Deborah Vella is Director & COO at E&S Group, a Malta-based advisory and corporate services firm specializing in licensing, corporate structuring, tax, compliance and business advisory for iGaming, fintech and blockchain companies. Through its multidisciplinary model, E&S Group helps operators navigate complex regulatory environments while building the corporate, financial and governance frameworks needed to support sustainable growth across international markets.
In this CasinoRank interview, Vella discusses how operators are approaching licensing strategy in an increasingly regulated industry, why strong corporate structures have a direct impact on payments, compliance and player experience, and where blockchain technology is creating practical opportunities within regulated gaming. She also shares her perspective on responsible AI adoption, evolving regulatory expectations, and the industry developments most likely to influence player trust, safety and sustainable market growth in the years ahead.
E&S Group now positions its Malta iGaming licensing support alongside advisory on offshore options. Where are operators drawing the line between speed-to-market and long-term regulatory credibility?
Deborah Vella: Honestly, the conversation has evolved enormously over the past couple of years. We used to see operators treat it as a binary choice — get a Curaçao or Anjouan licence quickly and worry about Malta later, or commit to the MGA process from day one. What we’re seeing now is something more strategic and, frankly, more mature.
The smarter operators are building in stages. They may launch on an offshore licence to test a product concept, a market, or a player acquisition model — but they’re structuring the corporate entity from day one with a Malta licence in mind. They’re not burning bridges. They know that payment processors, software providers, and serious affiliate networks increasingly ask about your regulatory home base, and a good-faith pathway to an MGA licence carries real weight even before you have one.
Where the line sits really comes down to what you’re building and who you’re building it for. If you’re targeting regulated European markets long-term, credibility is not optional — it’s the product. If you’re building something more exploratory or frontier-market focused, offshore gives you the breathing room to iterate. The mistake I see is when operators under-resource that offshore phase and then find their structures are incompatible with MGA standards later. That’s a costly rework. We always tell clients: regardless of where you start, structure for where you want to be.
E&S combines legal, tax, corporate, back-office and licensing support under one boutique model. Where do operators most often underestimate the link between strong business structuring and a smoother, safer experience for players?
Deborah Vella: This is something I feel quite strongly about, because it’s often invisible until something goes wrong.
The area where we see the biggest blind spot is payment architecture. Operators spend enormous energy on their front-end player experience — the UX, the promotions engine, the game lobby — and then wire up payment processing as almost an afterthought. But the corporate structure underneath determines which payment methods you can access, which acquiring banks will work with you, how quickly you can onboard and verify players, and ultimately how fast and reliably players can deposit and withdraw.
A poorly structured entity creates friction at every one of those touchpoints. A player who hits a withdrawal delay or gets asked for the same document twice isn’t having a compliance problem — they’re having a business architecture problem. It just looks like a customer service failure on the surface.
The same is true for responsible gaming. Your ability to implement effective player protections — self-exclusion tools, spending limits, cross-platform checks — depends heavily on how your data, your legal entity, and your operational contracts are set up. We have sat with operators who wanted to do the right thing for players and literally couldn’t because the structure they’d inherited made it legally or technically impossible. That’s avoidable, and it’s one of the reasons we push for this integrated approach from the very beginning.
Given E&S Group’s long-standing blockchain and tokenomics advisory work, where do you see the most realistic overlap between crypto infrastructure and regulated iGaming today — payments, player identity, loyalty, treasury, or something else?
Deborah Vella: Payments, without question, is where the most mature and immediately actionable overlap exists — but with real nuance. When we talk about crypto payments in regulated iGaming, we’re not talking about anonymous wallets and untracked transactions. We’re talking about stablecoins, blockchain-native payment rails with on-chain AML screening, and settlement mechanisms that are actually faster and more transparent than traditional banking. Regulators are catching up with this reality, and we’re helping clients navigate that directly.
Player identity is where I personally find the conversation most exciting. Self-sovereign identity and decentralised credential systems could genuinely transform KYC — giving players control over their verified data and allowing operators to request proof of age or residency without repeatedly storing sensitive documents. We’re not there at scale yet, but the building blocks exist, and the regulatory appetite is growing.
Loyalty is interesting but tends to be where the tokenomics conversation gets ahead of itself. Tokenised loyalty programmes sound compelling, but the moment a loyalty token has secondary market value, you’re in securities territory in most jurisdictions. That’s not insurmountable, but it requires careful structuring. Treasury is also a real use case for operators managing multi-currency exposure across jurisdictions — stablecoins as a treasury instrument make genuine operational sense.
So: payments now, identity soon, loyalty and treasury for those willing to do the structural work properly.
From your perspective, what should operators consider before using AI in areas that directly affect players, such as onboarding checks, AML reviews, responsible gaming, customer support or account restrictions?
Deborah Vella: This is a question I’m glad the industry is finally asking seriously, because for a while there was a rush to deploy AI that outpaced the thinking around accountability.
My starting point is always: who is responsible when the AI gets it wrong? That question needs a clear answer before you deploy anything that affects a real player. An onboarding system that incorrectly flags a legitimate player, or an AML model that generates a false positive leading to an account restriction — those aren’t just operational inconveniences. They carry regulatory consequences, reputational risk, and, at the human level, they cause genuine distress to real people.
Operators need to think about explainability first. Can you tell a player — or a regulator — why a decision was made? If the answer is “the model said so,” that’s not good enough in most regulated markets, and it’s increasingly not good enough for players who know their rights.
Human oversight must be built in, not bolted on. AI can triage, flag, and prioritise, but the consequential decisions — account restrictions, enhanced due diligence triggers, responsible gaming interventions — should have a human in the loop who can review and override. And that human needs to be trained, not just present.
Finally, test for bias regularly. Player populations are diverse, and models trained on historical data can systematically disadvantage certain groups. That’s not just an ethical issue in iGaming — it can be a regulatory breach.
AI done well in this space can genuinely improve player safety. But “done well” requires humility, oversight, and a genuine commitment to the player’s interest — not just efficiency gains for the operator.
As Director and COO, you sit close to both client delivery and firm operations. How have operator expectations changed when it comes to meeting regulatory demands while still keeping the player journey simple, fast and fair?
Deborah Vella: When I started in this space, the prevailing attitude among operators was that compliance was a tax — an unavoidable cost of doing business that you minimised wherever possible. The player journey was over here, and regulatory obligations were over there, and the goal was to keep them as separate as possible.
That has fundamentally changed. The operators who come to us now — certainly the ones I’d call the sophisticated end of the market — understand that a well-designed compliance framework is part of the product. The player who goes through a fast, frictionless, clearly communicated KYC process doesn’t feel like they’ve been through a compliance exercise. They feel like they’re dealing with a trustworthy platform. That’s a brand asset.
What’s driven this shift is partly regulatory pressure — enhanced due diligence requirements, responsible gambling obligations, source-of-funds checks — but also player expectations. Players are more sophisticated. They know when an operator is dragging them through unnecessary friction versus genuine verification. They notice when a withdrawal takes four days when it should take four hours. And they talk about it.
The practical challenge we help clients navigate is sequencing. How do you layer in the compliance touchpoints so they feel natural and proportionate rather than intrusive? How do you build a back-office operation that resolves queries fast enough that it never becomes a player’s problem? Those are operational design questions as much as regulatory ones, and they’re central to what we do.
Deborah, looking ahead, what changes in iGaming regulation could have the biggest impact on player safety, trust and market growth?
Deborah Vella: Three things stand out for me, and I think about this more than I probably should during quiet weekends.
The first is genuine regulatory harmonisation — or at least meaningful mutual recognition between jurisdictions. Right now, a responsible operator can hold an MGA licence, an UKGC licence, and a German licence and be subject to three substantially different sets of player protection rules, three different reporting formats, and three different approaches to what counts as a problematic gambling indicator. That creates compliance overhead that ultimately costs operators money they could be spending on better player protection tools. A more coherent international framework would unlock investment in genuinely world-class player safety infrastructure.
The second is the formalisation of responsible gambling as a measurable, auditable standard rather than a checklist. We’re moving in this direction — the Netherlands, Germany, Sweden, and the UK have all taken meaningful steps — but I think we’ll see a significant push toward operators having to demonstrate outcomes, not just inputs. That’s harder but better. It forces genuine innovation.
The third is the convergence of crypto-asset regulation and iGaming regulation, which is already underway but will accelerate. As MiCA matures in Europe and similar frameworks develop elsewhere, we’ll see clearer rules for crypto-native gaming products. That will open up real market growth in segments that are currently operating in grey areas or offshore by necessity — and bring those players into environments with proper consumer protections. That’s good for everyone.
What ties all three together is trust. Every regulatory development that genuinely builds player trust — that makes players feel safe, treated fairly, and confident their winnings are secure — ultimately grows the market. The operators who understand that are the ones investing in compliance as a genuine competitive advantage. And that’s the conversation I most enjoy having.
With a background in digital media and a keen eye for emerging technologies, Ronaldo bridges the gap between players and platforms through clear, insightful reporting to the iGaming industry.
