Betsoft passes the ISMS audit that opens the door to Spain
On 2 February 2020, Betsoft Gaming put out a press release just a few lines long, the kind you skim between two partnership announcements. Behind that dry text, the studio's cinematic slots had just earned their ticket into Spain. The provider had passed an ISMS audit and the Spanish regulator had signed off. Operators holding a local licence could now add its games.
Nobody gets excited about an IT security audit. There is no jackpot to announce, let alone a new game to spin. Yet this is exactly the kind of check that separates a regulated market from a grey area. Looking back, this quiet release carries more weight than plenty of far noisier studio news, because it paved the way for the Spanish deals of the following years.
What does an ISMS audit check at a game provider?
ISMS stands for Information Security Management System. The best-known standard in this field, ISO/IEC 27001, rests on three principles: confidentiality, integrity and availability of information.
Betsoft's announcement echoes this trio word for word. According to the provider's official press release, the audit scrutinised all of its internal controls. The aim was to check that it protects the confidentiality, availability and integrity of its games against threats. In other words, the auditor doesn't sit down at the table to count cards. They tour the back room with the usual questions: who gets into the servers, how each game version is protected, what happens when something goes wrong.
This check says nothing, however, about a slot's return to player or its random number generator. In Spain, that side falls under the functional certification of the games, handled by specialised labs.
Why does Spain also scrutinise game providers?
In Spain, the licence belongs to the operator, and it is the DGOJ (Dirección General de Ordenación del Juego) that grants it. Yet the casino never plays alone. The approval of technical systems required by the regulator relies on two types of reports. The first come from labs that specialise in testing gaming systems. The second come from IT security auditors designated in advance by the DGOJ.
The detail that changes everything is tucked away in an annex. A DGOJ resolution of 6 October 2014 states that an operator's technical system includes the systems of every gaming service provider involved in the solution. The provider therefore falls within the audited scope, just like the casino. Betsoft did not become an operator in Spain. Its audit simply allowed licensed operators to run its titles.
This approval is no blank cheque for life. It is valid for ten years and has to be maintained through prior authorisation of substantial changes, quarterly reports and audits every two years. In 2024, the DGOJ received 1,339 change requests, 167 of them for a new game provider coming on board. An ISO/IEC 27001 certification with the same scope is not mandatory. Even so, it allows part of the security requirements to be signed off.
Who carried out Betsoft's ISMS audit?
Betsoft credits the certification to iTech Labs, an accredited testing lab for online gaming. The Australian firm has been operating since 2004 and says it has been at the forefront of the Internet Gaming Standards, which regulators around the world now use.
One detail raises a smile today. The same release named Gaming Laboratories International (GLI) as Betsoft's independent certifier. In May 2023, GLI became the sole owner of iTech Labs. The world of testing labs can feel like a small village.
Colombia follows a week later
The story repeated itself almost word for word. On 9 February 2020, a twin press release announced another successful ISMS audit with iTech Labs, this time for Colombia. Annamaria Anastasi, then marketing director, hailed a fast-growing market in Latin America.
Betsoft would later speak of two ISMS audits passed in 2020, allowing it to operate in both Spain and Colombia. The second one quickly paid off in the Colombian market: in November 2020, the provider signed with Yajuego, a Bogotá-based operator licensed by Coljuegos.
The Spanish deals born from this audit
Annamaria Anastasi set the tone as early as February 2020: “Our Spanish partners will now have full access to our award winning content.” Events proved her right. In June 2020, Betsoft teamed up with Tecnalis, a Madrid-based platform provider. Then the operators followed: VERSUS in April 2022, 888casino in August and RETAbet in November. By the time of the deal with Casino777.es in February 2023, several of its hits had been translated into Spanish. Return to Paris and Thai Blossoms were already live on that site.
This track record has a value that players tend to underestimate. In the game libraries of unlicensed casinos, I have come across fake Betsoft games: same name, same visuals, no link whatsoever to the studio. On a DGOJ-licensed site, adding a provider goes through the regulator's change procedure. The difference doesn't show on screen. It plays out behind the scenes.
Six years after the audit: security as the opening stake
Reread in 2026, this release has gained depth. Since then, the studio has ventured into territory with very different rules, all the way into the social casino space with Legendz in March 2026. In a regulated market, security remains the opening stake. It is the one no player sees, and without it no game ever starts.
One question keeps nagging at me with every new signing: how many Spanish players know that a Betsoft slot first had to clear an audit nobody talks about?
FAQ: Betsoft ISMS audit
What is an ISMS audit?
An ISMS audit assesses a company's information security management system. It checks that internal controls protect the confidentiality, integrity and availability of its information. The best-known standard in this field is ISO/IEC 27001.
What did Betsoft's ISMS audit check?
According to Betsoft, the audit reviewed all of its internal controls. It had to confirm that the provider protects the confidentiality, availability and integrity of its games against threats and IT vulnerabilities.
When did Betsoft pass its ISMS audit for Spain?
Betsoft announced that it had passed its ISMS audit on 2 February 2020, together with the Spanish regulator's approval. From that date, operators holding a Spanish licence could add its games.
Who carried out Betsoft's ISMS audit?
The certification was handled by iTech Labs, an accredited testing lab for online gaming. Founded in Australia, it has been operating since 2004. Since May 2023, iTech Labs has been wholly owned by the GLI group (Gaming Laboratories International).
Does an ISMS audit check a slot's RTP?
No. An ISMS audit covers information security. It checks neither the return to player nor the random number generator. In Spain, those points fall under the functional certification of games, handled by specialised labs.
Are Betsoft games legal in Spain?
Yes, on licensed sites. Since February 2020, operators holding a licence from the DGOJ, the Spanish regulator, have been able to offer Betsoft games. This authorisation followed the ISMS audit the provider passed with iTech Labs.
Why does Spain also check game providers?
A DGOJ resolution of 6 October 2014 states that an operator's technical system includes the systems of every gaming service provider involved. The provider is therefore part of what gets approved. It has to go through lab reports and security audits carried out by bodies designated by the DGOJ.
How long does online gaming approval last in Spain?
Approval of a technical gaming system is valid for ten years from the date of the report. To keep it, the operator must get any significant change authorised in advance. It also has to send a report every quarter and pass an audit every two years.
How many ISMS audits did Betsoft pass in 2020?
Two. The first, announced on 2 February 2020, covered Spain. The second, announced on 9 February 2020 and also run with iTech Labs, opened the Colombian market to the provider's games.
Which deals did Betsoft sign in Spain after its audit?
In June 2020, Betsoft partnered with Tecnalis, a Madrid-based platform provider. The operators VERSUS (April 2022), 888casino (August 2022), RETAbet (November 2022) and Casino777.es (February 2023) followed.
