KYC and AML

Enhanced Due Diligence Triggers in Online Gambling

How online gambling operators define enhanced due diligence triggers, connect them to cases and player requests, and avoid the failures behind recent enforcement.

6 min readPart of kyc and aml

On this page
  1. What is an EDD trigger?
  2. Which triggers should operators use?
  3. How should triggers be wired into operations?
  4. How do you test that triggers work?
  5. How should trigger levels be set?
  6. What should a player-facing EDD request contain?
  7. What do regulators require around EDD?
  8. Worked example: the NorthStar timeline, and what should have happened
  9. What mistakes do operators commonly make?
  10. Checklist
  11. Frequently asked questions
  12. Sources
  13. More guides

Enhanced due diligence (EDD) triggers are the rules that move a player from standard checks to deeper review: source of funds and wealth, senior approval and closer monitoring. Good triggers combine cumulative and velocity deposit levels, profile mismatch, customer risk factors such as PEP status, and payment risk. The common failure is not the trigger but the wiring: a trigger that only creates a report, with no owner, deadline or player request, is how operators end up in enforcement cases.

Key takeaways

  • Every trigger needs an owner, a deadline and a default action if the review is overdue.
  • NorthStar’s CA$25,000 lifetime trigger existed in policy but was not applied [1].
  • Profile mismatch (spend against stated income or occupation) is one of the strongest triggers.
  • PEP status requires EDD by law in the UK and for foreign PEPs in Canada [2] [3].
  • Test triggers regularly: the Commission asks whether IT changes are checked before and after implementation [4].
CA$25,000NorthStar lifetime deposit trigger in policy
$100,000FINTRAC PEP determination for casino cash or VC receipts
30 daysFINTRAC deadline to complete PEP measures

What is an EDD trigger?

An EDD trigger is a rule that flags a player for deeper due diligence. Triggers come from the operator’s business-wide risk assessment, which every AML regime requires. Regulators expect operators to set them, apply them consistently and show that they work.

Which triggers should operators use?

EDD trigger types
Trigger Example rule Notes
Cumulative deposits Lifetime or rolling 12-month deposits over a set amount Set by risk tier; lower for higher-risk segments
Velocity Deposits over a set amount in 24 hours or 7 days Catches sudden spikes
Net loss Losses over a set amount in a period Overlaps with affordability
Profile mismatch Spend above a multiple of declared income Requires income or occupation data
Occupation risk High-risk occupations per policy Central in the NorthStar case [1]
PEP or sanctions hit Screening match confirmed Legal requirement; see PEP screening
Geography High-risk jurisdictions FATF lists inform this
Payment risk Third-party cards, many methods, crypto conversions See red flags
Behaviour Deposit and withdraw with little play Possible laundering

How should triggers be wired into operations?

Wiring an EDD trigger1Trigger firesRule evaluates in near real time on eachdeposit or session.2Case createdOwner, deadline and risk reason recordedautomatically.3Player request sentIn-app message asking for specific evidence,with a clear explanation.4Default action if overdueDeposits restricted until the review iscomplete.5Decision recordedOutcome, evidence and reasons kept for audit.
From trigger to recorded decision.

How do you test that triggers work?

  1. Sample monthlyPick accounts that crossed each trigger and check a case was created and closed on time.
  2. Test after every platform changeThe Commission found a migration that broke deposit limits for 194 customers [4].
  3. Back-test new thresholdsRun proposed triggers against historical data before going live.
  4. Review false positivesTune triggers that create noise so analysts focus on real risk.

How should trigger levels be set?

  1. Start from the risk assessmentCustomer, product, channel, payment and geography risk.
  2. Segment by riskLower triggers for higher-risk segments, such as high-risk occupations or geographies.
  3. Back-testRun proposed levels against past data to estimate volumes and catch rates.
  4. Resource for the volumeTriggers that create more cases than analysts can handle become reports, not controls.
  5. Review after enforcementPublic cases often show where triggers should sit.

What should a player-facing EDD request contain?

EDD request contents
Element Example
Why “To meet our legal obligations we need to understand where your deposits come from.”
What List of acceptable documents
When Deadline and review time
What happens next Account restrictions if not provided, in plain terms
Help Contact route for questions

What do regulators require around EDD?

EDD requirements by market
Market EDD requirement Source
Great Britain EDD for higher risk and PEPs under MLR 2017; senior management approval, SoF and SoW, closer monitoring for PEPs [2] [5]
Ontario Foreign PEPs: SoF, SoW, senior approval and enhanced monitoring within 30 days; domestic PEPs when high risk [3]
Malta CDD at €2,000; enhanced measures for higher risk [6]
Germany Enhanced approval with evidence of funds above the €1,000 monthly cap [7]
Brazil Risk-based due diligence under Ordinance 1,143/2024 [8]

Worked example: the NorthStar timeline, and what should have happened

NorthStar case compared with a wired trigger
Date What happened [1] What a wired trigger would have done
March 2024 Account opened; lifetime deposits pass CA$25,000 the same month Case opened; high-risk occupation flagged; SoF requested
December 2024 Player deposits CA$55,000 Deposits restricted until SoF provided
June 2025 Deposits reach about CA$189,395; account classified high risk after AGCO inquiries Review completed fifteen months earlier

What mistakes do operators commonly make?

Triggers without owners

Nobody acts on them.

No default action

Overdue reviews should restrict deposits.

Ignoring occupation and income

Spend alone misses profile mismatch.

Not retesting after changes

Migrations silently break controls [4].

Checklist

  • Triggers derived from the business-wide risk assessment.
  • Each trigger creates a case automatically.
  • Player-facing request templates per trigger.
  • Default restriction for overdue cases.
  • Monthly sampling and post-change testing.
  • Decisions documented with reasons.
  • Triggers back-tested.
  • Analyst capacity matched to volume.
  • Player-facing request template per trigger.

Frequently asked questions

What is enhanced due diligence in gambling?

Deeper checks on higher-risk customers, usually including source of funds and wealth, senior approval and closer monitoring.

What triggers EDD?

Cumulative or rapid deposits, profile mismatch, PEP status, high-risk geography, payment risk and suspicious behaviour.

Is there a legal EDD threshold?

Some markets set thresholds (Malta’s €2,000 CDD, FINTRAC’s $100,000 PEP determination); most rely on risk-based triggers.

What happened in the NorthStar case?

A CA$25,000 lifetime deposit trigger in policy was not applied; the AGCO imposed a CA$100,000 penalty.

Should deposits be restricted during EDD?

Many operators restrict deposits when a review is overdue.

Who approves PEP relationships?

Senior management, under UK and Canadian rules.

How often should triggers be reviewed?

Regularly, and after every platform or rule change.

Is EDD the same as an affordability check?

No. EDD is about legitimacy of funds; affordability is about harm.

How often should EDD triggers be reviewed?

At least annually and after major enforcement cases or product changes.

Should triggers differ by segment?

Yes, risk-based triggers should be lower for higher-risk segments.

Sources

  1. Gaming Intelligence: AGCO penalty on NorthStar Gaming
  2. Gambling Commission: notice on politically exposed persons
  3. FINTRAC: PEP and HIO guidance
  4. Gambling Commission: QuinnBet public statement
  5. Money Laundering Regulations 2017, regulation 35
  6. FIAU: Implementing Procedures
  7. SBC News: LUGAS and the GGL
  8. Mattos Filho: Brazil AML ordinance

Source of funds and source of wealth

When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.

PEP and sanctions screening

Screening players against PEP and sanctions lists: when, which lists, and how to handle matches.

Transaction monitoring basics

Rules, scenarios, alerts and case handling for gambling transaction monitoring.

AML red flags for operators

The payment, gameplay and customer warning signs that should trigger review.

Affordability checks

UK financial vulnerability checks, Dutch thresholds, German limits and Sweden’s duty of care.

Further reading elsewhere