Short answer: Ontario’s regulator, the AGCO, imposed a CA$100,000 monetary penalty on NorthStar Gaming (Ontario) Inc., reported at the end of August 2026. A player in an occupation the operator’s own policy rated high risk passed its CA$25,000 lifetime deposit trigger for enhanced due diligence in March 2024, but no source of funds verification followed, and deposits reached about CA$189,000 by June 2025.
What happened?
- The account was opened in March 2024 and passed the CA$25,000 lifetime deposit threshold that month.
- NorthStar’s policy required high-risk classification and enhanced due diligence, including source of funds verification, at that point. It was not applied.
- The policy also called for escalation, such as refusing transactions, when risk indicators appeared. That did not happen.
- Deposits continued, including CA$55,000 in December 2024, reaching about CA$189,395 by June 2025.
- After AGCO inquiries, the operator classified the player as high risk and closed the account.
What should Ontario operators check?
The case is about following your own rules. Most operators have a written trigger; the failure is in wiring it to an action. Practical checks:
- Every EDD trigger in the policy generates a case automatically, with an owner and deadline.
- Occupation and other profile risk factors feed the risk score, not just deposit totals.
- Accounts with an overdue EDD case have deposits restricted by default.
- Regular sampling confirms triggers fire as designed.
Lora’s source of funds guide lists trigger types and evidence, and the KYC by market guide summarises Ontario and FINTRAC duties. Player communication matters too: igaming.cx’s KYC drop-off guide covers document requests that players complete. Cevro supports Ontario operators such as PowerPlay; its KYC automation article explains how AI agents handle verification conversations. Training on AML triggers is available through Cevro Academy.
What should operators check, by market?
| Market | What operators should check | Rule or source |
|---|---|---|
| Ontario | Every EDD trigger in policy creates a case; overdue cases restrict deposits; occupation risk feeds the score | AGCO Registrar’s Standards |
| Great Britain | Same expectation that triggers lead to action; see the QuinnBet and Grosvenor cases | Gambling Commission AML guidance |
| Malta | CDD and EDD applied as the risk assessment requires, with evidence kept | FIAU Implementing Procedures |
| New Jersey | Bank Secrecy Act programme for casinos, including suspicious activity reporting | 31 CFR Part 1021 |
Frequently asked questions
How much was NorthStar fined?
CA$100,000, imposed by the AGCO.
What was the trigger that was missed?
A CA$25,000 lifetime deposit threshold in NorthStar’s own AML policy, which required enhanced due diligence including source of funds verification.
Which rules apply to AML in Ontario iGaming?
The AGCO’s Registrar’s Standards for Internet Gaming and federal AML law administered by FINTRAC.
How can operators test that triggers fire?
Sample accounts that crossed each trigger and confirm a case was opened, worked and closed with evidence.
Further reading
- Source of funds checks: Lora guide
- AML red flags: Lora guide
- KYC drop-off without weakening compliance: igaming.cx
- AML training: cevro.academy
Sources
More guides
Enhanced due diligence triggers
How to set and wire EDD triggers so reviews happen before large losses or wins.
Source of funds and source of wealth
When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.
KYC requirements in Ontario
AGCO identity standards, age 19, geolocation, FINTRAC identification and PEP rules.