iGaming Affiliate Marketing in 2026: How the Business Actually Works

Money starts as a player deposit and reaches you only after the operator counts what it kept, which is never the same number. Three commission models split that risk differently. None fits every traffic type. Conversions arrive by server-to-server postback keyed to a click id, so ad blockers and Safari's ITP never get a vote on your income. Run this as a finance business or lose it as a traffic one.

Most introductions describe this job as sending clicks somewhere. That's the smallest part of it. You're joining a chain of payments with a reporting layer bolted on, and if you don't know where each link sits you'll spend years arguing about numbers you can't check.

Who actually pays whom

A player deposits money at a casino. That deposit is not revenue and never was. The operator pays out the winners, takes off bonus money, payment processing and gaming tax, and what survives that subtraction is net gaming revenue, NGR, which is the only pot your commission is ever paid from.

Not the deposit. Not a marketing budget that exists whatever the players do.

Which is why the NGR definition and the carryover clause decide more than the headline percentage does. They set what counts as revenue before your percentage ever touches it, and a generous-looking rate sitting on a hostile definition pays less than a modest rate on an honest one. NGR and negative carryover, explained takes that clause apart line by line.

So the chain runs player, operator, affiliate, and a platform like AFFILIFY sits between the last two as the record keeper. We log the click, take the operator's conversion report, match the two, calculate commission against your deal and your level, hold the balance while it clears, score it for fraud, release it. Seven steps. Affiliates have been quietly shorted at every one of them, at some network, at some point. So we make the arithmetic checkable from your side: your conversion events come back out over the affiliate API with a personal key, event by event, and you can reconcile our numbers against your own without asking anyone's permission.

Three commission models, and what each costs you

CPA pays a fixed amount per qualifying first-time deposit, $125 at Bronze rising to $325 at Diamond on the published ladder. It opens at Bronze, so ten qualifying deposits and an admin review stand between you and the option. Fast, knowable before you spend a cent, and none of the operator's downside lands on you. The tail is what you give up. A player who stays four years earns you exactly one payment, and nothing in your reporting will ever tell you it happened.

With RevShare you take a percentage of the NGR your players produce, for as long as they keep playing. Trial starts at 25%. Diamond reaches 55%. The upside compounds and so does the exposure, because a month where your players run hot is a month of negative NGR, and where carryover applies that hole follows you into the next one.

Hybrid is a smaller fee at the deposit plus a percentage after it. Most experienced affiliates end up there, and they pay for the comfort twice, because the fee sits below a pure CPA and the percentage below a pure RevShare. Nobody hands you both sides for free. Which model fits which traffic is the whole of CPA vs RevShare vs hybrid.

Only one of those risks is invisible while it's happening to you, and it's the CPA one. Nothing in your reporting tells you the player you sold for a flat $125 went on to fund somebody else's quarter. You just never find out. So here is the plain version, since most guides refuse to say it: CPA on SEO and community traffic is usually the wrong model, because those are exactly the players who stay, and a fixed fee is the one instrument that cannot pay you for staying.

How a conversion is actually reported

This decides whether you get paid at all, and almost nobody checks it before signing.

When someone clicks your link, the redirect appends a click id to the destination URL under the operator's own parameter. The player registers, then deposits. The operator's server calls our endpoint with the event, a player identifier and that same click id, and that call goes machine to machine at a moment when the player's browser is closed or four pages away. The browser is not in the chain when your money is decided. An ad blocker can't strip a call it never sees, and Safari's Intelligent Tracking Prevention gets no vote on a cookie nobody set. Pixels decay. Postbacks don't.

Behind the click id sit the fallbacks, in order: a player token, the link code, a first-party cookie, a device fingerprint. Those are for the messy cases. Verify the normal one yourself, and verify it before you spend money rather than after a month goes missing. Click your own link from a real phone on mobile data. Ten minutes, once. Confirm the click id lands on the destination URL, under the parameter the operator named, spelled the way the operator spelled it. If it isn't there, nothing downstream rescues you, and no amount of arguing after the fact puts the conversion back. Ten sub-id slots ride along with every click, so fill at least two of them before you have a reason to. Event vocabulary is in the FTD, NGR, CPA, CPL and CPR glossary.

The traffic sources that still work in 2026

Five channels still move real iGaming volume. Each one carries a rule that ends accounts without warning and without appeal, and it's almost never the rule people brace for. Learn the rule first.

• SEO content. Slow, compounding, still the best asset in this business because you own the thing that ranks. The landmine isn't Google. In a licensed market the operator's licence conditions reach your pages, and one misstated bonus term gets your account closed by a compliance team you have never spoken to.
• Media buying. The fastest feedback loop there is, and the only channel where CPA arithmetic is honest to the cent, because you know what the click cost. The big ad platforms approve gambling advertisers country by country, and cloaking around a rejection gets you banned permanently rather than warned. There is no appeals desk.
• Telegram and communities. Cheap to start, brutal churn, and a natural fit for RevShare because the audience actually stays put. Watch the tipster framing: a channel promising outcomes with no 18+ line anywhere on it is the screenshot a regulator puts in a press release.
• Streamers and short video. Trust transfers better here than anywhere else. Which is exactly why the platforms police it hardest. Twitch banned links and referral codes to slots, roulette and dice sites it doesn't consider adequately licensed. Distribution a policy update can delete isn't a business yet.
• ASO and app traffic. This one is underused because it's genuinely hard. Both app stores treat real-money gambling as a restricted category approved country by country, and in many regions the developer account has to belong to the licensed operator itself, so you're promoting somebody else's listing or you're not in the channel at all. Which is a real barrier and, for whoever gets in, a real moat.

Compliance, in the version that affects you

Compliance isn't a legal department's problem that trickles down to you in a memo, six weeks after somebody senior already decided. It's your operating floor. Four things.

Everything you publish is 18+, and 21+ in some markets. Everything means the creative, the landing page, the channel bio, the pinned message and the video description, not only the tick box on the operator's own registration form.

No vulnerable audiences. No debt-relief framing, no "make rent this weekend", no keywords bought off people searching for help with a gambling problem. That last one gets bought constantly, because it converts. It converts because the person clicking is in trouble, which is the entire reason not to.

Local rules are local, and they are not variations on a theme. Italy has banned most gambling advertising outright since the Dignity Decree, Spain has boxed in how and when a bonus can be put in front of a newly registered player, and Germany runs its own licensing regime with its own limits on what may be said and where. Three European markets, three incompatible rulebooks. If you can't name the regulator of the GEO you're running, you're guessing with your account as collateral, and how to choose your first GEO is that decision made on purpose instead.

And a deal's GEO list is not a suggestion. It's the outer edge of what that operator is licensed to accept, traffic from outside it can be voided months after you spent the budget, and "but the player deposited" has never once won that argument.

Getting paid, and what holds it up

Earnings accrue as pending and clear to available on the 15th of each month, in USD by default. Identity verification happens once, before your first payout, so do it on day one and it never blocks anything again. One caveat we would rather state than have you discover: deposits sitting under security review are held until they clear, and if a review is still open on the 15th, that money waits for the review and not for the date. Stage by stage, that's how AFFILIFY payouts work.

We publish the caveat because a platform promising the 15th unconditionally is either lying or not looking. Somebody else's fraud gets paid out of the same commission budget your clean conversions come from, which is the part of this business nobody enjoys saying out loud. So every click is scored for proxy and VPN use, for velocity and for uniqueness, and the backoffice correlates devices and IP addresses across accounts to find one person wearing five hats. Holds are annoying. They are also the reason the rate printed on the ladder is the rate you actually get.

The opinion: this is a finance business

Almost everyone arrives as a traffic person. You learn a channel, get good at it, point it at an offer, and for a while that is genuinely enough. Then it stops being enough, and the people still standing five years later all made the same switch at some point: they quit optimising clicks and started running a P&L.

Here is the uncomfortable version. If you can't state your cost per FTD in your best GEO right now, to the dollar, without opening a spreadsheet, you don't have a business, you have a hobby with a payout schedule.

In practice the switch is boring. You know cost per FTD by GEO and by channel, never in aggregate, because an aggregate is one market quietly subsidising another until it stops. You know which of your deals are CPA and which are RevShare and why, per traffic type, without phoning an affiliate manager to ask what you signed. Pending and available are different kinds of money to you. And you hold working capital for the month one player wins big and your RevShare goes to zero, because that month is coming whether you budgeted for it or not.

A traffic person with a bad month buys more traffic. A finance person opens the ledger, finds the held deposits or the carryover balance or the GEO that quietly stopped converting, and knows inside twenty minutes whether the problem is the traffic or the deal. Different businesses. Only one of them survives a bad quarter.

Every mechanism in this article exists so you can run that check yourself and take nobody's word for it, ours included: the published ladder, the conversion events you can pull over your own API key, the postback trail you can verify from a phone on mobile data. Use them. Then go and clear the gate, which is your first 30 days as an iGaming affiliate.