Regulatory Compliance Requirements: A Reference Guide

The UK Gambling Commission reported more than 9,700 compliance activities in 2024–25, compared with more than 4,200 the previous year. Enforcement against 24 operators produced £4.2 million in fines or regulatory settlements, according to its performance report. For iGaming businesses, those figures frame the central compliance question: can the licensed entity produce evidence that its controls operated?

Table of Contents

• Why Regulatory Compliance Requirements Matter in iGaming
  • Evidence matters beyond the compliance department
  • An evidence-led interpretation
• International Baselines Behind National Licensing Rules
  • How the FATF framework expanded
  • What the history means for a licence holder
• Licensing Approvals and Jurisdiction-Specific Obligations
  • Separate approval evidence from operational evidence
  • Assign ownership before launch
• AML and KYC Controls for Gambling Operators
  • Apply thresholds in their proper context
  • Build a documented decision sequence
  • Test the programme and its dependencies
• Responsible Gambling and Customer Interaction Duties
  • Follow the signal through the intervention
  • Financial vulnerability requires proportionate review
• Technical Standards and Product Lifecycle Evidence
  • Trace requirements to the deployed build
  • Preserve records that explain production behaviour
  • Distinguish supplier assurance from operator verification
• Data Protection, Payments and Advertising Requirements
  • Enforce financial limits in the account system
  • Reconcile the customer record across teams
• Quick Reference Index and Related Sections
  • Quick-Reference Compliance Requirements by Domain
  • Dependencies that reviews should test
  • Questions for a compliance review

Why Regulatory Compliance Requirements Matter in iGaming

Regulatory compliance requirements connect legal obligations to everyday decisions about customers, payments, products, suppliers and data. A policy can describe the intended process. An investigation record, release approval or intervention history shows whether employees and systems followed it.

The financial exposure extends beyond gambling enforcement. Under the General Data Protection Regulation, available sanctions include reprimands, restrictions or prohibitions on processing, and fines reaching €20 million or 4% of total worldwide annual turnover, subject to the applicable regulatory threshold. That exposure makes privacy governance relevant to business continuity, not merely information security.

Evidence matters beyond the compliance department

The operational implication is straightforward: compliance teams can't substantiate every obligation from their own files. Engineering holds deployment records, payment teams hold transaction decisions, customer-service teams hold interaction histories, and suppliers may hold verification or testing evidence.

A useful distinction separates three questions:

• Applicability: Which legal entity, product, market and activity does the requirement cover?
• Execution: Which employee, system or supplier performs the control?
• Demonstration: Which retained record establishes what happened, when it happened and who approved the outcome?

This distinction matters to operators and suppliers for different reasons. Operators need visibility into the controls supporting their licences. Suppliers need to understand which customer obligations their technology affects, rather than relying on broad statements that a platform is compliant.

An evidence-led interpretation

The enforcement figures don't establish that every operator faces the same risk, or that compliance activity automatically means a breach. They establish the scale of supervisory activity. The analytical conclusion is narrower: businesses should prepare for recurring examination rather than assume that an approved application or policy manual ends the process.

Practical rule: A control isn't audit-ready merely because a policy describes it. The responsible team should be able to retrieve evidence of its operation.

For compliance leads, the most useful reference is therefore an obligation-to-evidence map. Each entry should distinguish the underlying requirement from management's chosen implementation and identify both the accountable owner and the evidence custodian.

The ownership arrangements below are recommended operating models, not universal statutory job descriptions. Likewise, suggested evidence files are practical ways to demonstrate compliance, not a claim that every regulator requests an identical document package. Local legislation, licence conditions and applicable technical standards remain decisive.

International Baselines Behind National Licensing Rules

National gambling rules don't emerge from a single international gambling code. However, the Financial Action Task Force, or FATF, provides an important baseline for the anti-money-laundering obligations that countries incorporate into legislation and supervision.

The distinction is essential: an international standard explains the policy foundation, while domestic implementation determines the enforceable obligation.

How the FATF framework expanded

The chronology records a progressive expansion of scope:

• April 1990: FATF created its 40 AML Recommendations, establishing a common baseline covering criminal law, law enforcement, financial regulation, customer identification and suspicious-transaction reporting.
• June 1996: Revisions extended the framework to serious crimes beyond traditional drug-related offences.
• June 2003: The recommendations expanded to designated non-financial businesses and professions, broadening their reach beyond banks.
• February 2012: FATF consolidated the original recommendations and nine Special Recommendations into 40 standards, addressing terrorist financing, proliferation financing, corruption risks, beneficial ownership and risk-based controls.

These milestones and the framework's national implementation model are documented in the Japanese Ministry of Finance's account of international AML standards.

What the history means for a licence holder

The original customer-identification and reporting baseline helps explain why licensing frameworks demand more than evidence that a customer opened an account. The later expansion explains the importance of understanding criminal proceeds beyond a narrow predicate offence, identifying ownership and adapting controls to risk.

The practical interpretation is that compliance teams should trace a requirement through distinct layers:

This avoids treating FATF guidance as an identical law everywhere. It also prevents the opposite mistake, assuming that a locally different procedure has no connection to a common international objective.

Jurisdictional monitoring should preserve those distinctions. Coverage such as PAGCOR regulatory updates can help teams identify matters for legal review, but editorial coverage shouldn't replace the applicable regulator's text.

Analytical conclusion: A multinational operator needs a shared control taxonomy, not a single undifferentiated rulebook. Common objectives can support consistent governance, while local requirements determine the actual trigger, process and reporting route.

Licensing Approvals and Jurisdiction-Specific Obligations

A gambling authorisation and an AML reporting regime answer different questions. Licensing concerns whether a business may conduct the relevant activity under specified conditions. Financial-crime rules concern how an in-scope business prevents, detects and reports suspicious activity.

The UK remote gambling and software framework and the United States Bank Secrecy Act casino framework should therefore be compared by function, not treated as interchangeable approval systems.

Separate approval evidence from operational evidence

For application planning, a compliance lead should assemble a jurisdiction-specific dossier covering corporate structure, beneficial owners, proposed products, platforms, player-protection arrangements and AML controls. The regulator's actual application requirements should determine the contents; this isn't a universal submission checklist.

A practical approval sequence is to establish the applicant's identity and activities, identify the required permissions, prepare supporting controls and documentation, respond to regulator review, and preserve the resulting conditions and reporting obligations. Internal approval to launch shouldn't substitute for any regulatory approval required in the relevant market.

Under the US framework, a Casino Suspicious Activity Report is required for conducted or attempted activity involving or aggregating at least $5,000 when the casino knows, suspects or has reason to suspect the specified suspicious circumstances. FinCEN also identifies structuring indicators around the separate $10,000 reporting or recordkeeping threshold, including split cash-outs and divided casino checks, in its casino and card-club suspicious-activity guidance.

Assign ownership before launch

The recommended licence-condition register should identify the authorised entity, covered activity, relevant condition, internal owner, supplier dependency and evidence location. Legal counsel should resolve applicability; the operational owner should demonstrate execution.

For example, a platform supplier may hold a test report, while the operator's engineering team holds the deployed configuration. Neither record alone necessarily establishes that the approved functionality reached the relevant production environment.

Supplier approvals also deserve a separate workstream. A PAGCOR business-to-business provider application reference can support navigation, but teams should confirm the applicable category and requirements against official materials before preparing a submission.

Approval evidence establishes what the business was permitted to launch. Operational evidence establishes how the business subsequently ran it.

The comparison's main lesson is about scope. FinCEN's casino guidance doesn't establish a general online gambling licence, and a technical approval doesn't resolve every AML obligation. Compliance leads should record the boundary of each permission and requirement explicitly.

AML and KYC Controls for Gambling Operators

AML and know-your-customer controls, or KYC, should begin with a documented assessment of customer, product, geographic, payment and distribution-channel risks. The operator should then choose controls proportionate to those risks, rather than build the programme around transaction thresholds alone.

Apply thresholds in their proper context

The FATF Recommendation 10 casino framework requires customer identification and verification for financial transactions at or above USD/EUR 3,000, while suspicious activity requires attention regardless of value. EU Directive 2015/849 applies a EUR 2,000 due-diligence trigger to gambling transactions involving collection of winnings, wagering a stake, or both, including apparently linked transactions; these distinctions form part of the FATF recommendations and associated gambling-sector framework.

Local implementation can be stricter. Neither trigger should be configured as permission to ignore activity below it, and the separate US reporting trigger discussed earlier serves a different purpose.

Build a documented decision sequence

1. Assess exposure before selecting controls. The AML lead should document how the operator's products, markets, payment methods and distribution arrangements affect risk. The evidence file should explain why the chosen controls address those exposures.

2. Establish a customer profile. Operations should verify identity using reliable, independent information and identify beneficial owners where business customers are involved. The retained record should distinguish information supplied by the customer from information independently checked.

3. Escalate higher-risk cases. Enhanced due diligence should address the reason for increased risk. Where source-of-funds review forms part of that response, the investigation should explain what the information establishes and what remains unresolved.

4. Monitor linked activity. Analysts should examine deposits, wagering, withdrawals and winnings together. Reviewing isolated transactions can miss the relationship that makes a sequence suspicious.

5. Preserve the decision. An alert record should contain the activity reviewed, investigation steps, analyst rationale, escalation and reporting decision where applicable. A closed alert without a reason doesn't explain the judgment.

The registration interface is only one part of that sequence. A customer-facing reference such as Go Perya registration guidance shouldn't be mistaken for evidence that the operator completed its own verification and risk assessment.

Test the programme and its dependencies

Governance should include documented policies, staff training, alert quality assurance, independent testing and regulator-ready records. The operator should also establish how outsourced KYC and payment providers support the controls.

Recommended evidence ownership is deliberately split: the AML lead owns the methodology, operations owns case execution, engineering owns monitoring implementation, and procurement or supplier management holds contractual assurance.

Analytical conclusion: The most important AML record isn't just a successful identity check. It's the documented connection between the customer's risk, observed activity, investigation and final decision.

Responsible Gambling and Customer Interaction Duties

In Great Britain, remote gambling customer-interaction systems must follow an identify, act and evaluate model. Operators must detect customers who may face gambling-related harm, interact appropriately and assess both individual interventions and their overall approach.

The Gambling Commission's examples include requiring a customer to set a spend limit, blocking direct marketing or new bonus offers, imposing a spend limit and applying a time-out. These requirements and examples appear in the Commission's licence conditions and codes of practice for betting.

Follow the signal through the intervention

A hypothetical workflow illustrates the evidence trail without implying a documented operator case. A monitoring system flags a concerning change in play, and a trained reviewer examines the available account information.

The reviewer records the signal, relevant context and reason for the selected intervention. Customer service delivers the interaction, marketing applies any suppression, and the safer-gambling team subsequently assesses the response.

The resulting file should connect:

• Identification evidence: The detected signal, relevant account history and review time.
• Action evidence: The interaction, restriction or limit applied and the reason for choosing it.
• Evaluation evidence: Subsequent observations, customer response and any escalation or revised action.

A message-delivery record alone doesn't establish that the intervention was appropriate or effective. Similarly, a marketing suppression instruction doesn't establish that every connected campaign system applied it.

Financial vulnerability requires proportionate review

UK remote licensees must conduct financial-vulnerability checks when monthly net deposits reach £150, a requirement effective from 28 February 2025, as described in the Chambers gambling-law comparison.

The implementation judgment is distinct from the trigger. Compliance teams should document data reliability, escalation criteria, human review and the handling of disputed findings or false positives.

Analytical caution: More financial data doesn't automatically establish a more proportionate player-protection decision.

A recommended review should compare the rationale for customized messaging, deposit friction, cooling-off measures, further review or account restrictions. Teams can evaluate harmful-play indicators, complaints, conversion effects and escalation quality without assuming that commercial retention demonstrates protection.

The safer-gambling lead should own intervention policy. Monitoring, CRM, customer service and marketing should retain their execution records, while audit tests whether the complete chain can be reconstructed. AML and harm-prevention teams may examine overlapping activity, but they shouldn't substitute one programme's conclusion for the other's.

Technical Standards and Product Lifecycle Evidence

The UK Gambling Commission's Remote Gambling and Software Technical Standards, or RTS, cover functional and security requirements for remote operators and gambling-software licensees. The security requirements are described as a subset of ISO/IEC 27001:2013 controls in the Commission's technical standards guidance.

The operational consequence is that technical compliance should continue through development, testing, deployment and subsequent changes. A pre-launch certificate can't, by itself, establish how a later production version behaves.

Trace requirements to the deployed build

Engineering and compliance should maintain a traceable chain from the applicable requirement to the system component, test case, evidence owner, approval and deployed version. Release gates should identify when independent or approved testing is required under the applicable procedures.

For implementation planning, DevArmor's resource on mapping ISO 27001 controls to engineering workflows offers a related organisational reference. It shouldn't be treated as a substitute for the Gambling Commission's testing requirements or evidence of regulatory approval.

Preserve records that explain production behaviour

A recommended release evidence package should contain:

• Configuration history: Versioned game and platform settings, with the relevant build identifiers.
• Testing records: Test cases, results, identified defects and evidence of their resolution.
• Change approvals: The scope, reviewer, approval decision and deployment record.
• Operational records: Incidents, access logs, vulnerability findings and subsequent remediation.
• Supplier assurance: Applicable attestations and supporting evidence tied to the actual supplied component.

After material changes, teams should reconcile game mathematics, account controls, promotional logic and security settings against the tested configuration. The release owner should record exceptions rather than allow unresolved differences to disappear into general project documentation.

Distinguish supplier assurance from operator verification

Supplier oversight should reflect regulatory impact. A game component, identity-verification service and automated customer-risk model don't create identical evidence needs.

A survey of more than 100 gambling-supplier executives found that 75% experienced increasing operator demands for attestations, broader audit clauses and faster remediation; 58% believed regulatory and legislative understanding would limit AI adoption and benefits, according to Vixio's gaming-supplier survey announcement.

Those findings describe supplier perceptions, not proof that particular controls work. Recommended contracts should address testable objectives, audit access, incident notification, record retention, model changes and exit arrangements.

For jurisdiction-specific planning, PAGCOR game-content provider accreditation requirements belong in the supplier review workstream. The engineering owner should still establish which accredited component and configuration the operator uses.

Data Protection, Payments and Advertising Requirements

Privacy, payments and marketing teams often act on the same customer account for different purposes. The central control challenge is ensuring that each team receives the information needed for its obligation without assuming unrestricted access to the entire customer record.

For player identity, payment, behavioural, marketing and account data, privacy governance should address lawful processing, security and breach response. A practical evidence model records the processing purpose, responsible owner, access arrangements and incident decisions, rather than treating encryption as the complete privacy programme.

Enforce financial limits in the account system

UK remote gambling systems must offer gross deposit limits as a minimum. Withdrawals don't reduce the deposits counted toward that limit, and further deposits must be prevented once the applicable limit is reached.

Operators must prompt customers to set a financial limit at registration or first deposit and keep the facility accessible. A requested increase requires at least 24 hours of cooling-off followed by positive customer confirmation, under the Commission's fair and transparent terms and practices requirements.

Payment and account teams should retain the selected limit, counting logic, rejected-deposit events and increase-confirmation history. Payment-risk information should also reach the AML workflow where relevant, without replacing the separate investigation.

The illustration is conceptual, not evidence of an operational product or certified compliance capability.

Reconcile the customer record across teams

The advertising controls discussed earlier depend on accurate customer status reaching campaign systems. A restriction stored only in a case-management note won't demonstrate that a connected marketing tool enforced it.

A PAGCOR payment-gateway accreditation reference can support supplier scoping. Accreditation review should remain distinct from testing whether account-level restrictions operate correctly through that gateway.

Quick Reference Index and Related Sections

The reference below maps requirements to practical evidence files. The evidence descriptions are recommended review targets; the precise records and retention duties must follow the applicable jurisdiction and obligation.

Quick-Reference Compliance Requirements by Domain

Dependencies that reviews should test

The table shouldn't encourage isolated departmental checks. An AML threshold review also needs the linked-activity analysis described in the AML section; a customer-interaction review needs reliable account information and proof of downstream action.

Technical evidence supports both initial approval and later assurance. Supplier attestations are useful only when teams can connect them to the component, configuration and obligation under review.

The central analytical finding is that evidence ownership and regulatory accountability aren't identical. A supplier may hold the record, an internal team may operate the control, and the licensed business may remain responsible for demonstrating compliance.

Questions for a compliance review

• Which records should remain retrievable? The records supporting applicability, execution, judgment, approval and subsequent review.
• Who closes an evidence gap? The accountable control owner, with the relevant internal or supplier custodian.
• When should assessments be revisited? When changes to products, payments, markets, customer exposure or technology challenge the assumptions supporting existing controls.
• What establishes completion? A documented resolution and, where appropriate, testing that confirms the revised control operates.

Before the next launch or compliance review, the compliance lead should select an applicable licence condition and trace it to its owner, supplier dependency, production control and retained evidence. Any missing connection should become an assigned remediation item with a defined acceptance test, rather than another policy revision without operational proof.