Sweepstakes Compliance Consulting for Operators
Nine states have banned the model outright — eight in force, Oklahoma’s from 1 November. Six more closed without passing a bill. The question is no longer whether the sweepstakes market gets regulated — it is whether a given operator survives the next twelve months of it.
What is actually happening
California removed roughly a fifth of the industry’s US revenue on 1 January 2026 and extended criminal liability to payment processors, geolocation providers, content suppliers and media affiliates. New York’s Section 912 did the same and added the Attorney General and the State Police to the enforcement list. Indiana defeated two attempts to license the model instead of banning it. Louisiana’s governor vetoed a ban on the grounds that the games were already illegal, and the Gaming Control Board then issued forty cease-and-desist orders and sued for $44 million. Oklahoma’s governor vetoed his legislature’s ban as vague and overbroad in May, and was overridden inside a week.
An operator whose compliance function tracks bill calendars is monitoring the slower half of the threat. West Virginia never filed a bill. Around fifty subpoenas cleared the state anyway.
Minnesota made the same point from the other direction this year. SF 4474 passed the Senate on 30 April, then died in a House committee when the session adjourned on 18 May — a clean legislative defeat, and a headline several operators read as a reprieve. The Attorney General had already issued exit orders while the bill was still moving. The market was closed either way. Anyone whose Minnesota position changed on 18 May was watching the wrong instrument.
What is on offer
Fixed-fee readiness audit
An assessment against the seven sections of the Readiness Framework. Scoped in a week, delivered as a gap list with an implementation sequence, priced as a fixed fee before work starts. No day-rate creep, no open-ended engagement.
Security and access audit
Narrower and faster. Credential handling, access control, session management, data retention, and the geolocation stack that every state statute now assumes is working. One week. This is usually the right first engagement, because it can be scoped precisely and it finds something every time.
Fractional compliance
A retained monthly arrangement for operators who need a compliance function and cannot yet justify a full-time hire. Implementation, not advice — the deliverable is a changed product, not a memo.
The credential
Every argument on this site is demonstrated rather than asserted. Flickloot is a working social casino built to the framework — published reel weights, a self-service audit any visitor can run in their browser, a geolocation gate that cites the statute blocking them, functioning session limits, reality checks, and irreversible self-exclusion. It was built by one person, in evenings, without a licence, a testing house, or a budget.
Which is rather the point. The features operators say are impractical took one person a few weeks.