iGaming
No ISO deadline forced the issue - a PSP did. The casino could not produce the supplier assurance and access evidence the payment provider's review demanded, and onboarding sat frozen.
iGaming pressure rarely arrives as an audit date. It arrives as a PSP review, a licence query or a partner questionnaire - and each one asks for evidence the operator has never assembled. The work was to build that evidence once, in a form reusable across all of them.
Finding 01
No review or classification for PSPs, KYC providers or game aggregators - exactly what the PSP asked to see.
Finding 02
Broad access to player and payment data with no periodic review or approval trail.
Finding 03
Affiliate and support tooling granted more access than the role needed, never revisited.
Finding 04
Incidents were handled in chat with no record a reviewer could follow.
Finding 05
The proof mostly existed in pieces, but nobody could assemble it into something a PSP or auditor could read.
The stalled PSP review proceeded once the operator could show its controls instead of describing them. The same evidence pack became the backbone for ISO 27001 readiness and licence-related scrutiny - built once, reused everywhere.
For an operator, the security review happens either way - the preparation is the only variable. Build the evidence once, outside deadline pressure, and it serves the PSP, the licence and the ISO audit at the same time.
These are representative engagements - detailed, realistic walkthroughs built from the ISO 27001 failure patterns we see most often, not accounts of specific named clients. Certification is always decided by an accredited certification body; we prepare teams for it and never guarantee the outcome.
Certification is performed by an accredited certification body through Stage 1 and Stage 2 audits. Kellwick prepares you for that process; it does not perform it and cannot guarantee its outcome.
Kellwick is an independent advisory practice. We are not a certification body and do not issue ISO certifications. Certification decisions are made only by accredited certification bodies.