A confidential compliance investigation commissioned by Evolution has raised a much bigger question than whether one casino supplier failed to prevent its games from reaching certain markets: who is ultimately responsible for knowing where an online casino player is located?
The Spectrum Gaming Group report, which has now entered the public record through litigation in New Jersey, found compliance deficiencies connected with Evolution games being accessible in jurisdictions where they were prohibited, including Hong Kong, Singapore, the United Arab Emirates and Saudi Arabia. Reporting on the document also indicates that Evolution received revenue connected with operators making its content available in some restricted or grey markets.
That matters because Evolution is one of the largest B2B suppliers in online gambling rather than a casino operator dealing directly with individual players. The company says it has around 870 operators among its customers and approximately 22,900 employees, while its regulatory footprint includes licenses or registrations across markets including Malta, Great Britain, Belgium, Sweden, Denmark, Romania, South Africa, several Canadian provinces and US states.
For the casino-app industry, the case exposes a difficult reality. A game may appear on a player's smartphone in seconds, but behind that screen is a chain of companies, servers, contracts and compliance systems. When one link fails, determining who should have stopped the player can become surprisingly complicated.
From Your Phone to a Live Casino Studio: What Actually Happens?
A player opening a live roulette table may feel as though the casino app itself is providing the game. Technically, the relationship can be considerably more complicated.
A simplified casino-content chain looks something like this:
Player → Casino App/Website → Operator → Aggregator or Platform → Game Supplier → Live Casino Studio/Game Server
The casino operator owns the relationship with the player in most cases. It registers the account, performs KYC checks, processes deposits and withdrawals and determines whether the customer should be permitted to gamble.
The game supplier, meanwhile, provides the actual gaming content. Between those two companies, there may also be an aggregator providing hundreds or thousands of games from multiple studios through a single technical integration.
That structure has helped online casinos scale quickly. Instead of integrating separately with 50 game developers, an operator can connect to an aggregation platform and receive a huge catalog through fewer integrations.
But aggregation creates another compliance layer.
The supplier may have a contract with an aggregator, while the aggregator supplies an operator, which ultimately serves the player. Consequently, the company producing the game can be several steps removed from the person actually placing the bet.
The Spectrum findings put that distance under scrutiny.
What Did the Evolution Commissioned Review Find?
Spectrum reportedly identified significant shortcomings in the compliance controls it examined, including insufficient proactive monitoring of customer-facing operators and problems surrounding contractual obligations. The report also identified circumstances involving virtual currencies that warranted enhanced due diligence.
According to reporting on the disclosed document, Evolution received revenue from operators offering its games in markets including Hong Kong and Singapore. Importantly, the findings concerned access through downstream operators rather than a conclusion that Evolution itself was directly operating consumer-facing casinos in those jurisdictions.
There is also an important distinction concerning some of the most serious allegations. The original controversy included claims involving US-sanctioned jurisdictions such as Iran and Syria. Reporting on Spectrum's investigation says it did not establish evidence supporting those allegations. Playtech, however, has subsequently argued that Spectrum was unable to confirm or refute certain questions because requested gaming-session and revenue information was not provided. Those are materially different conclusions from proving that Evolution knowingly operated there.
The distinction is important because this remains an active legal dispute, and Evolution has consistently challenged the allegations surrounding the original investigation.
How Does an Online Casino Determine Your Location?
The obvious answer is an IP address, but modern gambling geolocation can involve considerably more.
An operator can examine the player's IP address and compare it with geolocation databases to estimate the country or region from which the connection originates. In tightly regulated markets, additional technologies can potentially examine device location, GPS information, Wi-Fi networks, mobile signals, device characteristics and suspicious changes in connection behavior.
Then comes VPN detection.
A VPN can make a connection originating in one country appear to come from another. Compliance technology can attempt to identify IP addresses associated with VPN providers, proxies, hosting companies and data centers, but the process is not infallible.
An operator could know considerably more about the player than the game provider does. The supplier may receive technical information about the gaming session without controlling the customer's account, KYC documentation or payment relationship.
That creates the central tension exposed by the Evolution case.
Who Should Block the Player?
Historically, B2B suppliers have had a straightforward argument: the operator controls the customer.
There is considerable logic behind that position. The casino decides who can register, verifies identity, accepts deposits and determines the jurisdictions it targets. A game studio cannot necessarily perform a second full KYC investigation every time somebody opens blackjack.
But regulators increasingly expect compliance to extend through supply chains.
If a supplier repeatedly sees substantial volumes of traffic or revenue originating from markets where its games should not be available, simply pointing to the operator contract may eventually become insufficient.
This is where continuous monitoring becomes important.
A sophisticated supplier compliance system can potentially analyze traffic by operator, country, currency, domain and aggregator. Unexpected activity could automatically trigger investigation or suspension.
The future of supplier compliance may therefore increasingly resemble financial anti-money-laundering monitoring: companies will not merely establish rules when a contract is signed; they will be expected to identify unusual patterns throughout the commercial relationship.
Crypto Makes the Problem Harder
The Spectrum findings concerning virtual currencies are particularly relevant in 2026 because crypto has become deeply integrated into parts of the international casino market.
Traditional payments provide multiple geographical and compliance signals. A bank account, card issuer, billing address and payment provider can all contribute information about a customer's identity and location.
Cryptocurrency can remove some of those signals.
A blockchain address does not automatically tell a casino that its owner lives in Singapore, Dubai or London. Operators therefore need to combine blockchain analytics with KYC, IP intelligence, account monitoring and source-of-funds controls where required.
Spectrum reportedly found instances where virtual-currency wagering should have resulted in enhanced due diligence.
That finding is potentially more important for the wider industry than the individual countries named in the dispute. Crypto casinos are increasingly forcing regulators and suppliers to decide how much due diligence should exist beyond the consumer-facing operator.
Evolution's Scale Makes the Case Important
This would be a relatively narrow compliance story if it concerned an obscure software studio. Evolution's position changes the significance.
The group provides fully integrated B2B online-casino products to hundreds of operators and holds regulatory approvals across numerous major gambling jurisdictions. Its portfolio and infrastructure make it part of the plumbing of modern online casino gaming.
There is also important historical context. In 2024, the New Jersey Division of Gaming Enforcement closed its earlier investigation without taking action against Evolution. At the time, the regulator found no evidence that Evolution had sanctioned, promoted, permitted or materially benefited from content being offered by operators in jurisdictions New Jersey considered prohibited.
The newly disclosed Spectrum material does not automatically reverse that regulatory outcome. Instead, it introduces additional information into the public debate over how Evolution's internal and downstream compliance controls operated.
That distinction should not be lost amid dramatic headlines.
The Bigger Question: Where Does Supplier Responsibility End?
The Evolution controversy may ultimately become part of a much broader regulatory shift.
Online gambling regulation was traditionally concentrated on the company holding the relationship with the player. But modern casino apps rely on interconnected ecosystems of operators, game developers, aggregators, payment processors, identity-verification companies, cloud providers and affiliate networks.
Regulators increasingly have reasons to examine the entire chain.
For suppliers, that could mean stronger contractual controls, automated jurisdiction monitoring, audits of downstream partners, VPN and proxy detection, cryptocurrency due diligence and faster suspension procedures when unusual traffic appears.
For aggregators, it could mean becoming much more than technical distributors. They may increasingly function as compliance gateways between hundreds of operators and suppliers.
And for casino players, there is a useful lesson: the game visible on a casino app is not necessarily operated by the company whose logo appears on the roulette table.
The app is only the front end of a much larger infrastructure.
The Evolution case therefore asks one of the most important technology-regulation questions facing online gambling in 2026: if every company in the supply chain controls only one part of the player journey, who is responsible when the complete journey crosses a prohibited border?
Increasingly, regulators may decide that the answer is not one company - but everyone involved.
References / Works Cited
Financial Times. (2026, September 8). Gaming group Evolution’s own report found it made money in banned markets. Financial Times. The report says Spectrum corroborated access to Evolution games in prohibited markets including Hong Kong, Singapore, the UAE and Saudi Arabia, while finding no evidence supporting the Iran and Syria allegations.
Financial Times - Evolution investigation
iGaming Business. (2026, September 10). Read the full Spectrum Gaming Group report. iGaming Business. The publication reports that the unsealed Spectrum review raised concerns about prohibited-market availability, regulatory implications and Evolution's monitoring of customers, while also noting Spectrum did not conclude that Evolution had engaged in illegal practices.
iGaming Business - Full Spectrum Gaming Group report
iGaming Business. (2026, September 9). Playtech highlights Evolution compliance failures as Spectrum Gaming report is released. iGaming Business. This is particularly useful for presenting Playtech's position and the limitations Spectrum reportedly encountered when seeking information from Evolution.
iGaming Business - Evolution compliance findings
Asia Gaming Brief. (2026, September 9). Evolution-commissioned report flags access from prohibited Asian markets. AGB. The report covers downstream operator access, alleged weaknesses in contractual monitoring and circumstances involving virtual currencies that should have triggered enhanced due diligence.
Asia Gaming Brief - Evolution commissioned report