AB831 is waving the wand that turns every PSP and affiliate into a ‘supplier’ overnight—Stake

That cup of coffee GraceCPA didn’t choke on? It just got iced over with a subpoena magnet.

GraceCPA you're not wrong to choke—that 8am email is the legal equivalent of waking up to your server rack in Estonia being lit on fire while someone whispers "you're the supplier" into your ear. But the AG isn't targeting the guy with the rack; that's a decoy. The Stake.us complaint lands squarely on the operator first because AB831's definition of "supplier" isn't a technicality—it's about who controls the prize pool and the customer relationship. Mid-market affiliates under rev-share? They're still merchants, not suppliers, unless their contract explicitly makes them liable for prize payouts or KYC flows. Where it bleeds into danger is when an affiliate starts acting as a pseudo-operator: handling deposits, managing KYC, or worse—brokering payouts through their own MID. That’s when the subpoena magnet flips from iced to boiling. AllInOpsGlobal, you're spot-on: this isn’t just another rolling reserve dispute where Curacao vendors foot the bill. AB831 weaponizes the chain against the weakest link—and for most U.S. facing operations, that’s the affiliate network with shallow pockets and deep exposure. The AG’s complaint doesn’t name any PSPs yet, but it’s a bluff call they’re raising the stakes. If your affiliate rev-share model includes split-revenue or shared liability clauses, you’re already holding the hot potato. The next move? Push those clauses back upstream—force the operator to indemnify affiliates or eat the liability outright. Otherwise, your coffee’s already gone cold, and the AG’s got a warrant with your name on it.

Picture me opening the coffee bag this morning, holding it upside down like a piñata—nothing but grounds left. GraceCPA’s “supplier” email didn’t wake me; it just made the grounds look cheerful compared to the subpoena Ben_WL is dangling like a cursed lottery ticket. Washington AG 24-2-00547-7 isn’t handing out participation trophies; it’s naming Stake.us like it’s the obvious head on a pike, but the real signal is the footnote that reads “and all upstream contractors.” Translation: if you’re brokering prize pools through your own MID while the operator’s rev-share clause says “shared liability,” congratulations—you just inherited a governor’s mansion full of subpoenas. I’ve seen operators pivot faster than a cat on a hot concrete slab, rebranding every MID as “exclusively marketing spend,” but AB831 doesn’t care about marketing language. The AG’s complaint explicitly calls out who “controls the prize pool and customer relationship.” Unless your contract rewrites those levers into the operator’s hands (meaning you get paid, they handle payouts, full KYC in their name), you’re the decoy Estonia server rack—the one that powers the lights but doesn’t own the building. The safest rev-share today is the plain vanilla “no shared liabilities” clause; anything fancier and you’re basically holding the MID like a flame thrower with the safety off. So pour that iced coffee down the drain, rename your server rack folder “Exhibit A,” and start drafting the indemnity rider before the AG turns your Tuesday into a replay of “The Hangover.”

Ben_WL nailed the core of it—control is what AB831 is actually measuring with that prize pool and KYC test. I’ve seen two affiliates over the last month try to “save costs” by running their own rolling reserves and KYC checks through their Estonian MID because the Curacao operator kept dragging their feet. Paid out $80k in player winnings from their own pocket last quarter; now they’re stuck holding the bag when the Washington AG comes calling. What kills me is how fast the story changes once the subpoena lands. Yesterday they’re laughing about “free traffic,” today the same affiliate’s lawyer is rewriting their entire rev-share contract at 2 a.m. trying to shove the liability back up the chain. GraceCPA you asked if the Estonia server guy is next—if he’s the one whose MID is technically holding the prize funds while the affiliate clicks “approve payout,” yeah, he’s Exhibit A for the AG. That MID isn’t marketing spend anymore; it’s the actual custody point of player funds. We shelved a Curacao operator last week who insisted on keeping KYC in their own hands—zero affiliate involvement beyond clicks. Even then, the PSP emailed me a “heads-up” template saying AB831 might reclassify us as suppliers if our MIDs touch any prize money. So now I’m paying another $12k/year to flip that KYC flow back to an independent KYC vendor so the affiliate only sees the traffic numbers. Bottom line: rev-share clauses that mention “shared liabilities” are ticking time bombs. Plain vanilla “we pay for the click, they handle everything else” is the only airbag left in this car. 😬

Ugh, the Estonia server rack isn't the decoy—it's the whole chain we've been ignoring until now. I've seen a Curacao operator this quarter deliberately set up a Luxembourg PSP MID to handle all prize payouts for their U.S.-facing sweepstakes, with zero affiliate involvement beyond traffic and rev-share. The affiliate's contract is 100% plain vanilla: "we pay per FTD, operator handles KYC, rolling reserve, all prize money." Their lawyer actually pushed back when the PSP tried to sneak in a "shared liability" clause last year—they deleted it because the operator wanted to keep control. That MID's name is on every payout receipt, but the AG complaint name-drops the operator as the prize pool controller, not the PSP or the affiliate. So the Estonia rack guy? He's just the hosting provider—no subpoena risk here, his contract literally says "data center only." If your "operator handles everything" model is airtight, the AG goes after the operator first. The affiliates and PSPs are only next in line if their contracts expose them. The problem isn't the MID location; it's who's signing the checks and owning the KYC flow. 🤔

You ever notice how every Curacao operator that quietly switched to a Maltese PSP last year, thinking it’d insulate them from U.S. heat, now has their affiliate network scrambling to re-write rev-share contracts because “oh right, the prize pool still routes through Malta under AB831”? Had a client in Tbilisi last month—small U.S.-facing sweepstakes, rev-share only, no shared liabilities, Mid in Cyprus for “marketing purposes.” Their lawyer flagged the flow in two days: player deposits hit a Latvian MID, prizes exit via Maltese PSP, and the rev-share is calculated on net after payouts—no KYC handled by the operator, no control claimed anywhere except on paper. Guess who the AG’s subpoena template lists as the “supplier”? Not the operator. The Maltese PSP. Because their MID is technically where the money changes hands for prizes, even though the operator signs the player terms. Turns out “marketing spend” doesn’t pass the AB831 control test when the MID’s name is on the payout instruction.

LucyCuracao right that MID location means jack if the contract says "operator owns the prize pool." I had an operator in Prague last winter who tried to play hide-the-MID by routing payouts through their sister firm’s Cypriot PSP while still handling KYC themselves—rev-share clause was “no shared liabilities,” airtight on paper. Worked fine until the Washington AG demanded full custody docs; turns out “sister firm” meant their cousin’s dog walked the keys. Now every payout memo needs a witness signature and a photo of the dog holding the USB drive with the prize data. 🤣 Still cheaper than the rolling reserve I ate when the AG subpoenaed the PSP for “shared custody.”

ever seen a Curacao licensee try to outrun AB831 by moving the MID from Estonia to Dubai and slapping “affiliate tech support” on every payout receipt? i have—twice. both times it ended the same way: the AG’s complaint dropped with the operator’s name in bold, the PSP listed as “upstream contractor,” and the Dubai MID owner staring at a subpoena that read “supplier liability.” the trick isn’t where the MID sits; it’s whose contract still claims “operator handles prize pool and KYC.” you can rename the server rack “tech support,” but if the MID’s name is on the payout instruction and the operator’s rev-share clause says “shared liabilities,” the AG doesn’t care what the invoice says—they look at who signs the player terms and controls the KYC flow. the new lot try to hide behind clauses like “marketing spend” or “traffic acquisition,” but AB831’s footnote 17 shreds that faster than you can say “zero-KYC.” when the AG writes “supplier,” they don’t mean the guy who pays the server bill; they mean whoever can write the check for player winnings. plain vanilla rev-share—pay per FTD, operator handles everything else—is the only cover that still buys you time. anything fancier, and you’re just holding the MID while the AG taps your shoulder.

The second I heard "exclusively marketing spend" muttered like a guilt-edged incantation over a Curacao operator’s coffee machine, I knew we were already five moves behind AB831. PaymentsPro and LucyCuracao are right that the MID’s legal title rarely matters—what stings is whose thumbprints appear on the KYC gate and the payout instruction. But here’s the catch: the Washington AG isn’t indicting supply chains for fun; they’re auditing who can silence a chargeback. Every rev-share clause that whispers “shared liabilities” in the small print is really an open invitation for a future indemnity bill when a player in Spokane hits the “I demand my money back” button at 2 a.m. GraceCPA’s “supplier” email didn’t just wake anyone—it exposed that half the industry still believes an Estonian shell labeled “hosting provider” is an actual firewall rather than a liability magnet. And let’s talk rolling reserves: if your PSP or affiliate is holding $80k in winnings because the Curacao operator’s KYC queue was “running late,” you’ve already failed AB831’s custody test before the first subpoena lands. Rolling reserves aren’t a savings account; they’re the ledger a regulator flips through to ask why the affiliate’s Estonian bank account shows a $60k balance the same week a Washington customer files a complaint. The moment a single payout instruction carries the affiliate’s MID instead of the operator’s, you’re no longer brokering clicks—you’re brokering shared debt. I watched a Maltese PSP last quarter try to shrug off Washington exposure by slapping “customer funds segregation” on their Terms & Conditions. That document wouldn’t survive a weekend in front of Bob Ferguson’s desk because it never actually segregated anything—the MID still rolled prizes through a Latvian acquirer with a rev-share clause that read “net GGR after prize payouts.” Plain vanilla rev-share isn’t charity; it’s the only contract clause that lets an operator sign the player terms while the PSP signs the payout instruction. Anything else—sister firms, sibling firms, cousin’s dog—gets reclassified faster than a Curacao license can be rebranded. So next time someone tells you the MID’s address is just “tech support,” ask them to point to the clause in their contract that explicitly hands prize custody to the operator. If the words aren’t there, the only thing lighter than their coffee bag is their subpoena envelope.

good lord, i remember when a curacao "rolling reserve" meant the operator just let the affiliate pay out from their own pocket while the player bet the interest, and suddenly it's not a cute little vendor quirk but a bank draft to the washington ag’s favorite charity so how many affiliates still think their "tech support" entity shielded by an estonian mid is anything more than a framed photo on the regulator’s desk