An Industry Reshaped by Law, Tax and State Action
India's real money gaming sector grew through the early 2020s into one of the larger consumer-internet categories, with fantasy sports, rummy, poker, and skill-based contest platforms drawing tens of millions of paying users and significant venture funding. That trajectory ended abruptly. The Promotion and Regulation of Online Gaming Act, 2025 received Presidential assent on 22 August 2025, and the Act together with its rules came into force on 1 May 2026. The Act prohibits online money games, that is, games where users pay a fee or stake with the expectation of monetary winnings, irrespective of whether the game is one of skill, chance, or both. Rummy, poker, and fantasy sports played for money fall squarely within the prohibition. Offering an online money gaming service is now a cognizable, non-bailable offence carrying imprisonment of up to three years and fines of up to one crore rupees, with steeper penalties for repeat offenders, and banks and payment intermediaries are barred from facilitating the related transactions. Users themselves face no penalty.
The Act ends the long-running debate over the line between games of skill and games of chance, which had run through state legislation, the 28 percent GST levied on the full face value of deposits, and a stream of high court litigation. For the operators who built the sector, the question is no longer how to insure an uncertain but operating business; it is how to manage the run-off of a prohibited one and, for those pivoting, how to insure the permitted activities (e-sports and online social games that do not involve staking money) that the Act expressly encourages.
For founders and their boards, the starting point is honesty about what insurance can and cannot do. Insurance funds the consequences of operational failures, third-party claims, and security incidents that crystallise during wind-down or in a pivoted business. It never protected, and certainly does not now, against the business risk that the core product is unlawful. The legacy real money operator's live insurance concerns are therefore the tail of user disputes, the cyber and crime exposure on balances still being returned to users, and the directors-and-officers exposure that an enforcement-led wind-down sharply increases.
Platform Liability to Users and Third Parties
An RMG platform's largest third-party exposure is to its own users. Disputes arise over contest outcomes, alleged unfair play or bot activity, withdrawal delays, account suspensions, and allegations that the platform facilitated problem gambling or allowed minors to play. Each of these can generate individual claims and, more dangerously, class-style litigation or regulatory complaints that aggregate many users.
The relevant cover is a professional indemnity and technology liability program that responds to claims arising from the platform's provision of its service, combined with general liability for bodily injury and property damage that the technology cover excludes. The professional indemnity element should be written to cover the platform's core activity of operating paid contests, including disputes over contest integrity and outcome, rather than a narrow software-error definition that excludes the activity that actually generates claims.
Media and content liability is a related exposure. RMG platforms run heavy marketing, sponsor sports and entertainment properties, and publish promotional content, all of which create exposure to advertising-related claims, intellectual property disputes, and regulatory action over advertising standards. The platform's liability program should address media and advertising liability either within the technology cover or as a separate layer.
The underwriting of platform liability for RMG is difficult because insurers are cautious about the sector's regulatory uncertainty and its litigation profile. Operators that present strong controls around contest integrity, age and identity verification, responsible-gaming features, and dispute resolution underwrite more readily and at better terms than operators that cannot evidence those controls.
Cyber, Payment Fraud and the Pooled-Balance Problem
RMG platforms hold large pooled user balances, process high volumes of deposits and withdrawals, and store extensive personal and financial data. That profile makes them a high-value target for cyber attack and payment fraud and exposes them to the cyber and data-protection obligations that apply to any large Indian data fiduciary.
The cyber exposure has three components. Data breach of user personal and financial data triggers notification, investigation, and liability costs, and exposes the platform to obligations under the Digital Personal Data Protection Act 2023 as it comes into force, including potential penalties for inadequate security. Business interruption from a cyber incident that takes the platform offline causes direct revenue loss during high-traffic periods such as major sporting events, when downtime is most costly. Payment and account fraud, including account takeover, fraudulent withdrawals, and bonus-abuse schemes, causes direct financial loss that sits at the intersection of cyber and crime cover.
The pooled-balance problem is specific to RMG and adjacent fintech operators. The platform holds funds belonging to users, and a security failure, an insider theft, or a payment-system compromise that depletes those balances is both a financial loss and a liability to the users whose funds were lost. The cover for this exposure spans a cyber policy for the breach and interruption elements and a crime or fidelity policy for the theft and fraud elements, and the two must be coordinated so that a loss involving both a cyber breach and a fraudulent transfer does not fall into a gap between them.
Operators should map their cyber and crime cover against the specific loss scenarios their balance structure creates, rather than buying standard cyber and crime policies and assuming they interlock. The coordination of the two covers, and the treatment of social-engineering and authorised-push-payment fraud in particular, is where RMG operators most often discover gaps after a loss.
Crime, Insider Risk and Fidelity Exposure
Platforms handling large pooled balances and high transaction volumes face material crime exposure from both insiders and external actors. The crime risk for an RMG operator is larger than for a typical consumer-internet company because the platform's funds are liquid, the transaction volumes obscure individual fraudulent movements, and the staff with system access can cause large losses.
The insider exposure is addressed by a fidelity or commercial crime policy that covers loss from employee dishonesty, including collusion between staff and external actors. The policy should cover the realistic insider scenarios: a finance or operations employee diverting funds, an engineer manipulating contest outcomes or balances, and collusion that combines internal access with external withdrawal. The limit should be sized against the largest plausible single insider loss given the platform's balance and access structure, not against a nominal figure.
The external crime exposure overlaps with the cyber and payment-fraud covers and includes organised fraud rings that exploit bonus structures, money-laundering attempts that use the platform to move funds, and social-engineering attacks that induce fraudulent transfers. The money-laundering dimension carries its own regulatory weight, because an RMG platform handling large cash flows is exposed to scrutiny under anti-money-laundering obligations, and a failure of AML controls is both a regulatory and a reputational risk that crime cover does not address.
The practical structuring question is the boundary between the cyber policy, the crime policy, and the platform's own loss-prevention controls. A loss that involves a cyber intrusion enabling a fraudulent transfer can fall under either policy depending on wording, and operators should confirm that their cyber and crime wordings are coordinated so that such a loss is covered under one or the other rather than disputed between both insurers.
Directors, Officers and the Regulatory Action Exposure
The founders and directors of an RMG platform carry significant personal exposure, and directors and officers liability cover is among the most important elements of the program. The D and O exposure for RMG operators is heightened by the regulatory uncertainty of the sector, which creates several distinct claim sources.
Regulatory investigations and enforcement actions, whether by the Online Gaming Authority of India established under the 2025 Act, tax authorities over the GST treatment, or financial-crime authorities, can name directors personally and generate defence costs even where no liability ultimately attaches, and the Act's classification of offences as cognizable and non-bailable raises the stakes for directors of platforms that operated before or during the prohibition. Shareholder and investor claims arise where a regulatory determination, a tax demand, or an enforcement action damages the company's value and investors allege that the directors misrepresented the regulatory risk or mismanaged compliance. Employment-practices claims arise from the rapid scaling and contraction that characterises venture-funded gaming companies.
The D and O cover for an RMG operator must be scrutinised for exclusions that the sector's risk profile makes critical. A broad regulatory exclusion that removes cover for any matter involving a gaming or tax regulator would defeat the policy's purpose for this sector, since regulatory action is the leading claim source. The cover should fund defence costs for regulatory investigations, with the conduct exclusions limited to final adjudication of deliberate wrongdoing rather than removing cover at the allegation stage.
Structuring an Insurable Program Under Regulatory Uncertainty
Building an insurance program for a former real money operator in wind-down, or for an operator pivoting to permitted e-sports and online social games, means assembling a coordinated stack under conditions where insurers are cautious about the sector's history and some risks are simply uninsurable. The structure that works treats the program as layered covers around a clearly defined core.
The core covers are technology and professional liability for user and contest disputes, cyber for breach and interruption, crime and fidelity for insider and external theft, directors and officers for management exposure, and general liability for the residual bodily-injury and property exposures. Around these sit the marketing and IP exposures, which may be covered within the technology layer or separately, and the property and business-interruption exposures of the platform's physical operations, which are usually modest for a digital-first operator.
The structuring discipline is coordination. The cyber, crime, and technology covers overlap at the edges, and the program should be assembled so that the realistic loss scenarios, particularly those involving the pooled balance, fall cleanly under one cover rather than into gaps between them. The D and O cover must be matched to the sector's regulatory claim profile rather than bought as a generic management-liability product.
The underwriting reality is that operators with a real money history will pay more, accept more restrictive terms, and need to evidence stronger controls than comparable consumer-internet companies, because insurers price the sector's history and the enforcement environment into both appetite and terms. Operators that present documented controls around user protection, security, financial controls, and AML compliance, and that can show a clean exit from prohibited activity, secure better access and terms than those that cannot.
Sarvada works with new-economy operators to structure coordinated insurance programs and to present risk controls to underwriters in a form that improves access and terms, including for the run-off of legacy platforms and the build-out of permitted e-sports and social-gaming businesses. Request Access to evaluate the platform.