How is money laundered through casinos and online gambling?
Source of funds is the question a Gambling Commission compliance assessment found QuinnBet's customer files could not always answer. One customer's payslips showed about £2,000 a month, yet the customer deposited and lost £9,000 in four days. Others deposited significant funds without an established source of funds, and controls did not ensure timely suspicious activity reports. On 20 August 2026 the operator agreed to pay £609,104.
In anti money laundering (AML) terms, gambling attracts launderers because criminal money can go in as a stake and come out as a payout that looks like a win. The FATF's release of 9 September 2026, drawn from more than 80 jurisdictions, warns of criminals using gambling platforms "to move money without actually gambling", making many small transactions to avoid detection (smurfing) and placing unusually large or coordinated bets on events flagged for possible competition manipulation. It names illegal gambling "one of the sector's most significant risks".
The UK's national risk assessment of 17 July 2025 raised money laundering risk in casinos from low to medium (para 5.154). Casino SARs rose 26 percent, from about 6,000 in 2022/23 to about 7,500 in 2023/24 (para 5.160).
Which red flags point to money laundering in gambling?
Twelve signs recur in the FATF's 2026 indicators, the UK risk assessment and the Gambling Commission's cases. One sign alone proves nothing. Two or three on one player file call for source of funds questions and, once suspicion forms, a report. Betting signs overlap with match fixing, so a sportsbook's integrity team and its MLRO should see the same alerts.
| Red flag | Source (dated by row) |
|---|---|
| Deposits withdrawn after little or no play | FATF, 9 September 2026 |
| Many small deposits or chip purchases kept under a line (smurfing); chip walking and structuring | FATF, 9 September 2026; FinCEN, Lake Elsinore order, 22 October 2024 |
| Unusually large or coordinated bets on events flagged for possible manipulation | FATF, 9 September 2026 |
| Several accounts or payment methods under different identities; payment details that do not match the player | FATF, 9 September 2026; Greentube Alderney, 9 January 2025 |
| Prepaid vouchers in, withdrawals out to several bank accounts | Videoslots, 20 November 2025 (vouchers over £75,000 in 16 days, proceeds sent to four bank accounts) |
| Spend out of line with known income | QuinnBet, 20 August 2026; NetBet, 5 November 2025 |
| Funds from newly opened bank accounts, or money not evidenced as coming from employment, business income or savings | L & L Europe, 21 October 2026 |
| An occupation with access to other people's money, such as a finance manager | Greentube Alderney, 9 January 2025 |
| A VPN used to appear based in the UK | UK NRA 2025, para 5.159 |
| Personal assistants or third party employees acting for customers of high end land based casinos; international PEPs, some from higher risk jurisdictions | UK NRA 2025, paras 5.157 and 5.164 |
| A player whose account was closed for money laundering concerns opening a new one | Platinum Gaming, 22 October 2025 |
| B2B or white label partners supplying unlicensed sites, or left without due diligence | Evolution Malta Holding, 23 July 2026; TGP Europe, 16 May 2025; UK NRA 2025, para 5.158 |
Which gambling businesses does each AML rulebook cover?
Casinos are the one gambling business every rulebook covers. The rest depends on the jurisdiction.
| Rulebook | Law and article (in force, November 2026) | Supervisor | Gambling caught |
|---|---|---|---|
| FATF | FATF Recommendations, updated June 2026: R.22, R.28 | National supervisors | Casinos, internet and ship based casinos included (Glossary), licensed and supervised (R.28(a)) |
| EU | Directive (EU) 2015/849 arts. 2(1)(3)(f), 2(2) until 9 July 2027; Regulation (EU) 2024/1624 (AMLR) arts. 3(3)(g), 4 from 10 July 2027 | National supervisors | Every provider of gambling services. Today a member state may exempt services of proven low risk after a risk assessment, never casinos (Directive art. 2(2)); from 10 July 2027 also never providers whose principal activity is online gambling or sports betting, unless the online service is operated by the state or its organization, operation and administration are regulated by the state (AMLR art. 4(1)) |
| UK | Money Laundering Regulations 2017 (MLR) regs. 8(2)(h), 14(1)(b); Proceeds of Crime Act 2002 (POCA); Gambling Act 2005 | Gambling Commission (MLR reg. 7(1)(d)) | MLR: casinos only, meaning holders of a casino operating license. Every operating license except gaming machine technical and gambling software: POCA and LCCP condition 12.1.1 |
| US | Bank Secrecy Act; 31 CFR part 1021 | FinCEN | Casinos and card clubs licensed under state, territory or tribal law with gross annual gaming revenue over $1 million, financial institutions under 31 CFR 1010.100(t)(5), (6) |
| Türkiye | Law No. 5549 art. 2(1)(d); Regulation on Measures art. 4(1)(p) | MASAK | Operators in games of chance and betting, including Milli Piyango İdaresi, Türkiye Jokey Kulübü and Spor Toto Teşkilat Başkanlığı |
| UAE | Federal Decree by Law No. 10 of 2025 and its executive regulations, Cabinet Resolution No. 134 of 2025 (CR 134), art. 3(1) | GCGRA, the federal entity overseeing commercial gaming | Commercial gaming operators, gaming on vessels included, for one transaction or linked transactions of AED 11,000 or more; transactions solely in gaming chips or instruments do not count |
The FATF lists casinos among the designated non financial businesses and professions (DNFBPs) in Recommendation 22. The EU goes wider and makes every provider of gambling services an obliged entity, with exemptions only for proven low risk.
The UK splits the sector. Only casinos fall under the Money Laundering Regulations. A bookmaker or bingo operator answers to POCA and to LCCP 12.1.1, a license condition. Its 2023 risk assessment rates remote casino, betting and bingo, land based casinos and off course betting as high risk, and land based bingo as medium.
Where is gambling illegal, and what does that change for AML?
In Türkiye, betting outside the Law's authority is a crime. Law No. 7258 art. 5(1), as amended on 12 July 2013, punishes running sports based fixed odds or pool betting or games of chance, or providing the place or means for them, with 3 to 5 years in prison and a judicial fine of up to 10,000 days (a). Letting people in Türkiye play on such betting run abroad, online or otherwise, carries 4 to 6 years (b). Intermediating money transfers linked to it carries 3 to 5 years and up to 5,000 days (c), and players face an administrative fine of 5,000 to 20,000 lira (d).
Turkish Penal Code art. 228(3) sets 3 to 5 years and 1,000 to 10,000 days where the place and means for gambling are provided through information systems. In AML terms, illegal gambling is a predicate offense, so any funds tied to it could be criminal funds (UK NRA 2025, para 5.155).
In the UAE, "only lottery and commercial gaming operators approved by the GCGRA are permitted to operate" (GCGRA, 9 December 2024). On that date The Game LLC held the sole lottery license.
What does casino AML compliance require, duty by duty?
The same duties run through every rulebook. The lines and the clocks differ.
| Duty, in force November 2026 | FATF | EU (AMLR from 10 July 2027) | UK | US, 31 CFR | Türkiye | UAE |
|---|---|---|---|---|---|---|
| When due diligence starts | R.22(a) and its Interpretive Note: financial transactions of USD/EUR 3,000 or more, single or linked | Directive art. 11(d): €2,000 or more on collecting winnings, wagering a stake or both, single or linked; the same line in AMLR art. 19(5), with identification at entry to physical premises allowed where transactions are attributed to the player (art. 19(8)) | MLR reg. 27(5) to (7): casinos, £2,000 or more on stakes (tokens, gaming machines, remote deposits) or winnings collected, single or linked; uncollected winnings staked again do not count | 1021.410(a): name, permanent address and SSN at each deposit, account or credit line; identity for each CTR (1021.312) | Regulation on Measures art. 5(1): relationship at any amount; transactions of 370,000 TL or more, single or linked; wires of 30,000 TL or more; any amount on suspicion | CR 134 art. 3(1): AED 11,000 or more, single or linked, chips only transactions excluded; due diligence at the start of a relationship, on suspicion or on doubt (art. 7(1)) |
| Ongoing monitoring and source of funds | R.10 | Directive art. 13(1)(d): scrutiny "including where necessary the source of funds"; AMLR art. 26 | MLR reg. 28(11)(a): scrutiny "including, where necessary, the source of funds"; LCCP 12.1.1 | 1021.210(b)(2)(v)(B): procedures to find transactions reportable under 1021.320 | Regulation art. 19: activity against the customer's profile and sources of funds | CR 134 art. 8(1): scrutiny "including, where necessary, the source of funds" |
| Suspicious activity report | R.20, applied to DNFBPs by R.23 | Directive art. 33: promptly, attempted transactions included; AMLR art. 69 | POCA s. 330 (casinos, the regulated sector) and s. 332 (other nominated officers): as soon as is practicable | 1021.320: conducted or attempted, $5,000 or more; filed no later than 30 calendar days after initial detection, with 30 more allowed to identify a suspect (60 at most); ongoing schemes also reported to law enforcement by telephone at once | Regulation art. 28(2): 10 business days from the date suspicion arose | CR 134 art. 18(1)(a): "immediately and without delay", whatever the value |
| Cash reports | None set | None in the Directive | None in the MLR | CTR: each transaction in currency, cash in or cash out, over $10,000 in a gaming day, aggregated (1021.311, 1021.313); filed within 15 days (1010.306(a)(1)) | Regulation art. 32: transactions over an amount the Ministry sets, reported on a continuous basis | No cash report in CR 134 |
| Records | R.11: at least 5 years | Directive art. 40: 5 years after the relationship or the occasional transaction, national law may allow up to 5 more; AMLR art. 77 | MLR reg. 40(3), (4): 5 years, and never required beyond 10 years for transactions inside a relationship | 1010.430(d) and 1021.320(d) (SAR files): 5 years; 1021.410(b)(9): a list of instruments of $3,000 or more | 8 years (Regulation art. 46; Law 5549 art. 8) | Not less than 5 years (CR 134 art. 25(1)) |
| Program | R.18 | Directive arts. 8, 46(4); AMLR arts. 9 to 11 | MLR regs. 18, 19, 21; LCCP 12.1.1 | 1021.210(b): internal controls, independent testing, training, a compliance person, procedures, automated programs where systems allow | Law 5549 art. 5(1): training, internal control and risk management as the Ministry sets by size and business volume | CR 134 arts. 21 (policies approved by senior management), 22 (compliance officer at management level) |
Three differences decide most designs. The EU and UK lines count linked transactions, so an operator has to attribute play to a player before it knows who the player is (AMLR recital 64). The US sets no single due diligence line for casinos: identity is taken when a deposit, account or credit line is opened and for every CTR. The UAE line starts at AED 11,000 and leaves chips only transactions out.
When must a casino or iGaming operator identify a player?
Picture a remote casino player (illustrative) who deposits £800, £700 and £600 in one evening. No single deposit reaches £2,000, but the three appear linked, so under MLR reg. 27(5) due diligence applies once the total hits £2,100. Winnings left in the account and staked again do not count toward the line (reg. 27(7)). The EU line works the same way at €2,000. Casino KYC requirements at that point: identify the player and verify that identity (MLR reg. 28), collecting the details the online gambling player verification form lists.
Which reporting clock applies to a gambling operator?
A US casino has 30 calendar days from initial detection to file a suspicious activity report, or 60 when it still needs to identify a suspect, and telephones law enforcement at once about an ongoing scheme. A currency transaction report is due within 15 days.
The UAE asks for a report immediately and without delay, Türkiye within 10 business days. In the UK staff and nominated officers disclose as soon as is practicable (POCA ss. 330 to 332). Where the operator asks for consent to go ahead, consent counts as given if no refusal arrives within 7 working days, and after a refusal the moratorium runs 31 days unless a court extends it (ss. 335, 336A).
Which AML failures cost gambling operators fines and licenses since 2023?
Done Brothers (Cash Betting), trading as Betfred, shows the pattern. Its penalty, on 3 December 2025, was £825,000. It asked about customers' source of income only after £15,000 of losses or £125,000 of stakes in 365 days, thresholds the Gambling Commission found not appropriately risk based. It also had no effective policy to identify and handle customers who may be subject to financial sanctions. In 2023 it had paid a £3.25 million settlement.
Most of the 24 actions below, from November 2023 to October 2026, come back to the same failures: fixed financial triggers instead of risk based ones, enhanced due diligence started late or not at all, source of funds taken on the player's word, and risk assessments that miss products, payment methods or B2B partners.
| Date | Regulator | Operator | Outcome | Main AML finding |
|---|---|---|---|---|
| 30 November 2023 | Ksa | Betent (Betcity) | €3,000,000 fine | Due diligence often started late and sources of income asked for laxly, December 2022 to May 2023, after a September 2022 instruction; unusual transactions often not reported |
| 10 January 2024 | Gambling Commission | Gamesys Operations | £6,000,000 | Some customers evaded AML triggers; reliance on verbal assurances or internet research; reinvestment of winnings policy |
| 4 April 2024 | Gambling Commission | Bet365 (two Hillside entities) | £582,120 | No financial sanctions checks on new customers before their first deposit; ineffective enhanced due diligence triggers |
| 6 September 2024 | US Attorney, S.D. Cal., and DOJ | Wynn Las Vegas | Agreed to forfeit $130 million under a non prosecution agreement | Transactions for foreign patrons facilitated by former employees, agents and third parties that were unlicensed money transmitting businesses (18 U.S.C. 1960); source: Wynn Resorts 8-K |
| 22 October 2024 | FinCEN | Sahara Dunes Casino (Lake Elsinore Hotel and Casino, a card club) | $900,000, $50,000 of it suspended pending an undertaking | Willful program failure; no SARs from September 2014 until after a 2017 state examination; structuring and chip walking unreported; CTRs missed |
| 9 January 2025 | Gambling Commission | Greentube Alderney (Admiral Casino) | £1,000,000 | Late scrutiny; "risky occupations" policy not followed; linked accounts not escalated |
| 4 March 2025 | Gambling Commission | AG Communications (AspireGlobal) | £1,407,834 | Enhanced due diligence only after a financial trigger, even at medium to high risk scores; reviews up to eight days late |
| 20 March 2025 | Gambling Commission | Corbett Bookmakers (36 premises) | £686,070 | High financial thresholds left stakes unverified; risk assessment gaps |
| 15 May 2025 | Gambling Commission | Spreadex | £2,022,000 | Reliance on self reported finances; deposits continued without source of funds information |
| 16 May 2025 | Gambling Commission | TGP Europe (white label) | License surrendered after it was told to pay a £3.3 million penalty | Due diligence on the owners of business partners and on the source of funds of business arrangements |
| 21 August 2025 | Gambling Commission | ProgressPlay (134 sites) | £1,000,000 | No appropriate money laundering risk assessment; source of funds not verified where needed |
| 22 October 2025 | Gambling Commission | Platinum Gaming (unibet.co.uk) | £10,000,000 | Customers blocked for money laundering concerns opened new accounts; unclear due diligence levels |
| 31 October 2025 | Gambling Commission | VGC Leeds (casino) | License suspended during a s. 116 review (lifted 25 November 2025; license surrendered 14 July 2026) | AML controls, decision making and governance |
| 5 November 2025 | Gambling Commission | NetBet Enterprises | £650,000 | Over reliance on financial triggers; spend disproportionate to net income; third party relationships missing from the risk assessment |
| 17 November 2025 | Ksa | Tulipa (ComeOn, GetLucky) | Instruction | Risk classes, transaction and source of funds checks, FIU report records, training |
| 20 November 2025 | Gambling Commission | Videoslots | £650,000 | Prepaid vouchers over £75,000 in 16 days; proceeds to four bank accounts; over reliance on an algorithm |
| 3 December 2025 | Gambling Commission | Done Brothers (Betfred shops) | £825,000 | Source of income thresholds not risk based; no effective sanctions policy |
| 22 December 2025 | Ksa | SCGO (Vbet) | Warning | Business wide risk assessment; transaction checks |
| 24 December 2025 | Ksa | TOTO Online | Instruction | Ongoing monitoring after onboarding; source of funds checks |
| 9 April 2026 | Ksa | Optdeck (Unibet) | Instruction | Due diligence; monitoring not matching policy; financial thresholds |
| 23 July 2026 | Gambling Commission | Evolution Malta Holding | £4,750,000 | Risk assessment missed that two operators supplied its games to six unlicensed sites |
| 20 August 2026 | Gambling Commission | QuinnBet (Gibraltar) | £609,104 | Disproportionate spend; source of funds not established; controls did not ensure timely SARs |
| 7 October 2026 | Gambling Commission | Grosvenor Casinos, Grosvenor Casinos (GC) and Gaming Group (Rank; 51 casinos) | £5,000,000 | Policies not updated for the 2020 MLR changes; high risk sources of funds used without scrutiny; enhanced due diligence not done |
| 21 October 2026 | Gambling Commission | L & L Europe (seven sites) | £900,000 | Controls based on thresholds and sampling; new bank accounts and unevidenced funds |
| Jurisdiction | Basis (in force, November 2026) | Ceiling |
|---|---|---|
| EU | Directive art. 59(1), (2)(e); Directive (EU) 2024/1640 art. 55(1), (2) from 10 July 2027 | For serious, repeated or systematic breaches: a maximum of at least twice the benefit, where it can be determined, or at least €1,000,000 (from 10 July 2027, whichever is higher); the €5,000,000 or 10 percent line of art. 59(3) is for credit and financial institutions only |
| UK | Gambling Act 2005 ss. 116, 117, 121; MLR regs. 76(8), 86 | For a breached license condition: a penalty with no stated maximum, noticed within 2 years of the breach, or of the Commission learning of it if later (s. 121), and after a review a warning, new conditions, suspension or revocation (s. 117). A casino that breaches the MLR commits an offense under reg. 86: on indictment, prison of up to 2 years, a fine, or both. MLR civil penalties under reg. 76 belong to the FCA and HMRC only |
| US | 31 U.S.C. 5321(a)(1), 5322; 31 CFR 1010.821; 90 FR 5629 | Criminal, willful (s. 5322): a fine of up to $250,000, prison of up to 5 years, or both; up to $500,000 and 10 years where the breach comes with another federal violation, or forms part of a pattern of illegal activity worth more than $100,000 in a 12 month period. Civil, willful (s. 5321(a)(1)): per violation, $71,545 or the amount involved up to $286,184, whichever is greater, after the 17 January 2025 inflation adjustment; a program failure counts once for each day it continues |
| Türkiye | Law 5549 arts. 13(1), (5), 28; Law No. 7258 art. 5 | 30,000 TL per identification or continuous reporting breach and 50,000 TL per STR breach, capped at 4 million TL per obligation a year for firms outside the financial sector (2020 amounts, revalued each January, the cap doubled the next year after a capped fine); prison terms for illegal betting |
| UAE | Federal Decree by Law No. 10 of 2025 art. 17(1) | Without prejudice to a more severe sanction under other legislation: a warning, AED 10,000 to AED 5,000,000 per violation, bans, suspension or license revocation |
Source of funds or affordability: which check does the regulator want?
Picture a player file at a UK online casino (illustrative). The player deposits £4,000 in one month and £12,000 the next, mostly by prepaid voucher, and withdraws to a bank account opened two weeks earlier. Two checks sit in that file, and they answer different questions.
The source of funds check is AML. MLR reg. 28(11)(a) asks for scrutiny of transactions "including, where necessary, the source of funds".
The Gambling Commission treats prepaid vouchers and all other prepaid payment methods as high risk. Operators "must not rely on third party payment processors" to run KYC checks for them, or on third parties for source of funds without further scrutiny (emerging risks from October 2025).
Evidence should be independent: Spreadex placed "undue reliance on customer assurances about the source of funds". A source of funds declaration records what the player states; the payslip or bank statement verifies it.
The affordability check is safer gambling and asks whether the player can bear the spend. The Commission "does not have any regulatory requirements for affordability checks and is not proposing any" (21 May 2025). Its pilot ran about 1.7 million financial risk assessments on about 860,000 accounts in stage two, 97 percent of them frictionless.
Keep both in one file, labeled apart. A payslip can settle an affordability question and still leave the source of funds open.
| Stage | AML check (source of funds) | Safer gambling and fairness check | Who decides |
|---|---|---|---|
| Signup | Identify the player once a line is reached; sanctions and PEP screening before the first deposit (Bet365, 2024) | Age and identity verification | Onboarding team |
| Deposit | Attribute every deposit to the player; rate prepaid methods high risk | UK financial vulnerability check at £150 net deposits in 30 days | Payments and compliance |
| Play | Compare spend with known income; raise the risk rating on velocity (QuinnBet, 2026) | Customer interaction on indicators of harm | Compliance and safer gambling teams |
| Withdrawal | Check the destination account and the source of funds before payout; report if suspicion forms | No information demanded at withdrawal that could reasonably have been asked for earlier (L & L Europe, 2026) | MLRO |
What is the UK financial vulnerability check, and when does it apply?
Social responsibility code 3.4.4 of the LCCP, in force since 30 August 2024, applies to remote licensees except listed lottery, technical, software, host, ancillary and some betting licenses. They must run a public record check when a customer's deposits minus withdrawals exceed £150 in a rolling 30 days; the line was £500 until 27 February 2025. The check looks for a bankruptcy order, a county court judgment, an individual voluntary arrangement or a similar marker. It is not needed again within 12 months of an earlier check or financial risk assessment. QuinnBet's settlement listed customers who met the threshold without one.
Which gambling AML rules took effect since 2025, and which arrive in 2027?
- 28 February 2025. The UK financial vulnerability line falls from £500 to £150.
- 17 July 2025. The UK national risk assessment raises casinos from low to medium risk.
- 30 September 2025. The UAE issues Federal Decree by Law No. 10 of 2025. CR 134 is issued on 29 October 2025, published in Official Gazette No. 811 on 14 November 2025 and in force from 14 December 2025 (art. 71).
- 2 October 2025. The Gambling Commission rates all prepaid payment methods high risk.
- 30 June 2026. The UK MLR casino line is set in pounds (S.I. 2026/621, reg. 14(d), (e)).
- 9 September 2026. The FATF publishes risk indicators for gaming and gambling.
- 7 October 2026. Türkiye's identification lines double (Presidential Decision No. 11845, Official Gazette of 7 October 2026).
Next: on 10 July 2027 the AMLR applies, with most of Directive (EU) 2024/1640, and every EU gambling provider not exempted under art. 4 works to the €2,000 line of art. 19(5). AMLA's direct supervision from 2028 covers selected credit and financial institutions only.
How do you prevent money laundering in a casino or online operator?
Prevention comes down to controls an auditor can test against a rule or a case. Where complead, formerly Sanction Scanner, has no part, the operator runs the control itself.
| Control | Source | How complead supports it |
|---|---|---|
| Business risk assessment covering products, channels, payment methods, geographies and B2B partners | LCCP 12.1.1; Directive art. 8; AMLR art. 10 | Outside the platform: the assessment is the operator's document; rules then take scope by product, segment or jurisdiction |
| Identify and verify at your line, attributing play before it | MLR reg. 27(5); Directive art. 11(d); AMLR art. 19(5), recital 64 | One risk score per player across onboarding, screening and monitoring |
| Sanctions and PEP screening before the first deposit | Bet365, 4 April 2024; FATF R.12; MLR reg. 35 | Sanctions, PEP and watchlist screening of each player, with every search recorded |
| Risk based source of funds triggers, not flat loss lines | Done Brothers, 2025; Corbett Bookmakers, 2025 | Detection rules built without code and backtested on real history before release |
| Source of funds evidence from independent sources | Spreadex, 15 May 2025 | Outside the platform: the document review is the operator's |
| Prepaid methods rated high risk | Gambling Commission, October 2025 | Rule conditions, thresholds and score effects set by the operator |
| Linked account and identity checks | FATF, 9 September 2026 | Outside the platform |
| Rerating on spend velocity | QuinnBet, 20 August 2026 | Monitoring rules with thresholds and score effects |
| SAR or STR clock tracked per jurisdiction | Table 2 | Reporting support within case management |
| CTR aggregation per gaming day (US) | 31 CFR 1021.313 | Outside the platform |
| White label and supplier due diligence | Evolution, 2026; TGP Europe, 2025 | KYB and UBO verification traces owners and parents up the chain to natural persons and screens every party |
| Records for 5 years, 8 in Türkiye | Table 2 | Each search kept with who ran it, the query, the time and the result, no match results included |
| Independent testing and training | 31 CFR 1021.210(b) | Outside the platform; each rule change versioned, with the who, what, when and why on record |
Which of these checks can complead run for an operator?
complead puts player screening, risk scoring, transaction monitoring and payout screening on one engine, so a player carries one risk score from signup to payout. Its AML for iGaming and gambling setup screens players through client screening and ongoing monitoring. API triggers switch monitoring per name. The screening data holds 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
Customer risk assessment and KYC sets each player's rating. In transaction monitoring, deposit and loss lines are rules built without code, and each can be tested on the operator's play data from the last 30, 60 or 90 days before it goes live.
Payment screening checks the sender and the receiver of a payout through the API while it is processed. Agents handle the routine cases end to end and leave the evidence, a narrative and a work log in each file. The MLRO decides the rest, and the decider's name stays in the record; for the filing there is reporting support within case management.
The operator still has to set its own source of funds trigger, the deposit, loss or velocity level at which it asks where the money came from, and decide which evidence closes the question. Done Brothers, Corbett Bookmakers and Optdeck were each faulted for financial thresholds that did not fit the risk, so write the level down with its data.
What the 2026 PDF adds. The articles and fines above were checked on 4 November 2026 against the official texts and the regulators' own releases or orders. The download beside this guide turns them into five working files for an operator: a threshold card by jurisdiction, a source of funds trigger worksheet, a player file checklist that keeps source of funds and affordability evidence apart, a due diligence form for B2B and white label partners and a reporting clock card.
