KYC and AML

KYC Requirements for MGA-Licensed Operators

What Malta Gaming Authority licensees must check for age and identity, when the FIAU’s €2,000 customer due diligence threshold applies, and what FIAU enforcement has focused on.

3 min readPart of kyc and aml

On this page
  1. When must MGA licensees verify players?
  2. What does the FIAU expect?
  3. What does an MGA verification timeline look like?
  4. What does the Kanon Gaming penalty show?
  5. How does Malta compare?
  6. Worked example: hitting €2,000
  7. What mistakes do operators commonly make?
  8. Checklist
  9. Frequently asked questions
  10. Sources
  11. More guides

MGA licensees must have policies that stop minors from using their services and require players to affirm they are of legal age. For AML, the FIAU’s Implementing Procedures for the remote gaming sector require customer due diligence once a player’s deposits reach €2,000, in one transaction or several, with enhanced measures for higher-risk players. Licensees can also verify identity before remitting withdrawals.

Key takeaways

  • Policies to prevent minors from using services; players affirm legal age (PPD Article 26) [1].
  • CDD at €2,000 in deposits under the FIAU’s Implementing Procedures [2].
  • Identity can be verified before remitting funds (PPD Article 29(3)(a)) [1].
  • Licensees file an annual Risk Evaluation Questionnaire with the FIAU; the 2026 deadline was 9 April [3].
  • FIAU penalties have cited missing source of funds information [4].
€2,000CDD threshold
18minimum age
9 Apr 2026REQ deadline

When must MGA licensees verify players?

MGA and FIAU verification rules
Check Rule Source
Age Policies to stop minors; players affirm legal age; minors found later are blocked and winnings confiscated [1]
CDD Once deposits reach €2,000 [2]
Before payouts Reasonable time to verify identity before remitting funds [1]
Enhanced measures For higher-risk players [2]

What does the FIAU expect?

Beyond the €2,000 threshold, licensees must maintain a business risk assessment, customer risk profiling (including PEPs), geographic risk controls, transaction monitoring and governance with MLRO oversight, which are covered by the annual Risk Evaluation Questionnaire submitted through the CASPAR portal [3]. A 2024 penalty against Kanon Gaming found source of funds or wealth information missing in 90% of files reviewed [4].

What does an MGA verification timeline look like?

  1. RegistrationCollect identity data and check age.
  2. Before €2,000 depositsComplete customer due diligence under FIAU rules [2].
  3. Risk assessmentAssign a risk rating and apply EDD where needed.
  4. Ongoing monitoringMonitor transactions and refresh documents.

What does the Kanon Gaming penalty show?

The FIAU’s penalty on Kanon Gaming [4] shows the FIAU reviews whether operators applied due diligence and monitoring in practice. Operators should keep evidence of risk assessments and decisions.

How does Malta compare?

Malta compared
Topic Malta Germany Great Britain Source
CDD timing By €2,000 in deposits No threshold Identity before play [2] [5]
Withdrawal timing Five working days where practicable Prompt, own-name accounts Prompt, explain delays [1]

Worked example: hitting €2,000

  1. Player deposits €800; age affirmed and screened.
  2. Deposits reach €2,000; CDD request sent automatically.
  3. Documents verified; risk profile set.
  4. Withdrawal paid within five working days.

What mistakes do operators commonly make?

Waiting until withdrawal

CDD is due at €2,000 in deposits [2].

Thin files

Missing SoF was central in the Kanon case [4].

Missing the REQ

Breaches FIAU reporting duties [3].

Checklist

  • Age controls and affirmation.
  • CDD at €2,000.
  • Enhanced measures for higher risk.
  • Business risk assessment current.
  • REQ filed on time.
  • CDD before €2,000.
  • Evidence of risk assessments.

Frequently asked questions

When must an MGA casino verify me?

Customer due diligence is required once deposits reach €2,000, and identity can be checked before payouts.

What is the FIAU?

Malta’s AML supervisor and financial intelligence unit.

What is the REQ?

The annual Risk Evaluation Questionnaire licensees submit to the FIAU.

What happens if a minor is found?

The licensee must stop use, return wagered money and confiscate winnings.

Do MGA licensees screen for PEPs?

Yes, as part of customer risk profiling.

Who regulates MGA licensees?

The Malta Gaming Authority, with the FIAU for AML.

What is the minimum age?

18.

Can verification delay my withdrawal?

Yes; identity checks are a permitted reason for delay.

What is the FIAU?

Malta’s AML supervisor and financial intelligence unit.

When must MGA licensees verify players?

By the €2,000 deposit threshold, and earlier where risk requires.

Sources

  1. MGA: Player Protection Directive
  2. FIAU: Implementing Procedures
  3. AML Watcher: FIAU REQ 2026 for iGaming
  4. NEXT.io: FIAU penalty on Kanon Gaming
  5. Geldwäschegesetz section 16

KYC rules by market

When identity and age must be verified in eight regulated markets, and which registers apply.

Casino withdrawals from MGA licensees

The Player Protection Directive: five working days, source account payouts and limits.

Malta

Payments, KYC, responsible gambling and marketing rules in Malta.

Source of funds and source of wealth

When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.

Enhanced due diligence triggers

How to set and wire EDD triggers so reviews happen before large losses or wins.

Further reading elsewhere