AML compliance in iGaming is the set of rules, controls and reporting duties that prevent sportsbook and casino operators from being used to launder the proceeds of crime. For an operator it is not a back-office formality: it is a condition of keeping the licence, keeping payment partners and keeping the business running without interruption. A regulator that finds gaps in AML controls can suspend or revoke a licence; a payment provider that sees unmanaged risk can withdraw service. This guide sets out which rules may apply to sportsbook and casino operators, where the sector’s specific risks sit, which controls an AML programme needs and what an iGaming platform should provide to support those controls.
In this article
-
-
- What Is AML Compliance in iGaming?
- Which AML Regulations Apply to Sportsbook and Casino Operators?
- Why Is iGaming Exposed to Money Laundering Risks?
- Key AML Controls for iGaming Operators
- What Should an iGaming Platform Provide to Support AML Compliance?
- AML Responsibilities: Operator vs Platform Provider
- How to Evaluate a Platform’s AML Capabilities
- How to Turn AML Requirements into Operational Controls
- Frequently Asked Questions About AML Compliance in iGaming
-
What Is AML Compliance in iGaming?
Anti-Money Laundering (AML) compliance in iGaming means the policies, procedures, people and systems an operator puts in place to detect, prevent and report attempts to introduce, move or legitimise illicit funds through gambling accounts. Its scope runs from onboarding to withdrawal, and it is judged by the regulator on evidence, not on intent. AML is often used interchangeably with KYC, but the two are not the same. Know Your Customer is one component of AML: it establishes who the player is. AML covers everything that happens after that, including risk assessment, ongoing monitoring of deposits, bets and withdrawals, record-keeping and reporting. An operator with a strong onboarding flow and no monitoring is not AML compliant. For the identity side of the picture, see our guide to KYC compliance in iGaming.
Which AML Regulations Apply to Sportsbook and Casino Operators?
The practical question an operator asks is not “what is AML” but “which rules bind me, who enforces them and who receives my reports”. The answer sits on three levels: international standards, binding regional or national law, and the conditions attached to the gambling licence. The levels do not replace each other; they stack.
International AML Standards: The Role of FATF
The Financial Action Task Force (FATF, or GAFI in French) sets the international AML/CFT standards through its 40 Recommendations. These are addressed to jurisdictions, not to individual operators: FATF does not issue licences and its Recommendations are not a law a sportsbook can be prosecuted under. Countries transpose them into their own legislation, and FATF then assesses how well each country has done so. FATF expressly treats casinos, including online casinos, as a covered sector. Whether bookmakers and other betting providers fall under the same obligations is a national choice, so coverage of sportsbook activity has to be checked in each market’s own rules. The standards are not static. On 9 September 2026 FATF published Risks of Gaming and Gambling, its first detailed examination of online and illegal gambling, with a set of red-flag indicators for operators, regulators and law enforcement. The report flags, among other patterns, the use of gambling platforms to move money without actually gambling, structuring of deposits into small amounts and co-ordinated bets on events suspected of manipulation, and it names cash, e-wallets, mobile money and virtual assets as payment channels that carry specific vulnerabilities (FATF news release). Operators should expect national supervisors to read their monitoring rules against those indicators.
Regional and National AML Legislation
Binding obligations come from law: supranational regulations, national AML acts and the secondary rules issued under them. Two examples show how different the picture can be. In the European Union, Regulation (EU) 2024/1624 creates a single AML rulebook that applies directly in all member states. It entered into force in July 2024 but, under its Article 90, applies from 10 July 2027 (EU Monitor). Until then, national transpositions of the existing directives remain the applicable law. An operator planning for EU markets should treat the Regulation as a known future requirement, not as a rule already in force. In Great Britain, every gambling operator has duties under the Proceeds of Crime Act 2002 to be alert to customers gambling with or laundering criminal funds and to report such activity. Remote and non-remote casinos carry additional obligations under the Money Laundering Regulations 2017, which impose formal customer due diligence, record-keeping and governance requirements that do not apply in the same way to a pure sportsbook (Gambling Commission). The product an operator runs changes the regime it sits in. Africa cannot be generalised. Each country has its own AML legislation, its own Financial Intelligence Unit and its own gambling regulator, and the obligations attached to a licence differ between, for example, South Africa, Uganda, Zambia and the DRC. An operator entering any of these markets should verify, with local counsel, which AML law applies to its product and licence type before go-live, and should expect the regulator to ask for evidence of controls rather than for a policy document alone.
Which Authorities Supervise and Receive AML Reports?
Four roles are involved, and in some markets one body holds more than one of them.
- The legislator writes the AML law and sets who is an obliged entity.
- The AML supervisor checks that obliged entities have adequate controls; for gambling this is sometimes the gambling regulator, sometimes a financial authority.
- The gambling regulator attaches AML conditions to the licence and can sanction the operator for failures.
- The Financial Intelligence Unit (FIU) receives and analyses suspicious activity reports and passes cases to law enforcement. FIUs work within national frameworks and share information through networks such as the Egmont Group; there is no single international AML police.
The table is illustrative. It does not replace verification of the applicable law, the territory, the product (sportsbook or casino), the licence held and the corporate structure.
Why Is iGaming Exposed to Money Laundering Risks?
Online gambling is not suspicious by nature, and the large majority of transactions on any licensed platform are ordinary play. The sector is exposed because its normal features, fast transactions, several payment instruments, cross-border activity and a wallet that can hold and move value, are also useful to someone who wants to disguise the origin of funds. AML controls exist to tell the two apart.
Transaction Patterns and Payment Methods
The indicators supervisors expect operators to watch are patterns, not single events. Typical examples include deposits followed by withdrawal with little or no play in between, repeated small deposits that together add up to significant sums, use of several payment methods with no apparent reason, mismatches between deposit and withdrawal instruments, and bets placed in ways that minimise loss rather than seek a return. No payment method is a risk in itself. Cards, e-wallets, mobile money and crypto rails can all be used legitimately; what matters is the combination of method, pattern and the controls applied. In markets where mobile money is the primary channel, the volume of small transactions makes rule design and reconciliation harder, which is why an operator needs transaction data it can query, not just settle. A payment layer such as PlaylogiQ’s Payment Hub gives a single view of deposits and withdrawals across providers; that visibility supports AML monitoring, but fraud prevention and AML remain distinct disciplines with distinct obligations.
Player Identity and Account-Related Risks
The second family of risks sits on the account. False or borrowed identities, accounts controlled by someone other than the registered player, multiple accounts held by the same person and inconsistencies between the stated profile, the funds involved and the gambling behaviour are all signals worth examining. They are signals, not findings: an alert on any of them is a reason to look closer, not proof of an offence.
Key AML Controls for iGaming Operators
An AML programme is a set of controls that can be shown to a supervisor: written policy, a named responsible person, documented procedures and tools that produce evidence. The acronyms matter less than what each control does and why.
Customer Due Diligence (CDD), KYC and Enhanced Due Diligence (EDD)
Customer due diligence establishes who the player is, assesses the risk they present and keeps that picture current. KYC is the identification and verification part. Enhanced due diligence applies additional checks where the risk is higher, for example when a player is a politically exposed person, when funds are unusually large relative to the profile or when the player’s jurisdiction is high risk. Due diligence is not a single event at registration: the data has to be refreshed when circumstances change and at intervals the policy defines.
Risk-Based Approach
The risk-based approach is the organising principle of every modern AML regime. Controls are proportionate to the risk presented by the customer, the product, the geography and the observed behaviour. A single deposit threshold applied to every player is not a risk-based approach; it over-controls low-risk players and under-controls high-risk ones. The operator documents how it scores risk, how scores change the controls applied, and how the methodology is reviewed.
Transaction Monitoring, Alerts and False Positives
Monitoring turns raw deposit, bet and withdrawal data into alerts that a person can act on. Rules and indicators generate alerts; a trained analyst reviews them, documents the outcome and escalates what cannot be cleared. The practical difficulty is volume: rules that are too broad produce more alerts than the team can review, and an alert that nobody reviews is a liability rather than a control. Tuning rules to reduce false positives, while keeping the ones that matter, is ongoing work. An internal alert is also not the same thing as a confirmed suspicion: the escalation path from alert to review to decision has to be clear and recorded.
Record-Keeping and Suspicious Activity Reporting
The operator keeps records of identification data, risk assessments, transactions, alerts and decisions for the period the applicable law requires, and in a form that can be produced on request. Where a review concludes that activity is suspicious, the operator files a report with the competent authority, usually the FIU, in the format and within the timeframe that the national regime sets. Report names, thresholds and deadlines differ by country; a process designed for one jurisdiction cannot be copied unchanged into another.
What Should an iGaming Platform Provide to Support AML Compliance?
A platform does not make an operator AML compliant. Compliance is a property of the operator’s programme, and the regulator holds the licensee accountable for it. What a platform can do is make the programme workable: give the compliance team the data, the tooling and the evidence trail it needs. The capabilities below are what an operator should look for; whether each one is native to a given platform or delivered through integrations should be confirmed with the provider during evaluation.
Player Account Management and Identity Data
The player account management layer is where identity, wallet and activity data come together. A PAM that holds the verified profile, the verification status, the risk classification and the full account history in one place lets the compliance team see a player as a whole rather than reconstruct them from several systems. PlaylogiQ’s Player Account Management module is designed to centralise that profile and expose it to the operator’s own teams and tools; the specific checks performed and the data retained depend on how the operator configures it and on the providers it connects.
Transaction Monitoring and Risk Alerts
Useful monitoring needs deposit, withdrawal and gameplay data at a granularity that rules can run on, a way to define and adjust those rules, and a workflow that routes alerts to people, records the review and keeps the audit trail. Automation generates and prioritises alerts; the judgement on each case belongs to the operator’s specialists. A platform should allow the two to work together without forcing the operator to export data into spreadsheets.
Integration with Specialist AML and KYC Providers
Identity verification, document checks, sanctions and PEP screening and adverse-media screening are specialist services delivered by dedicated providers. A platform’s role is to integrate them cleanly: pass the data, receive the result, store it against the player and trigger the right follow-up. PlaylogiQ is a platform provider, not a standalone AML vendor; the depth of screening an operator achieves depends on the providers it contracts and on how those integrations are configured for each market.
Audit Trails and Regulatory Reporting
Everything a supervisor may ask for, who verified what and when, which alert was raised, who reviewed it and what was decided, should be logged and retrievable. Reporting outputs have to match the format each jurisdiction requires, which means reporting is configured per market rather than delivered as a single universal template.
AML Responsibilities: Operator vs Platform Provider
The licensed operator defines the AML policy, appoints the responsible officer, assesses alerts, decides what to report and answers to the regulator. The platform provider supplies and integrates the tools, keeps the data available and supports the operator’s configuration. Contracts, the licence and the delivery model shift some tasks between the two parties: in a White Label arrangement the licence holder may carry obligations the brand operator does not, while in a Turnkey set-up the operator typically holds its own licence and the full set of duties with it.
What never moves is accountability. Outsourcing a task does not outsource the obligation, and supervisors are increasingly explicit about this: the Gambling Commission’s updated casino guidance asks operators to consider the money laundering risks posed by their business-to-business relationships, including third parties and white label partners (Gambling Commission). The operator should know, in writing, which party does what in each market before the first player registers.
How to Evaluate a Platform’s AML Capabilities
Five questions cover most of what matters in a platform evaluation.
- Does the platform give end-to-end visibility of player identity, wallet and activity data, or is it split across modules that do not talk to each other?
- Which KYC, screening and verification providers are integrated today, and how is a new one added for a new market?
- Can the operator define and adjust monitoring rules, and is there a built-in workflow for alert review, escalation and record of outcome?
- Are logs, reports and audit evidence exportable in a form the operator’s supervisor will accept?
- Can reporting and controls be configured per jurisdiction, so that entering a new market does not mean rebuilding the compliance set-up?
How to Turn AML Requirements into Operational Controls
AML compliance in iGaming comes down to four things an operator has to own: knowledge of the rules that apply in each market, governance that assigns responsibility, processes that run every day and technology that produces evidence. None of the four can be bought ready-made, but the fourth can be made much easier to run. If you are assessing how a platform’s data, monitoring and integration capabilities would fit your compliance programme, PlaylogiQ’s team can walk through the set-up for your markets. Talk to PlaylogiQ.
Frequently Asked Questions About AML Compliance in iGaming
What is the difference between KYC and AML in iGaming?
KYC is the identity-verification step: confirming who a player is, their age and, where required, the source of their funds. AML is the wider programme that uses that information: risk assessment, ongoing transaction monitoring, record-keeping and reporting suspicious activity to the competent authority. An operator can pass KYC checks and still fail its AML obligations.
Does an iGaming platform make an operator AML compliant?
No. A platform can provide the data, monitoring rules, alert workflows and audit trails that an AML programme depends on, and integrate specialist KYC and screening providers. The obligations themselves – policies, risk assessment, alert review, reporting and accountability to the regulator – stay with the licensed operator under the applicable law and licence conditions.
Which AML rules apply to a sportsbook operating in several countries?
The rules of each jurisdiction where the operator is licensed or offers services. FATF standards set the international baseline, but binding obligations come from national AML laws, the gambling regulator’s licence conditions and the local Financial Intelligence Unit’s reporting rules. Coverage of betting, as opposed to casino, varies by country and must be checked market by market.
Sources
- FATF, Risks of Gaming and Gambling, 9 September 2026, and the related news release
- Regulation (EU) 2024/1624, Article 90 application dates via EU Monitor
- Gambling Commission, frameworks: POCA and the Money Laundering Regulations 2017 and casino guidance update
- PlaylogiQ, Player Account Management, Payment Hub, KYC Compliance
