1. Objective
NGA licensees should maintain accurate records and audit logs that can reconstruct platform events, user actions, and funds-related outcomes. The aim is traceability, dispute resolution, and operational integrity.
2. Minimum logging outcomes
| Area | Minimum standard | Typical failure |
|---|---|---|
| Access & admin actions | Log admin logins, role changes, permission grants, and privileged actions with user ID + timestamp. | Shared admin accounts; no trace of who changed what. |
| Configuration changes | Record platform config changes (rules, limits, payout settings, game settings) with approvals and reasons. | Changes made directly in production with no record. |
| User lifecycle | Account creation, verification events, status changes, restrictions, closures, and reinstatements. | Account status altered without audit trail. |
| Funds-related events | Deposits, withdrawals, refunds, chargebacks, adjustments, and settlement confirmations. | Missing external references; “manual” changes not captured. |
| Game/session outcomes | Session start/end, bet placement, outcomes, and settlement events where applicable to the model. | No ability to reproduce outcomes or settle disputes. |
Log integrity: what makes logs “usable”
Logs should be timestamped, attributable (who/what), immutable or protected against tampering, and searchable/exportable. “A pile of server logs” is not evidence if it cannot be queried reliably.
3. Retention & accessibility
- Define retention windows proportionate to platform scale and dispute timelines.
- Ensure logs remain accessible even if vendors change or contracts terminate.
- Maintain secure backups and prevent unauthorised deletion or edits.
- Ensure exported reports preserve integrity and reference IDs.
4. Reporting cadence (practical minimums)
NGA licensees should maintain routine internal reporting that summarises key operational indicators. Reporting can be scaled by complexity, but consistency matters.
- Deposits, withdrawals, refunds, chargebacks (period summaries and exceptions).
- Account restrictions, closures, reinstatements, and dispute counts.
- Incidents and platform downtime (including root cause and corrective actions).
- Material policy/config changes during the period.
Suggested “exception register” fields
Date opened, type, impacted system, impacted users, root cause, interim controls, permanent fix, owner, status, closure date, and evidence links.
5. Export readiness & auditability
- Maintain standard exports for transactions, sessions, admin actions, and adjustments.
- Ensure exported data includes stable IDs and external references where relevant.
- Document reporting definitions (what each field means, and how it is calculated).
- Protect sensitive fields appropriately while preserving traceability.
6. Common failure patterns
- Shared admin accounts and unlogged privileged actions.
- No link between platform IDs and external payment references.
- Logs exist but cannot be searched, exported, or validated.
- Record gaps after system migrations or vendor changes.
- Manual adjustments without reasons, approvals, or documentation.
7. Oversight-ready evidence pack
- Logging policy and system map (what is logged, where, and why).
- Role and permission matrix for admin and reporting access.
- Sample audit trails for key events (changes, payouts, disputes).
- Retention policy and backup evidence.
- Standard report templates and sample exports.