KYC and AML

PEP and Sanctions Screening for Gambling Operators

How online gambling operators screen players for politically exposed persons and financial sanctions, which lists apply, how to handle matches, and what UK and Canadian rules require.

6 min readPart of kyc and aml

On this page
  1. What is the difference between PEP and sanctions screening?
  2. What do UK rules require?
  3. What do Canadian rules require?
  4. How should operators handle a screening match?
  5. How should screening be tuned?
  6. How should PEP relationships be monitored?
  7. How do PEP and sanctions rules compare by market?
  8. Worked example: a PEP at registration
  9. What mistakes do operators commonly make?
  10. Checklist
  11. Frequently asked questions
  12. Sources
  13. More guides

Gambling operators must screen players against sanctions lists, so they never pay a designated person, and identify politically exposed persons (PEPs), who need enhanced due diligence. In the UK, PEPs need senior management approval, source of funds and wealth checks and closer monitoring under regulation 35, with domestic PEPs treated as lower risk by default since 2024. Sanctions matches mean suspending the transaction and informing OFSI. In Canada, casinos make PEP determinations at account opening and for receipts of $100,000 or more.

Key takeaways

  • Sanctions screening is about not making funds available to designated persons; PEP screening is about extra due diligence.
  • In the UK, a confirmed sanctions match means suspending the transaction and informing OFSI immediately [1].
  • UK domestic PEPs are a lower risk starting point than foreign PEPs, but still need EDD, senior approval, SoF and SoW [2].
  • FINTRAC requires casinos to make PEP determinations at account opening and for cash or virtual currency receipts of $100,000 or more, with measures completed within 30 days [3].
  • Screen at onboarding and continuously as lists change.
Reg. 35UK PEP rules (MLR 2017)
May 2024Commission notice on domestic PEPs
$100,000FINTRAC casino PEP determination
5 yearsFINTRAC PEP record retention

What is the difference between PEP and sanctions screening?

Sanctions versus PEP screening
Sanctions screening PEP screening
Purpose Do not make funds available to designated persons Identify customers needing enhanced due diligence
Outcome of a match Suspend, report to the authority, do not pay EDD, senior approval, SoF and SoW, monitoring
UK list OFSI consolidated list of designated persons Commercial PEP databases and own research
Can the relationship continue? Not without a licence where an asset freeze applies Yes, with approval and EDD

What do UK rules require?

For PEPs, regulation 35 of the Money Laundering Regulations 2017 requires senior management approval, measures to establish source of funds and wealth, and closer ongoing monitoring. The Commission’s May 2024 notice explains that domestic PEPs are now a lower relative risk starting point than non-domestic PEPs, so the extent of EDD can be less where no other risk factors exist [2] [4].

What do Canadian rules require?

FINTRAC PEP rules for casinos
Situation Casino duty Source
Account opening Reasonable measures to determine PEP, HIO, family member or close associate status [3]
Receipt of cash or virtual currency of $100,000 or more PEP determination [3]
Foreign PEP SoF, SoW, senior management approval and enhanced monitoring [3]
Domestic PEP or HIO Same measures if risk is assessed as high [3]
Timing Complete measures within 30 days [3]
Records Keep at least five years [3]

How should operators handle a screening match?

  1. Check the matchCompare date of birth, nationality and other identifiers to rule out false positives.
  2. Sanctions: freeze and reportSuspend the transaction, report to the authority, do not tip off, take legal advice.
  3. PEP: start EDDSoF and SoW, senior approval, set monitoring level.
  4. Record everythingWho reviewed, what was found, decision and approver.
  5. RescreenWhen lists change and on a schedule.

How should screening be tuned?

Screening configuration
Setting Consideration
Fuzzy matching Catches spelling variants but raises false positives
Secondary identifiers Date of birth and nationality cut false positives
List coverage Sanctions lists for every relevant regime; PEP data with family and associates
Rescreening frequency On every list update for sanctions; periodic for PEP

How should PEP relationships be monitored?

  1. Set monitoring levelHigher alert sensitivity for PEP accounts.
  2. Review periodicallyRefresh source of funds and wealth at set intervals.
  3. Re-approveSenior management re-approval when risk changes.
  4. RecordKeep decisions and approvals with dates.

How do PEP and sanctions rules compare by market?

PEP and sanctions by market
Market PEP rule Sanctions authority Source
Great Britain Regulation 35; domestic PEPs lower risk starting point OFSI [1] [2]
Ontario FINTRAC determinations at account opening and $100,000 receipts Canadian sanctions regimes [3]
EU (Malta) EDD for PEPs under EU AML rules as applied by FIAU EU and national lists [5]
US Risk-based under BSA programmes OFAC [6]

Worked example: a PEP at registration

  1. New UK player passes identity checks; screening returns a possible match to a local councillor.
  2. Analyst confirms the match on date of birth and address; player is a domestic PEP.
  3. EDD opened: source of funds and wealth requested; senior manager approval sought.
  4. Evidence received; approval recorded; monitoring set to enhanced.

What mistakes do operators commonly make?

Screening only at sign-up

Lists change daily.

Treating every PEP as prohibited

PEPs can be customers with EDD and approval.

Ignoring family and associates

They are within scope.

Paying out after a sanctions hit

Unlawful without a licence where an asset freeze applies [1].

Checklist

  • Sanctions screening at onboarding and on list updates.
  • PEP screening covers family and close associates.
  • Match review procedure with false-positive checks.
  • Senior approval workflow for PEPs.
  • OFSI or local reporting route documented.
  • Records retained for the required period.
  • Fuzzy matching tuned with secondary identifiers.
  • PEP monitoring schedule.

Frequently asked questions

What is a PEP in gambling?

A politically exposed person: someone in a prominent public role, or their family member or close associate.

Can a PEP open a casino account?

Yes, with enhanced due diligence and senior management approval.

What happens if a player matches a sanctions list?

The operator suspends the transaction, reports to the sanctions authority and does not pay out without a licence.

Which sanctions list do UK operators use?

The OFSI consolidated list of designated persons, per Commission guidance.

Are domestic PEPs lower risk in the UK?

Yes, as a starting point since 2024, though EDD still applies.

When do Canadian casinos check PEP status?

At account opening, periodically, and for cash or virtual currency receipts of $100,000 or more.

How often should screening run?

At onboarding and whenever lists update, plus periodic rescreening.

Can staff tell a player about a sanctions match?

No. Avoid tipping off and take advice.

What is a false positive in screening?

A potential match that turns out to be a different person.

Do domestic PEPs need EDD in the UK?

Yes, though as a lower risk starting point than foreign PEPs since 2024.

Sources

  1. Gambling Commission: AML guidance part 6.18, persons subject to financial restrictions
  2. Gambling Commission: notice on politically exposed persons (May 2024)
  3. FINTRAC: PEP and HIO guidance for account-based sectors
  4. Money Laundering Regulations 2017, regulation 35
  5. FIAU: Implementing Procedures
  6. FinCEN

Enhanced due diligence triggers

How to set and wire EDD triggers so reviews happen before large losses or wins.

Source of funds and source of wealth

When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.

KYC rules by market

When identity and age must be verified in eight regulated markets, and which registers apply.

Transaction monitoring basics

Rules, scenarios, alerts and case handling for gambling transaction monitoring.

AML red flags for operators

The payment, gameplay and customer warning signs that should trigger review.

Further reading elsewhere