In August 2025, CISA, the US cybersecurity agency, published a draft revision of the government’s minimum list of what a software inventory has to record.
The 2021 original had seven fields, and the revision added two that matter here: a hash of each component, and its licence. Both the draft and the final version, published in July, set no limit on how deep the list goes: every dependency, however far down.
If you’re about to pay for a crypto casino codebase, ask for that inventory first. It answers what you want to know: what’s in this, and on what terms do I hold it?
Files Are Not Rights
Anyone evaluating crypto casino source code should establish what the purchase actually includes. The contract determines whether the buyer receives documentation, the right to modify and redeploy the code, and the means to keep it running.
Documentation rarely gets its own clause, but it matters: without it, the next developer hired may struggle to maintain or extend the software.
Under UK law an assignment of copyright has no effect unless it’s in writing and signed by or on behalf of the assignor. Without that, what changed hands is at most a licence.
Licences the seller had already granted to others generally bind the new owner too, unless it bought in good faith and without notice of them.
Then there’s whether the seller owned it. Code written by a contractor stays the contractor’s unless it was assigned in writing; the company that paid for it may hold only an implied, limited licence.
Buyers of software businesses routinely ask for signed assignments from everyone who wrote the code. Ask for the same list of names.
The Licences Inside the Code
Most of any modern codebase is other people’s libraries, each with its own terms. Permissive licences like MIT ask little beyond keeping the notices. The GNU General Public License requires that if you distribute a modified program you distribute its source under the same terms, and interaction with users over a network doesn’t count as distribution. The Affero version closes that gap: section 13 says that if you modify the program and people interact with it remotely, you must offer those users the source of your version.
A casino is a network service, so an AGPL component somewhere in a purchased stack, modified by you or by the seller before you, can oblige you to publish code you thought you’d bought outright. The SPDX project keeps a standard list of licence identifiers so an inventory can be checked by machine. Get the software bill of materials before you pay, ask for it in the current format with the licence field filled in, and have someone read that column.
The Case for Commissioning
Commissioning a build makes sense when, inventory in hand, none of the codebases on offer can be shown to do what the product needs on terms you can live with. You’ll need a finished specification, a budget with contingency, a test plan and a maintenance arrangement for the years after launch. Your developers pull in dependencies too, so make the inventory a deliverable.
Settle ownership at the start. If the developer assigns the finished code to you in writing, you own it. If it keeps the code and licenses it to you, and that’s common, ask where the source goes if the developer stops trading. The usual answer is an escrow agreement. The source sits with a third party and is released to you if the supplier becomes insolvent or fails its maintenance obligations. Escrow agents offer verification up to a full compilation of the deposit, which is the only level worth paying for.
Either Way, the Same Questions
Both routes raise the same operational questions. Start with money. How are deposits, withdrawals and balances recorded, and can the books be reconciled to on-chain balances when someone asks? New York’s financial regulator expects the virtual-currency custodians it supervises to segregate customer assets both on-chain and in their own ledgers, with an audit trail per customer even where funds sit in a shared wallet.
The integrations the product needs, for games, payments and identity, either connect through documented APIs or get wired in by hand. Find out which, because the difference shows up in every later change.
Security comes down to who can change what, how limits and approvals are enforced, and who has tested the system besides the people who wrote it. The legal layer is its own subject: whether the product, the markets and the operating model meet the licensing and data-protection rules that apply to them. How operators choose an offshore licence is where to start on it.
Beyond the Quote
Neither quote is the whole bill. A purchased codebase may need remediation, years of deferred dependency upgrades, integration work for every service the seller’s reference customer didn’t use, and customisation to reach the product you wanted.
A commissioned build carries escrow fees, inventory reviews and a maintenance contract. You at least see those on the invoice.
Put both on one sheet: a budget that runs several years, a named owner for each milestone, the support arrangement after go-live and what maintenance is likely to cost. Price a hidden AGPL dependency or an unassigned contractor on the same sheet.
Check the List
The SPDX licence list has been on version 3.29 since 16 September, and that’s the list a seller’s inventory should be using. If the licence column is full of identifiers that aren’t on it, ask why before you pay.
