Ontario Built the Market
Now Build the System.
A teaching and learning deep dive into Ontario iGaming regulation, system design, supplier risk, transparency and reform
Recover With Sara | Policy explainer and reform blueprint
Why I am looking at Ontario as a system
The more time I spend looking at online gambling, the less useful it becomes to think in terms of individual websites. A website is only the surface. Behind it can sit operators, suppliers, aggregators, platform companies, payment providers, affiliates, customer-support teams, data processors, intellectual-property owners, corporate groups, regulators and consumers.
That is why this post is not really about asking for "more regulation." It is about asking whether Ontario can evolve from regulating individual entities into understanding the relationships between them.
The central systems question is not only: did one company comply? It is also: what did the system allow to happen between companies, across suppliers, across brands and across corporate restructurings?
Ontario already has many of the right building blocks. The interesting part is what happens if those building blocks are connected more deliberately.
The three documents that matter
Three AGCO documents are especially useful for understanding the architecture of Ontario's approach: the Internet Gaming Notification Matrix, the entity-level Registrar's Standards, and the broader risk-based standards framework that explains why Ontario moved toward outcomes-based regulation. Read together, they reveal a model built around controls, accountability, evidence, notification and regulatory assurance.
1. The Internet Gaming Notification Matrix
The Notification Matrix sets minimum reporting expectations for internet gaming operators and Gaming-Related Suppliers. Its significance is not only the individual items listed. The bigger point is that Ontario expects regulated entities to understand what is materially relevant to the regulator and to communicate openly when important events occur.
The Matrix also requires operators to maintain an up-to-date supplier picture and, historically, has contemplated suppliers within the operator's own corporate structure as well as third-party suppliers such as marketing affiliates. That matters because it recognizes that the regulated system extends beyond the name on the website.
The gap is that a supplier list is not the same thing as a supply-chain map. A list may tell the regulator who directly provides services to an operator. It may not explain who supplies the supplier, who redistributes the supplier's product, which domains receive it, which related companies are involved, or how the relationship changes over time.
2. The entity-level Registrar's Standards
The entity-level standards are the heart of the control environment. They require formal control activities, independent assessment, periodic review for effectiveness, documentation of deficiencies, remediation, management accountability, training and record retention.
One word matters enormously: effectiveness. A control does not become meaningful merely because it exists on paper. The regulatory question is whether it works.
This creates an assurance model that looks a lot like modern internal-control and risk-management practice: define the objective, identify the control, test the control, document weaknesses, remediate them, keep evidence and make the system available for regulatory review.
The framework also recognizes downstream accountability. Operators and suppliers are expected to monitor compliance with control activities not only by employees, but by those providing goods and services to them. That means outsourcing does not automatically outsource regulatory responsibility.
3. Ontario's risk-based regulatory philosophy
Ontario deliberately moved away from trying to prescribe every operational step. Instead, the system focuses on regulatory outcomes and expects regulated entities to design controls capable of achieving them. That model can be more adaptable in a fast-moving technology market, but only if assurance is strong.
In a risk-based system, the real engine is the risk assessment itself: identify the hazard, assess likelihood and consequence, determine inherent risk, apply controls, measure residual risk, monitor and reassess.
If Ontario asks companies to manage risk, then the next question is unavoidable: risk to what, from whom, through which relationships, and based on what evidence?
The systems gap: Ontario is good at nodes, but needs stronger visibility into edges
Think of the market as a network. The nodes are operators, suppliers, people, brands, payment companies, affiliates and platforms. The edges are the relationships between them: owns, controls, supplies, markets, processes payments for, licenses intellectual property to, provides customer support to, aggregates content for, or acquired assets from.
Traditional regulation is usually good at identifying nodes. Systems regulation must also understand the edges.
That matters because risk can move even when the original company name does not. A brand may move. A trademark may move. A customer-support contract may move. A platform may remain the same. A beneficial owner may remain the same. A player database may move. A supplier relationship may move. The legal shell can change while the operational continuity remains material.
Reform 1: require a Pre-Regulation Ontario Activity and Transition Statement
Ontario should require every operator entering the regulated market to provide a factual history of any prior Ontario-facing activity. I would avoid making the legal test depend on the phrase "grey market." The facts are more useful than the label.
The statement should identify when Ontario consumers were accepted, which legal entity contracted with them, which domains and brands were used, which platform operated the accounts, which suppliers supported the business, which licences were relied upon, and when Ontario-facing activity ceased or changed.
Then ask the harder question: what happened to the business?
• Were accounts closed, migrated, sold or transferred?
• Were player balances transferred?
• Did another entity assume the contracts?
• Did the brand or trademark move?
• Did the customer database move?
• Did the platform remain the same?
• Did affiliates, payment relationships or customer support remain?
• Did the beneficial owners remain materially the same?
"We stopped" and "we transferred it" are not the same answer. And "we transferred it" and "we transferred it to another company we control" are not the same answer either.
Reform 2: make corporate history permanent and temporal
Ontario should stop treating corporate information as a snapshot. Regulatory identity should be historical and time-stamped.
Instead of recording only "Company X owns Brand Y," record "Company X owned Brand Y from Date A to Date B." Do the same for control, trademark ownership, operating entities, platform relationships, supplier relationships and material support arrangements.
This allows the regulator to reconstruct the system as it existed when an event actually happened. It also prevents corporate restructuring from erasing the trail.
Reform 3: publish the brand, trademark and operating chain
Consumers should be able to identify the legal and commercial structure behind a regulated brand without becoming amateur corporate investigators.
For each Ontario-regulated brand, a public profile should show:
• Current legal operator
• Approved Ontario domains
• AGCO registration identifier
• Ontario market-entry date
• Current trademark owner
• Previous trademark owners where relevant
• Material changes in operating entity
• Material restructurings or transfers
• Complaint route
• Privacy contact
• Public enforcement history
The point is not to publish confidential commercial information. The point is to make responsibility visible.
Reform 4: disclose material related gaming interests
The regulator should not look only at the company holding the Ontario registration. Significant owners, beneficial owners, controlling persons and key decision-makers should disclose material ownership or control interests in other gambling-related businesses.
This could include operators, suppliers, platforms, game studios, aggregators, affiliate networks, marketing companies, payment businesses, white-label providers, software businesses, IP-holding companies and other businesses materially connected to gambling.
The legal test should focus on material control, influence or economic interest, not trivial passive investment. The point is to understand the economic system without collapsing separate legal entities into one another.
Reform 5: require disclosure of casino operational support outside Ontario
One of the most important reforms is to look beyond ownership and ask who actually helps a gambling business operate.
A non-Ontario-regulated gambling operator may be legally separate from an Ontario registrant, yet still rely on an Ontario registrant or related company for material operational support. That support may include customer service, CRM access, account administration, payments support, KYC, fraud monitoring, VIP operations, platform management, hosting, marketing, affiliate management, technical support, complaint handling or compliance functions.
The regulatory trigger should therefore be material operational support, not merely ownership.
Regulatory relevance should follow operational capability, access and knowledge, not only share ownership.
The anonymous hypothetical
Imagine Casino Operator A operates outside Ontario's regulated market. Service Company B does not own the casino, but B's employees answer player complaints, access customer accounts, work inside the CRM, handle escalations or provide other material back-office support.
Company B, its parent, its owners, or a related company also participates in Ontario's regulated ecosystem.
The right questions are not
automatically "Does B own A?" or "Are they the same company?" The better questions are:
• What does B actually do?
• What systems can B access?
• What data can B see?
• What decisions can B make?
• Does B know which jurisdictions the supported operator serves?
• Can B identify Ontario residents inside those systems?
• What happens if Ontario exposure is detected?
• Can B escalate, restrict or terminate service?
• Does the relationship create Ontario-specific regulatory risk?
Reform 6: create an Ontario Regulatory Perimeter Risk Assessment
Every material supplier should complete an Ontario-specific risk assessment addressing the likelihood that its products, services, distribution arrangements, related entities or operational relationships could contribute to activity affecting Ontario outside the regulated framework.
The assessment should be recurring, not a one-time onboarding exercise. At minimum it should be completed annually and after material changes such as acquisitions, restructurings, new distributors, new jurisdictions, ownership changes or significant incidents.
A robust assessment should cover:
• Distribution architecture
• Downstream customers
• Sub-distribution and aggregation
• Authorized jurisdictions
• Known domains
• Ontario geolocation controls
• Affiliate exposure
• Related-company exposure
• Historical Ontario-facing activity
• Trademark and brand transfers
• Payment relationships
• Termination and escalation controls
• Evidence that controls are actually effective
Use a real risk methodology
The model should look like a genuine enterprise-risk assessment, not a checkbox exercise:
Risk
Likelihood
Impact
Controls
Residual Risk
Unauthorized Ontario deployment
Possible
Major
Domain restrictions; monitoring; contractual limits
Medium
Unauthorized onward distribution
Possible
Major
Distributor approval; technical keys; audits
Medium
Ontario-targeted affiliate acquisition
Possible
Moderate
Affiliate controls; geo rules; monitoring
Medium
Operational support exposes Ontario players
Possible
Major
Escalation rules; jurisdiction checks; termination rights
Medium
If a supplier says the residual risk is low, the regulator should be able to ask: why? Show the contract. Show the audit. Show the logs. Show the monitoring. Show the incident history. Show me the evidence.
Reform 7: make suppliers file their own annual Statement of Assurance
Ontario already uses an annual assurance concept for operators. A logical next step is a supplier-specific annual assurance statement for material Gaming-Related Suppliers.
That statement should certify, after reasonable inquiry, that the supplier has identified its material Ontario regulatory risks, tested its key controls, documented deficiencies, completed remediation, and disclosed material changes.
A named accountable senior officer should sign it. Corporate accountability becomes much more meaningful when someone identifiable owns the attestation.
Reform 8: replace supplier lists with critical supply-chain mapping
Do not abolish the supplier list. Expand it.
For critical relationships, Ontario should be able to see the chain: operator to platform, platform to aggregator, aggregator to game supplier, operator to affiliate, affiliate to sub-affiliate, operator to PSP, PSP to acquirer, and so on.
The objective is not to map every trivial vendor. It is to identify relationships capable of creating regulatory, financial, player-protection or jurisdictional risk.
Reform 9: create permanent regulatory identifiers
Every regulated operator, Gaming-Related Supplier and regulated brand should have a persistent identifier that survives name changes, reorganizations, transfers and corporate restructurings.
Brands change. Domains change. Companies merge. Regulatory identity should not disappear with them.
Reform 10: make the evidentiary burden reflect information asymmetry
The operator knows the account. The affiliate knows acquisition. The payment provider knows the transaction. The platform knows deployment. The supplier knows distribution. The consumer often sees only fragments.
That is why a player-dispute or regulatory-intelligence system should recognize information asymmetry.
The strongest legal model is not "believe the player automatically." It is a two-stage model:
• Stage 1: the consumer establishes a credible prima facie case using evidence reasonably available to them.
• Stage 2: for facts uniquely or predominantly within the operator's control, the operator must produce the relevant records.
Where records were legally required to be retained but cannot be produced, legislation or adjudicative rules could permit an appropriate adverse inference, subject to procedural fairness.
Reform 11: consumer restitution must be distinct from fines
A regulatory penalty punishes non-compliance. Restitution addresses consumer harm. Those are not the same thing.
Ontario should explore a statutory restitution mechanism for defined cases where regulatory misconduct causes demonstrable consumer loss. That could include improperly withheld funds, defined self-exclusion failures, unlawful or non-compliant treatment of player balances, or other serious findings where a direct causal loss can be established.
This should not become gambling-loss insurance. The trigger should be substantiated regulatory failure and defined compensable harm.
Reform 12: create a player protection fund
Ontario could also consider an industry-funded player protection fund for extraordinary cases. The fund could be financed through designated regulatory assessments, a portion of monetary penalties or other legislatively authorized contributions.
Its purpose would be remedial, not punitive: to address defined categories of consumer harm where ordinary dispute resolution is insufficient.
Reform 13: fines must be economically meaningful
The deterrence question is not whether a fine looks large in isolation. It is whether the expected cost of non-compliance exceeds the expected benefit.
Expected cost of non-compliance = probability of detection × expected sanction.
For serious violations, penalties should consider the commercial benefit obtained, duration, number of consumers affected, degree of knowledge, previous violations, cooperation and remediation. Repeat breaches should become progressively more consequential rather than simply producing interchangeable fixed penalties.
Reform 14: build an incentivized whistleblower program
Ontario should create a specialist whistleblower channel for employees, former employees, contractors, suppliers, affiliates, payment professionals, developers, compliance staff and others with original inside information.
The program should protect good-faith whistleblowers, separate them from ordinary consumer complaints and, where legally designed to do so, consider financial awards when original, verifiable information materially contributes to a significant regulatory or enforcement outcome.
Pay for evidence, not allegations. A rumour gets nothing. Recycled public information gets nothing. Original documentary evidence that materially advances enforcement is different.
Reform 15: create a separate regulatory intelligence portal
Ontario should distinguish three different information streams:
• Consumer complaint
• Protected whistleblower disclosure
• Regulatory intelligence submission
A sophisticated consumer or researcher should be able to submit domains, payment descriptors, corporate relationships, supplier connections, historical records, screenshots or other documented patterns without forcing the submission into an ordinary customer-service complaint form.
Reform 16: mandatory public privacy accountability
Every Ontario gambling operator should have a clearly published, functioning privacy contact. Whether Ontario calls the role a Privacy Officer, Chief Privacy Officer or uses another title, the function should be real and reachable.
The regulator should periodically test the contact route. A privacy policy that names an email address nobody can reach is not an effective privacy control.
Reform 17: mandatory regulatory training and examinations
Ontario already expects training in important areas such as responsible gambling. The next step is to formalize role-based competency across high-risk functions.
Customer support, VIP teams, payments, marketing, affiliate management, privacy, complaints, compliance and senior management should each complete standardized Ontario-specific training appropriate to their role.
And yes: make them take a test.
If ordinary Ontario workers can complete WHMIS, workplace safety and violence-prevention training, people handling player accounts, promotions, withdrawals and sensitive data can survive a regulatory quiz.
Training should be refreshed when rules materially change, and the regulator should be able to ask for evidence showing who completed which module, when, and whether they demonstrated understanding.
Reform 18: test the controls, do not merely read the policies
Ontario should use controlled regulatory assurance testing. Not entrapment. Not tricks. Testing.
Can the privacy address receive a message? Can customer support correctly explain a withdrawal? Can the operator trace an affiliate acquisition? Can the supplier identify an end deployment? Can a high-risk responsible-gambling scenario be escalated correctly? Can the operator produce records that should exist?
Policies describe intent. Testing reveals operation.
Reform 19: make affiliate traceability mandatory
If an operator financially benefits from affiliate acquisition, it should be capable of identifying the affiliate and, where relevant, material sub-affiliate responsible for bringing a player to the operator.
The consumer should not have to reverse-engineer tracking infrastructure to determine who marketed a regulated gambling product to them.
Reform 20: make promotional compliance auditable
Every material promotion should have an audit trail identifying who created it, who reviewed it, who approved it, applicable jurisdiction, relevant terms, intended audience, affiliate distribution where applicable, publication dates and withdrawal date.
Marketing should be treated as a regulated operational function, not decorative content sitting outside the compliance system.
Reform 21: standardize AML data across regulated Canadian markets
Ontario and Alberta now provide a real opportunity for interoperability. They do not need identical laws. They do need a common language for regulated data.
A practical cross-provincial framework could standardize core entity identifiers, transaction classifications, beneficial-ownership fields, payment-provider identifiers, suspicious-activity taxonomies and incident categories.
The objective is not one national regulator. It is to avoid building incompatible provincial data silos.
Reform 22: create Ontario-Alberta cross-checking
Where legally permitted, Ontario and Alberta should establish structured regulatory information-sharing for operators and suppliers that participate in both markets.
If one province has already verified ownership, supplier relationships, compliance history or material enforcement findings, the other should not have to rediscover the same basic facts from scratch.
Each province should still make its own legal decisions. Information interoperability is not the same thing as surrendering regulatory independence.
Reform 23: build cross-provincial self-exclusion interoperability
Ontario's centralized self-exclusion model demonstrates the value of looking beyond a single operator account. As more Canadian provinces develop competitive regulated systems, consumers should eventually be able to opt into multi-jurisdictional exclusion where legislation and privacy rules permit.
A person should not have to rebuild a protection barrier one province at a time if they affirmatively want broader protection.
Reform 24: create a national-style supplier identifier without creating a national regulator
Ontario and Alberta could adopt common identifiers for operators, suppliers and material platforms. Think of it as a regulatory VIN number: names can change, brands can move, corporate structures can reorganize, but the identity persists.
This would make cross-market analysis, enforcement history and supplier mapping far easier.
Reform 25: standardize payment transparency
Every regulated gambling transaction should be reconstructable after the fact. Consumers should be able to determine which regulated operator the transaction funded, which merchant or intermediary processed it, when it occurred and how to dispute it.
Mystery merchant descriptors may be commercially convenient, but opacity is not consumer protection.
Reform 26: publish structured regulatory data
Do not publish only PDFs. Publish machine-readable data where appropriate: registration records, public enforcement decisions, market-entry and market-exit history, supplier identities, public brand records and anonymized compliance statistics.
Researchers, journalists, academics and consumers can become an additional layer of oversight when the data are usable.
Reform 27: publish aggregate assurance-testing results
Ontario need not immediately publish every individual failed control test. But it could publish aggregate findings: how many operators passed privacy-contact testing, how many affiliate-traceability deficiencies were identified, what themes appeared in responsible-gambling testing, and which remediation categories were most common.
That makes regulation visible without compromising active investigations or sensitive technical information.
Reform 28: make regulatory history survive restructuring
A corporate reorganization should not erase complaint history, compliance findings, responsible-gambling records, material customer liabilities or historical relationships that remain legally relevant.
Separate legal personality still matters. But regulatory memory should follow economic and operational continuity where the law permits.
Reform 29: create discrepancy detection
Once Ontario has better structured data, it can compare disclosures across the ecosystem.
If an operator identifies Supplier X but Supplier X does not disclose the relationship, flag it. If a brand moves but the trademark record does not change, flag it. If a related entity provides operational support outside Ontario but the supplier risk assessment says there is no perimeter exposure, flag it for review.
This is where system intelligence becomes more powerful than isolated filings.
Reform 30: measure the regulator's own system
A mature outcomes-based regulator should measure whether its own interventions produce better outcomes.
How quickly are serious complaints resolved? How often do identified control deficiencies recur? How often does remediation actually work? Do enforcement actions change behaviour? Do consumer protections reduce harm? Does information-sharing improve detection?
Regulation should have a feedback loop too.
The teaching point: this is not anti-industry
None of these recommendations requires assuming that every related company is suspicious, every offshore relationship is unlawful, every restructuring is evasive, or every supplier is responsible for the conduct of every customer.
That would be sloppy regulation.
The proper model is more disciplined:
• Disclosure does not equal liability.
• Common ownership does not erase separate legal personality.
• Operational support does not automatically make a supplier the operator.
• Historical association does not automatically establish present misconduct.
• Risk is not the same thing as breach.
• A consumer allegation is not proof.
• A corporate restructuring can be perfectly legitimate.
But all of those facts can still be relevant to regulatory risk. That is the distinction a mature system should preserve.
The bigger principle: move from entity supervision to ecosystem assurance
Ontario already has formal controls, management accountability, supplier reporting, training expectations, record retention, notification duties and an outcomes-based philosophy. The next stage is connective tissue.
Who owns whom? Who supplies whom? Who used to supply whom? What changed? When did it change? Where did the business go? What assets moved? Who controls the trademark? Who provides the customer support? Who can see the player data? Who can terminate the relationship? Which control is supposed to stop Ontario exposure? Has anyone tested it? What happened when it failed? Who knew? Was the regulator told?
Then ask the assurance question that cuts through almost everything: show me the evidence.
That is the regulatory conversation I think Ontario is ready to have now. Not merely more rules. Better visibility. Better memory. Better evidence. Better interoperability. Better accountability across the system rather than only inside each individual corporate box.
A consolidated reform blueprint
1. Create an Ontario Regulatory Perimeter Risk standard.
2. Require annual supplier Statements of Assurance for material Gaming-Related Suppliers.
3. Require critical supply-chain mapping, not only supplier lists.
4. Create permanent regulatory identifiers for operators, suppliers and brands.
5. Build temporal corporate and relationship mapping.
6. Require Pre-Regulation Ontario Activity and Transition Statements.
7. Require Asset Disposition Statements when brands, accounts, data or operations are transferred.
8. Require Related Gaming Interest Declarations from material owners and controllers.
9. Require trademark and brand-chain disclosure.
10. Publish a consumer-facing regulatory identity page for each regulated brand.
11. Require disclosure of material operational support provided to non-Ontario-regulated gambling businesses.
12. Require suppliers to assess offshore or non-Ontario operational-support risk.
13. Introduce role-based regulatory certification and examinations.
14. Require executive attestation after reasonable inquiry.
15. Introduce controlled regulatory assurance testing.
16. Require affiliate and sub-affiliate traceability.
17. Require end-deployment traceability from aggregators and key suppliers.
18. Require event-driven risk reassessment after material changes.
19. Create an internal AGCO ecosystem graph.
20. Create automated discrepancy detection across filings.
21. Standardize core data fields with Alberta.
22. Create structured Ontario-Alberta regulatory cross-checking.
23. Standardize core AML data architecture across participating provinces.
24. Create an incentivized whistleblower framework.
25. Create a separate regulatory intelligence portal.
26. Create a statutory player restitution mechanism for defined regulatory harms.
27. Explore an industry-funded player protection fund.
28. Revisit penalties so serious non-compliance is economically irrational.
29. Make repeat breaches progressively more consequential.
30. Require a functioning public privacy officer contact and test it.
31. Preserve regulatory history through restructurings.
32. Publish more machine-readable regulatory data.
33. Publish aggregate assurance-testing outcomes.
34. Measure the regulator's own interventions and remediation effectiveness.
Closing thought
Ontario does not need to choose between flexible, risk-based regulation and strong consumer protection. Done properly, those ideas reinforce each other. Flexible regulation only works when risk is understood, controls are testable, evidence is preserved, corporate history remains visible and regulators can see across the boundaries where operational responsibility is distributed.
The market is already complex. The regulatory system should be at least as capable of understanding it as the companies participating in it.
Primary regulatory reading
Alcohol and Gaming Commission of Ontario, Internet Gaming Notification Matrix and related notification guidance: https://www.agco.ca/
Alcohol and Gaming Commission of Ontario, Registrar's Standards for Internet Gaming and entity-level guidance: https://www.agco.ca/
Alcohol and Gaming Commission of Ontario, responsible gambling guidance for internet gaming operators: https://www.agco.ca/
Office of the Privacy Commissioner of Canada, PIPEDA accountability principle: https://www.priv.gc.ca/
Ontario occupational health and safety legislation and awareness training materials: https://www.ontario.ca/
Alberta Gaming, Liquor and Cannabis iGaming materials: https://aglc.ca/
