretches toward a year — longer if banking drags — on top of capital reserves, a physical local office and resident directors.

Emerging jurisdictions — Anjouan, Tobique, Nevis — offer the opposite: some process applications in a matter of weeks, with lower capital requirements and none of the local-substance demands. That makes them the right choice for a startup that needs to launch an MVP and test the market before committing serious capital.

Curaçao doesn't fit neatly into either category anymore. Since its 2024 reform it asks for the same local office and resident director Malta does, and a realistic six-to-eight-month timeline — the speed advantage it used to have over Malta is mostly gone. What it still offers is a lower cost base and no tax on gross gaming revenue, which is why we place it with the established, well-funded operators now.

We don't treat mature versus emerging as a choice you make once. Most of our clients launch in an agile jurisdiction first, build cash flow and traction there, and use that success to fund the heavier compliance work a mature market demands later.

iGaming News: Crypto keeps converging with gaming and payments. Where's the most meaningful regulatory progress happening?

Roman Baranovskyi: For years crypto sat in a grey area — a payment workaround more than anything else. What's changed is that regulators have moved from vague guidance to actual statute: MiCA is now fully in force, and the FATF Travel Rule is enforced globally.

What matters more than the rules existing is what they signal — regulators are treating crypto as real financial infrastructure now, not a loophole. We're seeing clear guidance on stablecoin settlement, crypto-to-fiat on-ramps, self-custodial wallet interactions. That gives operators room to build web3 gaming mechanics and automated payment flows without waiting for a crackdown.

The mistake we still see is operators assuming crypto exempts them from AML, KYC and source-of-funds checks, or launching a tokenised platform before the banking and exchange rails behind it are locked in. A crypto-enabled iGaming platform is held to the same reporting standard as a fiat institution today. Treat crypto as a regulated, high-efficiency layer of your financial architecture.

iGaming News: What role do EMI, PI and banking licences play in building a sustainable iGaming or fintech business now?

Roman Baranovskyi: They're the backbone of the business. A gaming or investment licence without a stable, compliant home for your funds is a piece of paper you can't use — and as Tier-1 banks kept de-risking high-risk industries, EMIs, PIs and specialised banking licences became the thing that actually keeps operators running.

An EMI account gives an operator multi-currency capability, automated payouts, merchant processing that can handle the transaction volume and compliance load a retail bank won't touch.

The bigger shift, though, is away from relying on one bank. A single EMI is a single point of failure — if it changes its risk appetite overnight, operations freeze. We build our clients' financial stacks with redundancy: a full banking licence for primary holding and safeguarding, alongside multiple EMIs and PIs for daily processing and local payment methods.

Investors and institutional partners notice this now, too. When they evaluate a business, they look past revenue to the stability of its banking channels — because that's what tells them whether the business can keep operating.

iGaming News: From a legal perspective, what's the most common mistake companies make when they scale internationally too fast?

Roman Baranovskyi: Speed overriding strategy. Teams treat global compliance as something to backfill later instead of something to plan for from the start.

The most common version: assuming one licence is a global passport. Operators launch marketing campaigns and accept users in new markets without checking local tax nexus or regulatory exposure — and holding a licence in one country doesn't make your activity legal in another. Nigeria's operators found that out the hard way in 2024, when a Supreme Court ruling handed gambling regulation to the states overnight and a federal licence stopped covering anything beyond the capital. That's the kind of exposure — enforcement, blocked domains, local tax liability, sometimes criminal penalties — that waiting until after launch to check local law actually costs you.

The second version is copy-pasting compliance. Terms and conditions or AML/KYC procedures that satisfied one regulator rarely satisfy another — local rules on consumer protection, data sovereignty and source-of-funds verification differ enough that a generic template is itself a red flag to a bank or regulator.

And the third: neglecting corporate architecture and IP protection until something forces the issue. Operations that were never properly ring-fenced, intercompany agreements that were never documented — that's exactly what surfaces during due diligence when a company tries to raise capital or sell, and by then it costs far more to fix than it would have to structure correctly at the start.

iGaming News: Compliance technology and RegTech keep coming up. How is automation changing licensing and compliance management?

Roman Baranovskyi: It's turned compliance from a manual bottleneck into something that runs in the background. Automated identity verification and biometric KYC screen users against PEP and sanctions lists in seconds instead of days, which cuts signup drop-off without cutting corners. Transaction monitoring now flags suspicious patterns or fraud in real time, without interrupting a legitimate customer.

It's also changed how licences get maintained. Regulators increasingly expect continuous compliance and automated reporting — the periodic paper audit is on its way out — so RegTech built into a platform's own architecture lets a compliance team track licence conditions across multiple jurisdictions and adjust workflows as rules change, instead of finding out after the fact.

Digital-asset firms alone accounted for nearly a quarter of the ten largest AML fines issued worldwide in 2025, according to one of the industry's standard enforcement trackers, and most of those cases trace back to manual review that couldn't keep pace with transaction volume — exactly the failure point automated monitoring is built to catch before a regulator does.

That's what lets a business scale its user base without scaling its legal headcount at the same rate. The operators doing well now built RegTech into their infrastructure from day one.

iGaming News: Looking across Europe, LATAM, MENA and Africa — where's the strongest momentum for new market entry right now?

Roman Baranovskyi: LATAM, clearly. Brazil's regulated framework under Law 14.790 turned the country into a multi-billion-dollar onshore market overnight — real local presence, grant fees, local payment rails like Pix. Peru, Colombia and parts of Argentina are following the same path, and LATAM has gone from an opportunistic market to a long-term priority for the operators moving fastest to build local structures and payment processing.

In the UAE, the GCGRA issued the country's first licensed operator in December 2025 — an internet gaming and sports-wagering platform called Play971 — and from June 2026 a new civil code removes the articles that made gambling contracts legally void in the first place. That's made the Emirates a serious regional hub for web3 gaming and fintech, with a framework built specifically for institutional-grade operators.

Sub-Saharan Africa keeps growing too, driven by mobile-first sports betting, but it's a genuinely different kind of market. Where Brazil got one clean federal law, Nigeria is going through the opposite — active fragmentation. Since its Supreme Court ruling in 2024, gambling regulation belongs to the states, which turned one national market into as many as thirty-seven separate ones. The industry answered with its own fix — a coalition of more than twenty state regulators now runs a shared licence that lets an operator apply once and work across every member state, which tells you how much appetite there is for a workaround when the law itself won't consolidate.

Kenya and South Africa are steadier by comparison — established regulators, mobile-money rails like M-Pesa built into the betting flow — but scaling across the three means treating each one as its own market, with its own tax structure and payment rails.

iGaming News: Last question — what's your advice to founders scaling in a highly regulated space who don't want to blow up their compliance along the way?

Roman Baranovskyi: Treat your legal and financial architecture as a product feature you design in from day one. Founders who backsolve compliance after building the platform typically end up paying three to five times more to fix a flawed structure or an unlicensed model than they would have spent getting it right from day one — and that multiple doesn't count the time lost while everything else stalls.

Three things matter most. Build a diversified financial stack early — redundant EMI, PI and banking relationships, so no single institution's change of appetite can freeze your operations. Keep your legal structure modular — ring-fence your operating entities, your IP, your payment gateways into separate vehicles, so risk in one doesn't sink the rest. And treat automated KYC and real-time monitoring as an infrastructure decision made on day one, before volume outgrows what a manual team can actually review.

Do that, and you're not scrambling to explain a messy structure the first time someone official asks to see it. Pick one of the three and put it in motion this quarter — before the next funding round or licence renewal forces your hand.

Roman Baranovskyi is Head of iGaming and Investment Practice at SBSB Fintech Lawyers, advising crypto and gambling operators on licensing across more than 90 jurisdictions.