Quick Answer: AML compliance in iGaming means an online casino or sportsbook must assess its money laundering risk, verify and risk-profile players, monitor deposits and play, and report suspicious activity, under the UK Money Laundering Regulations 2017, Malta’s FIAU procedures or the US Bank Secrecy Act. Operators can outsource the volume work, such as document review and alert triage, but never the MLRO’s decisions. Regulators are enforcing hard: the UK Gambling Commission (2025) fined online operator Platinum Gaming £10 million.
Key Takeaways
- UK enforcement keeps landing on AML controls: Platinum Gaming paid £10 million in October 2025 and Evolution Malta Holding £4.75 million in July 2026 (UKGC).
- Remote casino is still rated high risk for money laundering in the Commission’s 2026 sector assessment (UKGC, 2026).
- Since 28 February 2025, UK remote operators must run a financial vulnerability check once net deposits pass £150 in 30 days (UKGC, LCCP 3.4.4).
- The UK gambling sector filed 7,491 suspicious activity reports in the year to March 2025 (NCA, 2025).
- In Malta, the MLRO and the head of the monitoring function cannot be outsourced to third parties (FIAU, 2025).
- Threshold-only controls are a repeat failing: L & L Europe paid £900,000 after controls built on financial thresholds and sampling missed customer risk (UKGC, 2026).
What AML Obligations iGaming Operators Face
Every regulated online gambling operator must run a risk-based AML programme: assess its money laundering risk, verify and risk-profile customers, monitor activity, keep records and report suspicion. In Great Britain, remote casinos sit inside the Money Laundering Regulations 2017, and the Commission’s licence conditions require that risk assessment to be reviewed whenever products or technology change.
The core obligations by jurisdiction:
| Jurisdiction | Key rules | What the operator does day to day |
|---|---|---|
| Great Britain | MLRs 2017, UKGC licence conditions, LCCP 3.4.4 | Risk-profile players, monitor deposits and play, run a financial vulnerability check at £150 net deposits in 30 days, escalate and report suspicion |
| Malta | PMLFTR and binding FIAU Implementing Procedures, MGA licence conditions | Apply CDD once deposits reach €2,000, verify identity, screen for PEPs, risk-score players, report suspicion through the MLRO |
| United States | Bank Secrecy Act as applied to casinos, plus state licensing rules | File a Casino SAR on suspicious activity of $5,000 or more (FinCEN), file CTRs on cash over $10,000 a gaming day, verify identity and in-state location before play |
Two details catch operators out. First, the UK separates the consumer-protection financial vulnerability check from AML source of funds checks, but the same player activity often triggers both, so teams need one joined-up view of the customer. Second, US online play offered through a licensed casino carries the same BSA duties as play on the casino floor, while state rules add identity, age, self-exclusion and geolocation checks.
These rules generate a steady flow of work, which is where most operators either cope or fall behind.
The Workload Behind iGaming AML
The AML workload in iGaming is continuous and front-loaded: every new player creates verification work, and every deposit pattern can create a review. The UK National Risk Assessment found income from remote casino slot games rose 52% since 2020, from £2.3 billion to £3.6 billion (HM Treasury, 2025), with more customers gambling for longer.
Typical work queues inside an operator’s AML function:
- Registration KYC: identity, age and address checks, with manual review of failed or unclear documents.
- Threshold triggers: the UK £150 vulnerability check and Malta’s €2,000 CDD trigger, which Malta expects to be completed within 30 days.
- Ongoing monitoring: alerts on rapid deposits, unusual withdrawals, payment method changes and play patterns.
- Enhanced due diligence: source of funds and source of wealth evidence for higher-risk players.
- Suspicion and reporting: case files for the MLRO, who decides whether to report. UK gambling businesses filed 7,491 SARs in the year to March 2025 (NCA, 2025).
No regulator publishes an industry-wide figure for how many players need enhanced checks or how long reviews take, so operators size teams from their own deposit and alert data. The cost of getting that sizing wrong shows up in the enforcement record.
Where Operators Get Fined: Recent Enforcement
UK fines and settlements show the same failings again and again: risk assessments that miss real customer risk, due diligence that is not followed, and source of funds evidence that is collected but not analysed. The table below lists recent actions against online operators taken from the Commission’s own case pages.
| Regulator | Operator | Date | Penalty | Main AML failing |
|---|---|---|---|---|
| UKGC | Evolution Malta Holding Limited | July 2026 | £4,750,000 | Inadequate ML and TF risk assessment, policies and controls |
| UKGC | L & L Europe Limited | October 2026 | £900,000 | Controls based on thresholds and sampling, own CDD procedures not followed |
| UKGC | QuinnBet (Gibraltar) Limited | August 2026 | £609,104 | AML and social responsibility failures |
| UKGC | Platinum Gaming Limited | October 2025 | £10,000,000 | Risk assessment ignored previously closed accounts, letting blocked customers reopen |
| UKGC | Maple International Ventures Limited | September 2025 | £360,000 | Social responsibility and AML failures |
In Malta, the FIAU (not the MGA) imposes AML penalties, and its thematic review of remote gaming found recurring gaps: no customer risk assessment after the €2,000 threshold, delayed CDD, missing identity or address evidence, and no source of funds information for medium and high-risk players (FIAU, thematic review).
Most of these failings are not about missing policy. They are about work that did not get done well or on time, which is exactly the part an operator can choose to resource differently.
What Operators Can Outsource and What They Must Keep
Operators can outsource AML tasks but not AML accountability or the MLRO’s decisions. The UK MLRs allow CDD to be carried out through an outsourcing provider while the operator stays liable, and Malta’s FIAU states the MLRO and the officer in charge of monitoring “cannot be outsourced to third parties” (FIAU, 2025).
| AML task | Usual split | Why |
|---|---|---|
| Identity verification and screening | Technology plus outside reviewers for exceptions | Repeatable CDD steps; the operator stays liable |
| KYC document review and file completion | Often outsourced | Permitted under UK MLRs and FIAU procedures |
| Source of funds and source of wealth evidence gathering | Often outsourced | Evidence collection is procedural |
| Source of funds analysis and approval | Kept by operator | Weak analysis features in UK enforcement |
| Transaction monitoring alert triage | Often outsourced | A third party may flag unusual activity to the MLRO |
| Case preparation for the MLRO | Often outsourced | Operational support; the judgement stays internal |
| Risk appetite, risk methodology, customer acceptance | Kept by operator | Core control decisions |
| MLRO role, suspicion decision, SAR or STR filing | Kept by operator | Cannot be delegated in Malta; the MLRO decides in the UK |
Malta adds a paperwork step: before outsourcing, the operator must document its assessment of the arrangement and set the exact scope in a written agreement the FIAU can review. In the UK, the Commission holds the licensee responsible, and enforcement in 2025 and 2026 has not accepted “the vendor did it” as a defence. Our guide to the outsourced MLRO covers where external advice fits around the MLRO role, and our wider guide to AML outsourcing covers the same split for banks and payments firms.
With the split clear, the next choice is what kind of outside support to use.
Types of AML Support for Operators
Operators usually combine three kinds of outside help, each suited to a different job. The right mix depends on whether the problem is technology, volume or expertise.
- Compliance and identity platforms: automate ID checks, sanctions and PEP screening, document authentication, transaction monitoring rules and case management. They cut manual volume but still need people to tune rules and work the alerts.
- Managed review teams: trained analysts who work the operator’s queues, such as KYC review, screening dispositions, alert triage, source of funds evidence gathering and case packs, under the operator’s procedures and QA. Best for steady or growing volume with clear playbooks.
- Specialist consultancies and law firms: risk assessments, policy design, gap analysis, regulator readiness, independent audits, remediation programmes and privileged investigations. Best for design and assurance, not daily volume.
A common pattern for mid-sized operators is platform plus managed team, with a consultancy brought in for the annual risk assessment refresh or an independent audit. Whatever the mix, the operator’s MLRO owns the end-to-end control and should be able to show a regulator who does what.
That raises the practical question of what an outsourced team looks like on the ground.
How South African Teams Handle iGaming AML
A South African AML support team works inside the operator’s own platforms and procedures, covering the review queues that build up out of hours and during peaks. South Africa runs on UTC+2, one hour ahead of Malta in winter and level with it in summer, and one to two hours ahead of the UK, so a single team can cover the European day and extend into evening peaks when deposits and play are highest.
What a typical engagement covers:
- KYC and document review: clearing manual verification queues against the operator’s acceptance rules.
- Alert triage: level 1 review of monitoring alerts, with clear escalation to the operator’s investigators.
- EDD evidence packs: collecting and organising source of funds and source of wealth documents for the operator’s decision.
- QA and reporting: sampling, error tracking and management information for the MLRO.
South Africa’s data protection law, POPIA, follows GDPR-style principles, which simplifies contract alignment for UK and Malta operators. Our guide to BPO in South Africa covers the wider location case. Afrishore BPO also runs iGaming player support for operators, so compliance and player-facing teams can share escalation routes, for example when a support agent spots a potential affordability or source of funds concern during a chat.
Before signing, operators should compare the real cost of each model.
AML Compliance Costs in iGaming: In-House vs Outsourced
There is no reliable public figure for total AML compliance cost at gambling operators, so the comparison comes down to cost drivers rather than a single benchmark. Compliance hiring is expensive in the UK and Malta, and fines like the £10 million paid by Platinum Gaming show the far larger cost of controls that fail.
| Factor | In-house team | Outsourced managed review team |
|---|---|---|
| Hiring and ramp time | Long recruitment cycles for experienced analysts | Trained analysts deployed to your procedures |
| Coverage hours | Night and weekend cover adds headcount | Extended and 24/7 coverage built into the model |
| Peak handling | Backlogs build during promotions and major events | Capacity flexes with volume |
| Control and accountability | Fully internal | Stays with the operator and MLRO by design |
| Oversight effort | Line management | Contract, QA sampling and reporting must be set up properly |
The honest trade-off: outsourcing reduces the cost of volume and coverage, but it adds an oversight job. Operators that skip the oversight step end up in the enforcement table above. A clear service agreement with QA targets and audit rights, as covered in our guide to BPO contracts and SLAs, is what makes the model safe.
Frequently Asked Questions
What is AML compliance in iGaming? AML compliance in iGaming is the set of controls an online casino or sportsbook uses to stop money laundering: a business risk assessment, player verification and risk profiling, monitoring of deposits and play, record keeping, and reporting suspicion to the authorities through the MLRO.
What AML rules apply to online gambling operators in the UK? UK remote casinos fall under the Money Laundering Regulations 2017 and Gambling Commission licence conditions. Operators must assess risk, apply risk-based CDD, monitor customers, report suspicion to the NCA, and since February 2025 run a financial vulnerability check once net deposits pass £150 in 30 days.
Do iGaming operators need an in-house MLRO? Yes. In Malta, the FIAU states the MLRO and the officer in charge of the monitoring function cannot be outsourced to third parties. In the UK, the MLRO is the operator’s own decision maker on suspicion. Outside teams and advisers can support the MLRO but not replace the role.
How does outsourcing AML operations affect regulatory accountability? It does not move it. The UK MLRs let operators carry out CDD through an outsourcing provider, but the operator stays liable for any failure. Regulators expect the operator to oversee the provider, sample its work and be able to explain who performs each control.
What are the top fraud and AML compliance platforms for iGaming operators? Operators typically combine three types of platform: identity and KYC verification tools such as Jumio or Onfido, sanctions and PEP screening tools such as ComplyAdvantage or World-Check, and transaction monitoring and case management tools such as NICE Actimize. Most mid-market operators run a combination rather than one suite.
Which AML solutions balance compliance with a seamless onboarding experience? Tiered verification works best. Low-risk players clear automated identity and sanctions checks with no manual touch, medium-risk accounts go to an analyst queue with a set turnaround, and only higher-risk or high-value players enter full EDD with source of funds checks.
What AML tasks can iGaming operators outsource? Operators commonly outsource KYC document review, screening dispositions, monitoring alert triage, source of funds evidence gathering, periodic review preparation and case packs for the MLRO. Risk appetite, source of funds approval, the suspicion decision and SAR or STR filing stay with the operator.
What are the most common AML failings in iGaming enforcement? Recent UK cases cite risk assessments that miss customer risk, controls built on financial thresholds and sampling, operators not following their own CDD procedures, and blocked customers able to reopen accounts. Malta’s FIAU has flagged delayed CDD and missing source of funds checks.
Afrishore BPO supports iGaming operators with player support and AML operations teams delivered from South Africa under the operator’s procedures, platforms and MLRO oversight. Read our guides to AML outsourcing, the outsourced MLRO and casino customer support, or see our financial services outsourcing division and full range of business process outsourcing services.
Need trained capacity for KYC and alert backlogs? Talk to our iGaming team or contact Afrishore BPO.
