Key Takeaways
- The United Arab Emirates now has a federally controlled commercial gaming industry through the General Commercial Gaming Regulatory Authority (GCGRA) which was formed in 2023. There is no commercially regulated gaming that is legal in the absence of a GCGRA license and issuance of a Certificate of Operation.
- The roles of an independent security firm and an independent test laboratory are distinct. While the former conducts the security audit of the enterprise, the latter conducts certification of the gaming platform to technical standards.
- GCGRA has adopted GLI technical standards, and commercial lottery operations also attract the World Lottery Association Security Control Standard. These were new to the region, so operator security teams rarely have prior experience evidencing them.
- The security and audit effort is more extensive than that of the penetration test. It includes architecture, configuration baseline, application and network testing, source code review, ISMS audit, data protection audit, process maturity audit, and sensitive data protection program.
- Findings only count once they are closed. Build remediation and retest into the schedule before the launch date, because the regulator accepts evidence of closure, not a list of open issues.
Typically, operators who enter the UAE market know very well how the process of licensing is done but have a fuzzy idea about what comes next. The process of applying for the license is pretty well-documented. The process that comes after – providing the technical and security information which turns a license-in-principle into a Certificate of Operation – is where delays occur.
Some part of the problem lies in the unfamiliarity. The standards which the GCGRA applies to were not used in the UAE before, hence the talent pool capable of evidencing them is limited. Some part of the problem lies in the sequencing. Testing brings up some problems, problems need to be solved, solutions need to be tested again, and only after that, the regulator gets something to accept.
This guide sets out what GCGRA expects on the security side, what the different assurance roles actually do, and how to plan the work so the evidence is ready when the regulator asks for it.
Key Definitions
- GCGRA: General Commercial Gaming Regulatory Authority, which is the UAE federal authority that regulates, licenses, and monitors commercial gaming. It was established in 2023 and has its headquarters in Abu Dhabi.
- Certificate of Operation: The authorisation issued once a licensee has satisfied its licence conditions and demonstrated operational readiness. Commercial gaming operations may begin only after it is issued.
- Independent Security Firm (ISF): Under GLI’s Gaming Security Framework, the qualified firm that performs gaming security assessments of the enterprise. Regulators rely on it alongside, not instead of, platform certification.
- Independent Test Laboratory (ITL): The test laboratory responsible for testing and certification of system components of the gaming platform based on technical standards such as GLI-19.
- WLA-SCS: World Lottery Association Security Control Standard, based on ISO/IEC 27001, to confirm the maturity level of the lottery’s security and integrity control processes.
- Sensitive Data Protection Plan (SDPP): Requirement of GCGRA for protecting sensitive and regulated data. It is developed through Sensitive Data Service Providers such as ValueMentor.
What Does GCGRA Require Before an Operator Can Go Live?
Before issuing a Certificate of Operation, the GCGRA needs all licence conditions to be met, all pre-launch checklists to be completed, and the operational readiness to be demonstrated. The proof of security and data protection will be included in the operational readiness.
The regulator has accepted GLI technical standards, such as GLI-19 for interactive gambling and GLI-33 for event betting system. The World Lottery Association Security Control Standard should also be considered for lottery operations. In addition to that, there are requirements related to data protection, AML and financial crimes, and responsible gaming.
The practical effect of all of this is that operators have to answer to multiple control languages simultaneously. Each language requests the same thing in different ways and requires different forms of proof. Those operators that take each of these languages separately find themselves doing the same proofing over again.
01. Separate the Two Assurance Roles Before You Budget
This is the distinction that catches operators out. The Independent Test Laboratory certifies your platform. The Independent Security Firm assesses the security of the enterprise that runs it: the architecture, the infrastructure, the configurations, the code, the processes, and the people.
GLI’s own framework is explicit that regulators rely on a qualified security firm as an essential addition to laboratory certification of critical system components. They are complementary, and you will need both. An operator who has booked a laboratory certification and assumes the security obligation is covered has a gap that will surface at the worst possible moment.
Check also that the firm you engage is recognised by GCGRA for this work. Approval status matters to the regulator when it reviews the resulting evidence.
02. Establish the Requirement Baseline Before Any Testing Starts
Identify all requirements for your product in respect of GCGRA, GLI Standards, WLA-SCS, and Data Protection in writing. Map every requirement against the activity that will prove it.
Do this before field work and make sure that the regulator accepts it. Otherwise, you find out in month four that the activity you scoped does not deliver the evidence the regulator expects, which is the most expensive type of rework in a fixed date launch.
Test: can you point to any requirement in the rule book and say what the activity is, what the evidence will be, and who owns it? If you cannot, then the baseline is not done.
03. Treat Data Residency as a Design Input
If the requirement is to keep the regulated data within the UAE, this will influence the way that the assurance activity is actually done. Any offshore test team, remote access to the environment, or cloud-based tooling that manipulates the data outside the country is not available.
Plan for onsite delivery. This takes procurement lead time that operators routinely underestimate. It is also easier to defend to a regulator than a set of documented exceptions.
04. Scope for the Full Breadth of Mandated Work
The security and audit obligations in this sector reach further than most operators expect. Across a pre-launch programme they typically include security architecture review, configuration review and baselining against CIS benchmarks, application security testing, external and internal network testing, and static source code review, alongside compliance work covering a unified gap assessment, an ISMS audit, a data protection audit, an information security process maturity audit, and review of the sensitive data protection plan.
That is a wide set of skills. A firm that is strong in offensive testing but thin on audit, or strong in audit with no testing capability, will leave you coordinating two vendors and reconciling their findings yourself.
05. Get the Sensitive Data Protection Plan Right Early
The sensitive data protection plan is a core GCGRA requirement and must be developed in collaboration with an approved Sensitive Data Service Provider. It is then audited.
Consider the preparation of the plan and its audit as two different events with some time in between. A plan prepared well in advance, with flaws corrected and compensating controls tested, is ready for audit. A plan prepared in the same month it is to be audited is not.
06. Build Remediation and Retest Into the Timeline
Operators always overestimate discovery but underestimate closure. For the regulator, it’s all about the resolved risk, not the identified risk.
Prioritize issues based on business risk and work those most serious risks down first. Put the identified risks through your risk management process, not just leave them sitting in a consultant’s spreadsheet, and then retest formally. If you can’t close an issue prior to launch, document a risk mitigation strategy.
You need to test the controls in the live environment and not just where the issue was identified initially. Working controls in staging do not mean working controls in production.
07. Plan for Compliance After Go-Live
The Certificate of Operation is a gate, not a finish line. Licensees have continuing obligations such as audits, reporting to the regulator, and incident reporting. The regulator is still setting up audit schedules as the market evolves.
The platforms evolve, the threats evolve, and regulatory expectation is still evolving. Make sure you have an assurance calendar for every year, instead of scrambling every year at launch.
| What operators often plan for | What the regulator actually needs |
|---|---|
| Platform certification from a test laboratory | Platform certification plus an independent security assessment of the enterprise |
| A penetration test report | Testing, audit, and data protection evidence mapped to each applicable requirement |
| A list of findings | Evidence that findings were closed and verified, or formally risk-treated |
| Compliance with one familiar standard | A single view across several frameworks that each use different control language |
| Assurance work delivered flexibly, including remotely | Work delivered in line with data residency constraints |
| A one-off pre-launch exercise | A sustained compliance posture with periodic audits after launch |
Summary
The GCGRA is less about a particular test and more about building the case that multiple rule books are complied with, and building it before a certain date. The operators who are effective in managing the compliance do the following three things early: they distinguish between platform certification and security assurance of resources, they agree on the compliance baseline before going into field rather than after, and lastly they allow time to fix and validate their findings. Data residency affects how the work is to be done, therefore should be part of the plan from the start. And once the Certificate of Operation is issued, the obligation continues, which makes a standing assurance calendar cheaper than an annual scramble.
ValueMentor is an independent security firm approved by GCGRA to perform security testing and audits for the commercial gaming sector, and supports commercial gaming operators, casino operators, and gaming service providers from pre-licence readiness through to continuous compliance.
Frequently Asked Questions
Yes. Free zone incorporation does not remove the need for GCGRA authorisation to conduct lawful commercial gaming, and it offers no protection against enforcement for unlicensed activity aimed at UAE consumers.
What is an Independent Security Firm, and how is it different from a test laboratory?
The test laboratory certifies your gaming platform’s critical system components against technical standards. The Independent Security Firm assesses the security of the enterprise around that platform: architecture, infrastructure, configurations, code, and processes. Regulators use both.
Can our existing penetration testing vendor do this work?
Only If they have been approved by the regulator to do so and can also provide the audit and data protection services. A vendor that provides only testing means that you will have to find your own ISMS audit, data protection audit, maturity assessment, and sensitive data protection review service.
Does an ISO 27001 certificate satisfy GCGRA?
No, though it helps. WLA-SCS is built on ISO 27001, so an established ISMS gives you a strong base. The regulator still requires the specific activities and evidence set out for the sector.
How long does the pre-launch security and compliance programme take?
It depends on the size of the estate and the maturity of your controls. A realistic programme runs for several months and must accommodate discovery, remediation, and retesting rather than testing alone.
Can any of the assessment work be done from outside the UAE?
In regard to where the data residency requirement applies to both regulated and gaming data, take it to be a “no” and make your plans on doing the work in-house using a licensed tool.
What happens after we receive the Certificate of Operation?
Ongoing supervision. You will need to undergo periodic audits, regulatory reporting, incident notification, and re-evidencing as your platform evolves.
Who can develop our Sensitive Data Protection Plan?
The plan is developed together with the approved Sensitive Data Service Provider, after which it is audited. Make sure to leave enough time between developing the plan and its audit to fix any gaps.
