When a slot spins at an online casino, the casino usually does not run the game. The spin request leaves the operator's platform, travels to a remote game server operated by the studio or by an aggregator, and the outcome comes back as a result plus a debit and credit instruction for the player's wallet. Three separate businesses can touch a single spin, and each one is regulated for a different part of it.
The mechanism in one paragraph
A modern online slot is split in two. The game client, the reels and animations on screen, is a front end that displays results. The game logic, including the random number generator, the reel strips, the paytable and the configured RTP, sits on a remote game server, usually called an RGS. The operator's platform owns the player account and the money. On each spin, the platform tells the RGS that a stake has been placed, the RGS determines the outcome, and the platform settles the balance. The operator never decides the result, and the studio never holds the player's funds.
Stage one: the studio builds the maths
The studio designs the game: grid, symbols, features and the probability model behind them. Most studios produce several RTP configurations of the same title, so that operators in different markets can pick one that fits local rules or commercial preference. Each configuration is a distinct set of maths, not a dial on a single version, which is why one game can appear at more than one RTP across different sites.
Before a configuration can be offered in a regulated market, the game and its RNG are tested by an accredited testing laboratory against that market's technical standard. The laboratory verifies that the RNG output is unpredictable and statistically sound, that the game logic matches the published rules, and that the theoretical RTP of each configuration is what the studio declares. Certification attaches to a specific build and configuration; a later change to the maths needs fresh testing.
Stage two: the remote game server hosts it
The RGS is where the regulated core of the product actually runs. It generates outcomes, records each game round, and keeps the logs that a regulator or laboratory will later want to inspect. Because outcomes are produced here, the integrity of the RGS matters more to a player than the integrity of the website displaying the reels.
In Malta this is precisely the activity the regulator singles out. The Malta Gaming Authority treats the supply and management of software that generates, captures, controls or processes essential regulatory records, and the provision or management of material elements of a game, as a critical gaming supply. Doing so from Malta, or through a Maltese entity, requires a B2B critical gaming supply licence under the framework set by the Gaming Act (Cap. 583). The MGA's application process for game providers runs on system documentation, system audit and system review checklists, so the licence is tied to how the technical setup is documented and audited, not only to who owns the company.
Not every studio runs its own RGS. Smaller studios often host their games on a larger provider's server or on an aggregator's platform, which shifts parts of the operational and compliance burden onto whoever operates that infrastructure.
Stage three: the aggregator connects it
An aggregator is a distribution layer. Instead of integrating with each studio separately, an operator integrates once with the aggregator and gains access to a catalogue of games from many studios through a single interface. The aggregator translates each spin request into the format each studio's server expects and passes results back.
This is efficient, and it changes who answers for what. The aggregator now sits in the path of every transaction for every title it carries. In regulated markets it generally needs its own supplier authorisation, and an operator's due diligence on a game extends to the aggregator that delivers it. The commercial terms between studio, aggregator and operator, usually some share of gross gaming revenue, are almost never published, so any claim about who earns what on a given spin should be treated as an estimate.
Aggregation also explains a pattern that confuses players: identical games appearing at dozens of unrelated casinos within days of release. Those casinos did not each sign a deal with the studio. They are reading from the same distribution pipe.
Stage four: the operator chooses and settles
The operator, licensed as a B2C business, makes three decisions that affect what a player sees.
| Decision | Who makes it | What it changes for a player |
|---|---|---|
| Which games go in the lobby | Operator | Which titles are available at all |
| Which certified RTP configuration is enabled | Operator, from the studio's certified set | The long run return of that game on that site |
| Limits, reality checks and account controls | Operator, within the regulator's rules | How spending and time are tracked and capped |
| The outcome of each spin | Remote game server | Nothing the operator can adjust after the fact |
The RTP choice deserves emphasis. Operators cannot invent an RTP; they select from configurations the studio has certified for that market. But they can select a lower one, and many do not advertise which. The game's information panel is usually the only place the active figure is shown.
Settlement is the operator's job alone. The RGS returns a result and an amount; the platform debits the stake and credits any win to the player's balance. Disputes over a balance therefore start with the operator, even though the outcome was produced elsewhere.
Where accountability gaps appear
Splitting one spin across three businesses creates seams.
Version drift. A studio updates a game, and an aggregator or operator continues to serve an older certified build. Certification records should catch this, but the player cannot see which build is running.
Disclosure. RTP configuration is a commercial decision taken by the operator, while the published RTP most players encounter in reviews and on provider websites is usually the top configuration. The two can differ.
Jurisdiction mismatch. A studio licensed in one regime may reach players in another through an aggregator that holds the relevant local permission. The chain is legitimate only if every link holds the authorisation that market requires, and that is rarely visible from a lobby.
None of these is evidence of wrongdoing in itself. They are structural points where the information a player relies on passes through hands other than the business named at the top of the website.
What this means for a player in practice
The site a player deposits with is rarely the business that decides whether a spin wins. Outcomes are generated on a remote server, tested by a laboratory against a published standard, and delivered through a supply chain that a Maltese B2B licence is designed to supervise at its most sensitive point. The operator's influence is real but specific: it chooses the games, chooses the RTP configuration, and runs the account.
The practical consequence is narrow and useful. The RTP figure worth trusting is the one in the game's own information panel on that site, not the figure on the provider's marketing page. And no part of this chain, studio, server, aggregator or operator, changes the fact that every spin is independent and that the house edge is built into the certified maths.
Responsible gambling
Online gambling in Malta is for people aged 18 and over, and only MGA licensed operators may offer it to players in Malta. Because the operator sets limits and reality checks, those controls are worth configuring at account level before any play, especially on titles where the active RTP configuration is not stated in the lobby. The Responsible Gaming Foundation offers free and confidential support, and Supportline 179 is available for anyone who wants to talk about their gambling or someone else's.