CRM Integration Checklist for iGaming Platforms

1. Map the data flows

Draw every flow between the platform, the CRM, the marketing tool, the responsible gambling system and any data warehouse. For each, note the fields, the direction and the delay. Remove fields the tool does not need, following data minimization.

2. Keep permissions one-way

• Permissions are created only by the registration flow and the preference center.
• The marketing tool receives permissions by product and channel, matching the matrix in social responsibility code 5.1.12 for Great Britain.
• The tool cannot change a permission from "no" to "yes". Its own unsubscribe actions are sent back as withdrawal events.
• Every permission arrives with a time and a source, as set out in event fields an audit trail needs.

3. Exclusion feeds

• Operator self-exclusions reach every tool fast enough to meet the market rule. In Great Britain that is "within two days of receiving the completed self-exclusion notification" under code 3.5.3, so aim for minutes, not days.
• National and provincial register matches (GAMSTOP, BetStop, BetGuard) are stored with the date of the check. The ACMA notes that the law does "not prescribe when a wagering provider must check BetStop", so set your own rule and record it.
• Imports from other sources are matched against the suppression list before they reach any segment.

4. Send-time check

• Every send, including automated steps and one-off campaigns, re-checks permissions and exclusions immediately before sending.
• The check returns a reason code that is logged with the send.
• If the check cannot be made, the send is held, not sent.

Consent-gated workflows describes the order of checks.

5. Evidence and logs

• Each send log records the permission and exclusion state used.
• Wording shown at consent capture is versioned and retrievable.
• Logs are kept for the period your retention policy sets.

6. Test before go-live

Seed one test account per state in the seven seeded test accounts and confirm each outcome before go-live.

The full test plan is in testing marketing workflows before launch. For questions to ask the vendor, see CRM platform evaluation criteria, which follow our requirement-based evaluation method.

7. Roles and access

• Marketing users can read eligibility but cannot change permissions or exclusions.
• Support staff can record a customer's request, and the event names them as actor.
• Administrator actions on permission data are logged and reviewed.
• Vendor staff access to production data is limited, logged and removed when no longer needed.

8. Go-live and rollback

• A written plan says who can pause all marketing sends, and how, in one action.
• The first live campaign goes to a small audience, with suppression results reviewed before the next.
• If the integration fails after launch, sends stop rather than continue on old data.
• After go-live, rerun the seeded account tests and keep the results with the launch record.