KYC and AML in Online Gambling
How operators verify players and keep criminal money out: KYC rules by market, source of funds and wealth, enhanced due diligence, PEP and sanctions screening, red flags and transaction monitoring.
KYC (know your customer) is how operators confirm a player’s age and identity; AML (anti-money laundering) is the wider programme of risk assessment, due diligence, screening, monitoring and reporting that keeps criminal money out. In most regulated markets identity is verified before play, and enforcement in 2026 focused on operators that set triggers but did not act on them.
Start here
New to the topic? Read these in order.
- KYC rules by market
When identity and age must be verified in eight regulated markets, and which registers apply.
- Source of funds and source of wealth
When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.
- Enhanced due diligence triggers
How to set and wire EDD triggers so reviews happen before large losses or wins.
- AML red flags for operators
The payment, gameplay and customer warning signs that should trigger review.
Guides in this topic
Grouped by subtopic.
KYC
KYC rules by market
When identity and age must be verified in eight regulated markets, and which registers apply.
KYC by market
KYC requirements in the UK
Verification before play, GAMSTOP, MLR 2017 due diligence and financial vulnerability checks.
KYC requirements in Ontario
AGCO identity standards, age 19, geolocation, FINTRAC identification and PEP rules.
KYC requirements for MGA licensees
Age checks, the €2,000 due diligence threshold and FIAU expectations.
KYC requirements in Sweden
Registration, BankID, Spelpaus checks and Swedish AML duties.
KYC requirements in Germany
GlüStV identification, GwG section 16, LUGAS and OASIS.
KYC requirements in Brazil
CPF validation, facial recognition, prohibited bettors and SPA AML rules.
KYC requirements in Mexico
LFPIORPI identification and notice thresholds, records and SEGOB permits.
KYC requirements in New Jersey
N.J.A.C. 13:69O registration data, multi-source authentication and age 21.
Due diligence
Source of funds and source of wealth
When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.
Enhanced due diligence triggers
How to set and wire EDD triggers so reviews happen before large losses or wins.
PEP and sanctions screening
Screening players against PEP and sanctions lists: when, which lists, and how to handle matches.
Onboarding and verification
Player drop-off after registration
Why players leave between sign-up and KYC approval, how to measure it, and how engagement and approval agents shorten the wait.
Monitoring and red flags
AML red flags for operators
The payment, gameplay and customer warning signs that should trigger review.
Transaction monitoring basics
Rules, scenarios, alerts and case handling for gambling transaction monitoring.
Key numbers
Figures from regulators and official sources, with links.
Latest news
- Star Ordered to Pay AU$260m as Court Finds AML Failures With High-Risk CustomersThe Federal Court split the penalty AU$195m for Sydney and AU$65m for the Gold Coast, payable over 19 months, after finding Star let high-risk customers gamble without source of funds checks.
- Ontario: NorthStar Penalty Shows What Happens When an EDD Trigger Is MissedA CA$25,000 enhanced due diligence trigger in the operator’s own policy was not applied.
- QuinnBet Case: Assuming Recycled Winnings Is Not a Source of Funds CheckThe Commission found over-reliance on source of wealth and assumptions about recycled winnings.
Frequently asked questions
What is KYC in gambling?
Verifying a player’s identity, age and address, and understanding their risk.
When must identity be verified?
Before play in most regulated markets.
What is source of funds?
Evidence of where deposited money came from.
What is EDD?
Enhanced due diligence for higher-risk customers.
Who decides on suspicious activity reports?
The MLRO or nominated officer.
What is tipping off?
Telling a customer that a report has been or may be made; a criminal offence in the UK.
Further reading elsewhere
- Cutting KYC drop-off without weakening compliance (igaming.cx)
- KYC support guide (igamingsupportai.com)
- How to automate KYC for online casinos (www.cevro.ai)
- Cevro Academy courses (cevro.academy)