In 2011, two people in Vancouver started a company to solve a problem almost nobody had yet. Anna Sainsbury and David Briggs built software that could establish, to a legal standard, exactly where a user was sitting when they made a transaction.
The addressable market at the time was close to nothing. Their company now processes over a billion transactions a month and has expanded into financial services, cryptocurrency and media rights.
The gap between those two sentences is the most repeatable opportunity in regulated markets, and most startup founders never look at it.
The Biggest Unopened Market in the Country
Start with the size of what is sitting there.
California has 39 million residents and more than seventy tribal casinos already operating under Class III compacts, which makes it one of the largest gaming economies anywhere in the world. It has never licensed an online casino. Coverage of online casinos California therefore centers on offshore platforms and the legislative calendar rather than a domestic licensed market, and the state's gaming tribes have signalled that the earliest realistic window for that to change is 2028.
Read that as a founder rather than a player and it says something specific. There is a very large market, a published timeline, and a supply chain that will need to exist on day one and does not exist yet.
That is a rare combination. Most markets do not tell you years in advance when they are going to open.
The Pattern Is Consistent
Here is the mechanism, and it repeats across every regulated sector.
A jurisdiction writes rules. The rules create obligations that operators must meet before they can trade: verify identity, confirm location, certify the product, audit the payouts, report the transactions. Each obligation is a technical problem, and each one is far outside the core competence of the businesses obliged to solve it.
An operator wants to run games and acquire customers. It does not want to build a geolocation stack, a sanctions screening engine and a licensing workflow system, and it certainly does not want to maintain them across a dozen jurisdictions with different rules.
So it buys them. The vendor category exists because the regulation created a requirement that the regulated party has no appetite to build.
Which means the moment you can read a regulatory timetable, you can read a product roadmap.
What the Category Actually Contains
Worth breaking out, because founders tend to see one product where there are five separate businesses.
Compliance geolocation. Establishing a user's jurisdiction to an evidentiary standard, using GPS, WiFi, cellular and IP data together rather than IP alone, which is trivially manipulated.
Identity verification. Matching a claimed identity to a real one, at signup rather than at withdrawal, across documents from every issuing authority.
Payment orchestration. Routing transactions through processors that will accept the category, with fallbacks, in markets where card acceptance is inconsistent.
Product certification. Independent test houses verifying that a game's mathematics match its published return, before it can be offered anywhere regulated.
Licensing management. Tracking applications, renewals and reporting obligations across jurisdictions, which for a multi-state operator becomes a full-time function.
Every one of those is a company. Several of them are large companies. None of them existed as a category before the rules did, which is the whole point, and it is the sort of second-order technology opportunity that gets missed because it looks like plumbing rather than product.
The Part Worth Copying
Back to Vancouver, because the execution details matter more than the idea.
GeoComply was founded in 2011, and its software was originally built to help with compliance under the Unlawful Internet Gambling Enforcement Act of 2006. The US sports betting market did not open until the federal ban was struck down in 2018. That is seven years of building for a market that had not arrived.
More striking is how they funded it. The company grew conservatively and profitably through that entire period and took no institutional capital at all until March 2021, when Blackstone Growth and Atairos led its first outside round. Sainsbury's own account is that the company had fielded investment enquiries for years and was in a position to wait for the right one. Norwest and Arctos followed in 2023.
Profitable, capital efficient, founder-led, and positioned before the wave. GeoComply reached more than 550 employees across ten cities and acquired OneComply, a fellow Vancouver startup building licensing workflow software, extending the platform rather than diversifying away from it.
The lesson is not that patience is a virtue. It is that a company building for a regulatory timetable has a genuine reason to be patient, because the demand arrives on a date somebody else has already published.
Why the Same Technology Travelled
The expansion is the most instructive part, and it was not luck.
Once you can prove where a user is to a compliance standard, that capability is not really about gambling. It is about jurisdiction, and jurisdiction is a problem in every regulated sector.
Financial institutions need it for sanctions screening, since serving a customer in a prohibited territory is a serious matter regardless of industry. Cryptocurrency exchanges face the same obligation. Broadcasters need it for media rights, because content licensed for one country cannot be served into another. The Globe and Mail traced how a company built for one industry ended up as infrastructure for several.
The underlying insight generalises: a compliance problem defined narrowly in one sector is usually a general capability wearing a vertical costume. Build the capability properly for the demanding customer and the adjacent markets are a sales problem rather than an engineering one.
What to Do With This
Three practical points for anyone building in or near a regulated market.
Read the legislative calendar as a product roadmap. Bills, compacts and ballot measures are published well in advance. California's 2028 window is not a secret, and neither are the obligations any licensed framework would impose.
Sell to the operator, not the end user. The consumer market is contested, expensive and often closed to you. The supply chain is neither, and its customers have a compliance deadline rather than a discretionary budget.
Build the capability, not the feature. The version of your product that solves a general problem for a demanding regulated customer is the version that ports into three other industries later.
None of this requires a view on gambling. It requires noticing that every time a government writes rules, it also writes a purchase order, and somebody has to be ready to fill it.
