AML Compliance Checklist for iGaming Operators (2026)

Most AML failures in gambling are not failures of knowledge. Operators understand the rules; what breaks is the operational layer where policies meet daily decisions. This checklist is built around the areas regulators test at audit and in enforcement, so it can be used both to build a programme and to stress-test one that already exists.

1. Business-wide risk assessment

Document the money-laundering and terrorist-financing risks of your products, customer base, markets, payment methods and delivery channels, rate them, and link each identified risk to a control. Update it at least annually and whenever you add a market, product or payment method. Regulators ask for this document first.

2. Policies and procedures that match the business

Policies must describe how your operator actually works, not a template. They should cover customer onboarding, due diligence tiers, enhanced measures, source-of-funds and source-of-wealth, PEP and sanctions screening, monitoring, reporting, record-keeping, training and governance, with named owners and version control.

3. Customer due diligence tiers

Define what is verified at registration, at first deposit and at defined thresholds, and how. Identity and age verification before play, address and payment-method ownership checks, sanctions and PEP screening, and clear rules for when a customer moves from standard to enhanced due diligence. Document exceptions and how they are approved.

4. Source-of-funds and source-of-wealth triggers

Set objective triggers, such as cumulative deposits, net losses, velocity, use of multiple payment methods, crypto deposits or high-risk jurisdictions, and define what evidence is acceptable at each level. Record the review, the decision and the reviewer. A trigger without a documented outcome is the most common audit finding.

5. Transaction monitoring

Monitoring must generate alerts for unusual patterns: rapid deposit and withdrawal with minimal play, structuring below thresholds, mismatched payment instruments, chip dumping in peer-to-peer games and account takeovers. Every alert needs a disposition within a set time, and the rules should be tuned on a schedule using alert outcomes.

6. Suspicious activity reporting

Define how staff escalate suspicions internally, how the MLRO decides, the deadline for filing with the financial intelligence unit, and how tipping-off is prevented. Keep a register of internal and external reports with reasons for decisions not to file.

7. The MLRO and governance

Appoint a regulator-approved MLRO with authority, resources and direct access to the board. Report AML metrics to senior management at least quarterly: alert volumes, dispositions, reports filed, high-risk customer counts, training completion and open issues.

8. Training

Role-based training at onboarding and annually, with records of attendance and assessment. Front-line, payments, VIP and compliance staff need different content, and VIP teams are a known weak point.

9. Record-keeping

Retain due diligence records, transaction data and reports for the statutory period, typically five years after the relationship ends, in a form that can be produced quickly. Align with your GDPR retention schedule.

10. Independent review and audit readiness

Commission an independent AML review at least every one to two years, remediate findings with owners and deadlines, and keep an audit file: risk assessment, policies, training records, monitoring tuning, SAR register and board reporting.

11. Responsible gambling interface

AML and safer-gambling signals overlap. Ensure that affordability checks, large losses and source-of-funds reviews are shared between the two functions, since regulators increasingly review them together.

Our compliance and AML practice builds and audits AML programmes for operators in Malta, the UK, the EU and Poland. For the regulatory background, see our article on what AML compliance requires.