Building an iGaming Affiliate Programme: Attribution, Commission and Oversight

Running affiliates is an operating system, not a campaign

An affiliate platform looks after the publishers, review sites, communities and other partners who send players to a brand. It covers sign-up of partners, tracking links, campaign codes, attribution, commission maths, reporting and payout controls. Your marketing team may own the offers and the creative, yet the affiliate system answers something else entirely: which partner gets credit for a qualifying player, and how much is owed under the agreement in force?

Saving a URL parameter in the CRM can be enough for partner number one, and then it breaks the moment a player comes back on a second device, already knew the brand, or is claimed by two sources at once. Spinolf links affiliate tracking to player-account and wallet events while keeping personal data out of view. Partners see the performance figures they need to manage their traffic, but not identity, payment or detailed play records they have no reason to hold.

• Partner sign-up and approval
• Referral links with campaign codes
• Matching each player to a partner
• Role-based reporting and payouts

Settle attribution rules before the first click

Most affiliate disputes are about who owns a player, not about the commission rate. Decide whether the first or the last click wins, how long a referral stays valid, what happens with someone who is already a customer, and whether a later partner can take over the source. Branded search, direct repeat visits and journeys across products need rules too. The contract, the platform settings and the report must all give the same answer, or neither side will ever be able to reconcile a number.

Relying on cookies alone is fragile: browsers block them, in-app browsers lose them and players switch devices. A unique click ID stored at registration, plus secure server-to-server postbacks, makes a much stronger chain. Postbacks must never carry personal details in the URL, and they should rely on authenticated events and unique IDs so a conversion cannot be counted twice. Test a mobile click followed by a desktop sign-up, a refused cookie, an organic return, a repeat registration and a first deposit that arrives days later, rather than a single browser session.

• First- or last-click model and validity window
• Who owns a player who already has an account
• Click IDs and authenticated postbacks
• Testing device switches and late conversions

Keep CPA and revenue share calculations repeatable and checkable

Not every sign-up should trigger a CPA. Define a qualifying player through verification status, an allowed territory, a minimum deposit, real activity and a fraud check. With revenue share, the formula behind NGR tells you more than the headline percentage. Spell out which game costs, bonuses, payment fees, jackpot contributions, chargebacks and taxes come off, and in what sequence. Two programmes advertising the same percentage can pay out very different sums.

Negative carryover decides whether a losing player balance is pushed into a later period. If you use it, be clear about which product, which players and what resets it. Hybrid deals that mix CPA and revenue share need a clear trigger for each part. Tiered rates must say whether reaching a new level applies backwards or only from that point on. Spinolf ties every calculation to a contract version, so a new rule can never quietly rework commission for periods already closed.

• What counts as a qualifying player for CPA
• Every deduction behind GGR and NGR, written out
• How negative carryover is handled
• Versioned hybrid and tiered rules

Fraud checks need evidence and a way to appeal

Affiliate fraud takes many forms: bots, multiple accounts on linked devices, shared payment methods, activity generated only to clear a CPA threshold, traffic from restricted markets, or a partner signing up accounts for themselves. Bidding on the brand name can claim people who were already looking for the operator. Spam, misleading bonus promises and unapproved influencer posts can create regulatory and reputational risk even when the referred player is perfectly genuine.

A player who wins, or an odd-looking result, does not prove fraud. The operator should name the rule involved, the conversions affected and the money at stake, then allow an authorised review. Automated rules can hold back suspicious commission, but any cancellation needs to keep the evidence and a stated reason. Agreements need an appeal process with a response target. Traffic quality should blend verification, deposits, chargebacks, linked accounts, early churn and responsible-gaming signals, so a strong partner is not penalised because of one unusual player.

• Links between devices, accounts and payments
• Brand bidding and promotional breaches
• Commission holds backed by evidence
• Partner appeals and manual review

Lock the period first, pay partners second

Commission shown on screen is not always ready to pay. Open fraud reviews, late chargebacks, minimum payout levels, currency conversion and invoice or tax paperwork all affect the period. Lock it, reconcile player and wallet events, show each adjustment as its own line with a reason, and require the right sign-off before a payment file is produced. Running this in spreadsheets raises the chance of paying twice, paying the wrong account, or changes to closed history slipping through.

A dependable programme also lets partners handle everyday questions on their own. Where allowed, show clicks, sign-ups, qualifying players, approved and pending commission, payout history and results by campaign or country. Never reveal player names, contact details or game history they do not need. An API and data exports help larger partners. Spinolf designs its affiliate layer around attribution people can trust, commission that can be explained and payouts that arrive on schedule, because the best publishers stay with programmes whose numbers they can check.

• Locking the period and reconciling the money
• Controls for currency, thresholds and documents
• Adjustments with reasons and approval
• Partner reporting that protects privacy

A practical 90-day plan

Spend days 1–30 confirming the market, reviewing the legal position, fixing scope, building the financial model and shortlisting suppliers. Days 31–60 go to integrations, design, payments and setting up compliance operations. Keep days 61–90 for end-to-end acceptance testing, training and a controlled soft launch, with licensing and payment dependencies treated as explicit go/no-go checkpoints.

Once live, check technical errors, deposit approval, withdrawal times, KYC completion, support volume, bonus spend and net revenue daily. Push for growth only when the team can explain those figures with confidence.