How to vet affiliates before you approve them

Vetting an affiliate means checking, before you approve them, who they are, what they own, where their traffic comes from, which markets it reaches and what their content says in your name. In Great Britain and most regulated markets, you answer for all of that from the day they start. Good vetting is fast for partners who can show their working, and slow only where the answers are missing.

This guide covers why the job is yours, what to check, how to scale checks to the type of partner, and how to do it without treating good affiliates as suspects. A checklist closes it.

Why vetting is your job

Great Britain

LCCP Social Responsibility code 1.1.2 applies to all licences. It states: "Licensees are responsible for the actions of third parties with whom they contract for the provision of any aspect of the licensee's business related to the licensed activities." Your contracts must require the third party to act as if bound by the same licence conditions and codes, oblige it to give you information you need for your reporting to the Commission, and let you terminate promptly if it breaches the contract or acts against the licensing objectives, "including for affiliates where they have breached a relevant advertising code of practice".

The Commission's page on third parties adds that licensees must do due diligence and keep oversight, and that failure "can result in regulatory action including suspension or the loss of the operating licence".

Two more conditions shape what you check:

• SR code 5.1.6 requires your marketing to comply with the CAP and BCAP codes. Through 1.1.2, an affiliate's breach can become yours.
• Condition 16.1.1, an operating licence condition, requires you to take all reasonable steps to stop affiliates placing your ads on sites that give unauthorised access to copyrighted content, and to be able to terminate those who do.

The ASA holds the brand and the affiliate responsible for affiliate marketing, even where the affiliate wrote the ad. In its ruling on Dribble Media Ltd t/a Midnite (16 September 2026), a paid TikTok ad made by an affiliate featured an AI-generated character who appeared under 25. Midnite said it had not sanctioned the ad. The ruling was still made against it and the affiliate.

Other markets

• Ontario (Canada). Standard 1.19 makes operators responsible for third parties, which the AGCO has said covers marketing affiliates. Standard 1.21 requires you to ensure that no affiliate you pay also promotes sites taking Ontario players without AGCO registration. Affiliates generally do not have to register as gaming-related suppliers (the AGCO decides case by case), so this control runs through you.
• Malta. Under S.L. 583.09 regulation 33, you are held responsible for an affiliate's breaches. The MGA may decline to sanction where the affiliate acted without your knowledge and you took sufficient precautions and acted at once. Your vetting file is the evidence of those precautions.
• Spain. Royal Decree 958/2020 article 37(2) makes operators responsible for communications made on their behalf and requires measures to ensure affiliates comply.
• United States. Rules are set state by state. In Pennsylvania, an affiliate paid on player activity must apply for interactive gaming service provider certification, and a flat-fee affiliate must apply for registration (58 Pa. Code §807a.1). Check an applicant's status before you approve them for that state.

For the regulator's own explanation in Great Britain, read the Gambling Commission's page on licensees' responsibilities for third parties. This guide is not legal advice.

What to check

Company and people

Start with KYB: the legal entity, its registration number and registered address, its directors and beneficial owners, and a bank account in the entity's own name. Ask who will run the account day to day. You need a real counterparty for the contract terms 1.1.2 requires, and you need to know who you are paying.

Properties and ownership

Ask for every property that will carry your brand: sites, apps, social accounts, channels and email lists. Ask the applicant to show they control each one, for example by placing a code you supply on the site or sharing analytics in a screen share. Check domains against your brand names. bet365 and Entain (clause 5.14(a)) both ban lookalike domains in their published terms.

Traffic sources

Ask how visitors arrive, in proportions, and for evidence: analytics exports, read-only ad account access or keyword lists. Compare the answers with what your terms prohibit. All eight large programmes whose terms we read in October 2026 ban brand bidding. Entain (5.15(a)) and FDJ United (3.9(1)) ban incentivised traffic. bet365, Entain and FDJ United ban spam.

GEOs against your licences

Map where the audience is against where you hold a licence. Then ask which other brands the applicant promotes, and where. In Ontario, an affiliate promoting unregistered sites to Ontario players is one you cannot pay under Standard 1.21. In the Netherlands, the KSA has said an affiliate promoting an unlicensed operator is itself in breach. In Germany, GlüStV 2021 §5(6) bans variable pay (revenue share, deposit-based or stake-based CPA) for internet advertising of products covered by the OASIS exclusion system, so the deal itself must fit the GEO.

Content compliance

Read a sample of pages or posts as a regulator would:

• Labelling. The ASA treats content with an affiliate link or code as advertising that must be identifiable upfront. It recommends "Ad" or "#ad" at the start. "Affiliate" or a footer disclaimer is likely to be insufficient, and a site where every offer earns commission must not imply independence.
• Offers. From 19 January 2026, amended SR code 5.1.1 bars wagering requirements above 10 times on bonus funds and incentives mixing more than one product type. A GB page still showing a 35x offer, or a bet-and-spins combination, is out of date.
• Appeal to under-18s. CAP rule 16.3.12 bars gambling marketing likely to be of strong appeal to under-18s.

Past conduct

Ask whether any programme has terminated the applicant, and why. Search the ASA's published rulings for their trading names. Ask for a named contact at another programme they work with. Treat an honest account of a past problem, and what changed, as a better sign than a blank.

Fraud signals

At application stage, the useful signals are gaps: properties the applicant cannot show they control, traffic claims with no evidence, or a mismatch between the stated audience and the analytics. The fraud guide covers what to watch once traffic flows.

Proportionate checks by affiliate type

The same questions apply to everyone. The depth should follow where the risk sits.

Media buyers

A media buyer controls placements, so check settings rather than content alone. 888 (3.12) and William Hill (5.20) ban keywords on the UK Industry Keyword Black List, and Entain bans keywords aimed at self-excluded people, such as "GAMSTOP" (5.15(l)). CAP's media placement guidance applies a 25% test: no medium should carry gambling ads if more than 25% of its audience is under 18, and marketers must show proactive steps such as using targeting tools. CAP's age-restricted ads guidance says affiliates and agencies acting for a marketer should use it too.

Streamers and creators

CAP's guidance tells marketers to check a streamer's audience age data and to monitor under-18 engagement with affiliate links and promo codes. Its rule of thumb is that 100,000 or more follower accounts registered to under-18s, in total across platforms, indicates strong appeal. It warns that the real number is likely higher, because many under-18s register with an adult age.

What data you can get varies. YouTube's Analytics API reports age groups, including 13 to 17, for logged-in users. Twitch's API has no endpoint for viewer age or other demographics, so ask for dashboard screenshots and other platforms' data.

Check platform rules too. Twitch bans links and affiliate codes to sites with slots, roulette or dice games, and names six prohibited sites. Kick prohibits gambling with funds provided by other users and bans bots that inflate views. In the Netherlands, the KSA said on 24 February 2026 that influencers and streamers count as role models whenever their reach makes them attractive for marketing, and told operators to end such partnerships. Working with streamers covers this in depth.

Vetting without treating good affiliates as suspects

Much of what is written about vetting assumes the applicant is hiding something. Most are not. A process built for the rare bad actor wastes the time of everyone else, and the best partners have other programmes to join.

1. Publish your list. Tell applicants what you will ask for before they apply, so they can send it once.
2. Accept a standard pack. Take the documents in the form the affiliate already holds rather than insisting on your own template.
3. Say why you ask. "Our licence makes us responsible for your content" lands better than an unexplained demand.
4. Separate gaps from red flags. A missing document is a question, not a finding.
5. Give a timeline, and tell the applicant when it will slip.
6. Explain a rejection, in enough detail to fix it if it can be fixed.
7. Re-vet on change, such as a new GEO, channel or owner, rather than repeating the full process on a whim.

Affiliate view

From our side, vetting often means sending the same documents to every programme in a different format, then waiting with no idea where the application sits. We expect to be checked. We would like to be told what you need once, and why.

Operator view

Every question in the pack maps to something we can be held to account for. If an affiliate's answer is clear, we can approve on the first pass. If it is vague, we have to ask again, and that delay is ours to manage, not a judgement on the applicant.

Vetting checklist

• Legal entity, registration number, address, directors and beneficial owners confirmed
• Bank account in the entity's name
• Every property listed, with proof of control
• Domains checked against your brand names
• Traffic sources described with evidence
• No brand bidding, incentives or spam in the mix, against your terms
• Audience GEOs matched to your licences
• Other brands promoted, by market, checked against Ontario 1.21 and similar rules
• State registration or certification checked where required, such as Pennsylvania
• Sample content checked for labels, current GB offer rules and strong appeal
• For media buyers: keyword lists, restricted terms and targeting settings reviewed
• For creators: audience age data across all major platforms reviewed
• Past terminations and ASA rulings asked about and searched
• Decision, reasons and evidence recorded in a vetting file
• Contract includes the 1.1.2 terms: same standards, information, prompt termination

What to do next

Share your document list with applicants, and point them to How to get approved faster, which describes the same process from their side. Once a partner is live, Spotting affiliate fraud covers ongoing monitoring.