AML and KYC in iGaming:
Complete Compliance 2026

The iGaming industry moves billions of dollars annually — and with it, regulatory scrutiny over anti-money laundering and player identity verification continues to grow. It is estimated that over USD 2.5 billion is laundered annually through betting and online gaming platforms, making AML/KYC compliance not just a legal obligation but a strategic necessity for business survival.

With the tightening of global regulations — including the EU's 6th Anti-Money Laundering Directive (6AMLD), updated FATF recommendations, and Curaçao's new LOD — operators who neglect their compliance programs face multimillion-dollar fines, license revocation, and even criminal liability. This guide details everything you need to know to implement a robust and efficient AML/KYC compliance program in 2026.

1. What Are AML and KYC in the iGaming Context?

AML (Anti-Money Laundering) refers to the set of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained money as legitimate income. In the iGaming context, AML encompasses all measures an operator must adopt to detect, prevent, and report money laundering attempts through its platform.

KYC (Know Your Customer) is the process of verifying customer identities — in this case, players. It is a fundamental component of AML, because without knowing who is using the platform, it is impossible to detect suspicious activities effectively.

Why is iGaming a target for money laundering?

Online gaming platforms have characteristics that make them particularly vulnerable to money laundering:

• Massive transaction volume: Thousands of daily deposits and withdrawals make it difficult to identify suspicious patterns without automated systems
• Digital anonymity: The online nature allows criminals to operate from anywhere in the world, frequently using fake identities
• Multiple payment methods: Accepting cards, e-wallets, bank transfers, and cryptocurrencies creates multiple risk vectors
• Rapid conversion: Funds can be deposited, minimally "played," and withdrawn as "legitimate winnings" within hours
• 24/7 operation: The uninterrupted nature of online platforms makes real-time manual supervision difficult

According to FATF reports, the online gaming sector is classified as high risk for money laundering and terrorist financing, requiring due diligence measures proportional to this risk level.

2. Regulatory Framework: FATF, EU, and Curaçao

AML/KYC compliance in iGaming is shaped by three interdependent regulatory layers that every operator must understand:

FATF — Financial Action Task Force

The FATF is the intergovernmental body that sets global standards for combating money laundering. Its 40 Recommendations form the basis of all national AML legislation. For the gaming sector, the following stand out:

• Recommendation 10: Customer Due Diligence (CDD) — mandatory identity verification
• Recommendation 12: PEP Screening — Politically Exposed Persons verification
• Recommendation 20: Suspicious Transaction Reports (STR/SAR)
• Recommendation 22: Application of CDD to DNFBPs (including casinos and gaming operators)

EU 6AMLD — 6th Anti-Money Laundering Directive

The EU's 6AMLD represents the world's most rigorous AML framework. Although Curaçao is not an EU member, the directive directly influences the island's regulations, especially because many Curaçao-licensed operators serve European players. Key points:

• Crime harmonization: Unified list of 22 money laundering offenses as predicate crimes
• Corporate liability: Companies can be held criminally liable, not just administrative fines
• Harsher penalties: Minimum of 4 years imprisonment for money laundering convictions
• International cooperation: Obligation to cooperate with authorities in other countries during investigations

Curaçao — LOD and GCB

Curaçao's new Landsverordening op de Kansspelen (LOD) has completely modernized the island's AML/KYC framework, aligning it with international standards:

• Mandatory AML program: Every licensed operator must maintain a documented AML program approved by the GCB
• Dedicated Compliance Officer: Obligation to designate a qualified AML Compliance Officer
• Real-time monitoring: Automated transaction monitoring systems are mandatory
• FIU reporting: Suspicious transactions must be reported to Curaçao's Financial Intelligence Unit
• Annual audits: The AML program must be audited annually by an independent entity

3. AML Requirements for iGaming Operators

An effective AML program for iGaming operators must include the following fundamental components:

Customer Due Diligence (CDD)

CDD is the standard verification process applied to all players. It involves:

• Identity verification before allowing deposits above defined thresholds
• Residential address verification
• Screening against international sanctions lists (OFAC, EU, UN)
• PEP (Politically Exposed Persons) screening
• Player risk assessment based on profile and behavior

Enhanced Due Diligence (EDD)

EDD is an elevated level of verification applied to high-risk players, including:

• High-value players: Accumulated deposits exceeding EUR 2,000 in any period
• PEPs and relatives: Politically Exposed Persons and their close relatives or known associates
• High-risk countries: Players from jurisdictions on the FATF grey or black list
• Atypical behavior: Gaming or transaction patterns that deviate significantly from the player's profile

EDD includes in-depth verification of the source of funds, intensified transaction monitoring, and periodic reviews of the player's profile.

Suspicious Activity Reports (SARs)

When suspicious activity is detected, the operator is legally obligated to submit a SAR to the competent financial intelligence unit. Characteristics of an effective SAR:

• Timeliness: Must be submitted without delay after the suspicion is detected
• Completeness: Detailed information about the player, transaction, and reason for suspicion
• Confidentiality: The player must not be informed that a SAR has been submitted (tipping-off is a crime)
• Documentation: All SARs must be archived internally for a minimum of 5 years

Record keeping

Operators must maintain complete records of all transactions, KYC verifications, and due diligence decisions for a minimum period of 5 years after the end of the relationship with the player. This includes:

• Identification and verification documents
• Complete transaction history (deposits, withdrawals, bonuses)
• Records of alerts and internal investigations
• Copies of submitted SARs
• Staff training records

Staff training

Curaçao's GCB requires all relevant employees to receive AML/KYC training at least quarterly. The training must cover:

• Identification of suspicious activities and money laundering typologies
• Internal escalation and reporting procedures
• Regulatory updates and new threats
• Individual responsibilities under AML legislation

4. KYC Process: The 3 Levels of Verification

The KYC process for iGaming operators is structured in 3 progressive levels of verification, each triggered by specific criteria:

Level 1 — Identity Verification

The first level is mandatory for all players before allowing significant deposits or withdrawals. It includes:

• Identity document: Passport, national ID card, or driver's license with photo
• Facial recognition: Live selfie or video compared with the document photo via biometrics
• Age verification: Confirmation that the player is 18 years or older
• Document validation: Automated verification of authenticity, validity, and fraud detection

Deadline: Must be completed within 72 hours of registration, or before the first withdrawal (whichever comes first).

Level 2 — Address Verification

The second level confirms the residential address declared by the player. Accepted documents:

• Utility bill: Water, electricity, gas, or internet (issued within the last 3 months)
• Bank statement: Official bank statement with visible address (last 3 months)
• Official correspondence: Letter from a government agency or financial institution
• Proof of residence: Official residency document issued by local authority

When triggered: Mandatory when accumulated deposits exceed EUR 1,000 or before the first withdrawal over EUR 500.

Level 3 — Source of Funds Verification

The third level is the most rigorous verification, applied to high-value players or elevated risk situations:

• Proof of income: Pay stub, tax return, or employment contract
• Detailed bank statements: Last 3–6 months showing the origin of deposited funds
• Asset documentation: Property deeds, investment certificates, sale contracts
• Source of wealth declaration: Detailed form explaining the origin of the player's wealth

When triggered: Mandatory when accumulated deposits exceed EUR 2,000, for all PEPs, or when requested by the compliance officer following a risk analysis.

5. Transaction Monitoring and Alerts

Transaction monitoring is the heart of any effective AML program. Curaçao's GCB requires operators to implement real-time monitoring systems capable of automatically detecting and alerting on suspicious activities.

Real-time monitoring systems

An effective monitoring system must analyze:

• Transaction velocity: Rapid deposits followed by withdrawals without significant gaming activity
• Structuring (smurfing): Multiple small deposits to avoid reporting thresholds
• Profile inconsistency: Activity incompatible with declared income or the player's profile
• Geolocation: Access from inconsistent locations or use of VPNs to hide real location
• Payment methods: Use of multiple methods or third-party accounts for deposits

Threshold alerts

Operators must configure automatic alerts for the following minimum thresholds:

Pattern detection

In addition to threshold alerts, advanced systems use artificial intelligence and machine learning to detect suspicious behavioral patterns:

• Layering pattern: Funds moved between multiple games or accounts before withdrawal
• Offsetting bets: Player bets on all possible outcomes to convert money
• Minimal play: Player deposits a large amount, places minimum bets, and requests withdrawal
• Atypical spikes: Sudden and significant increase in betting volume without justification

Reporting obligations

When suspicious activity is confirmed, the operator must:

1. Document all evidence internally
2. Submit a SAR to Curaçao's FIU without delay
3. Not alert the player about the investigation (anti-tipping-off)
4. Consider account blocking or transaction restrictions, as directed by the FIU
5. Maintain investigation records for a minimum of 5 years

6. Compliance Checklist: 22 Essential Points

Use this comprehensive checklist to ensure your iGaming operation meets all AML/KYC compliance requirements demanded by the GCB and international best practices:

Tip: We recommend conducting an initial gap analysis based on this checklist before starting implementation. This allows you to prioritize the most critical areas and allocate resources efficiently.

7. Compliance Tools and Technologies

Implementing AML/KYC compliance manually is unfeasible for modern iGaming operations. Automated tools are essential to scale verification without compromising the player experience.

Leading KYC/AML providers

Total automated compliance cost

Investment in automated compliance tools varies depending on player volume, but the average cost for a startup-level operator is:

• Automated KYC: EUR 3,000–8,000/year (based on verification volume)
• Transaction monitoring: EUR 2,000–5,000/year (depending on number of transactions)
• PEP and sanctions screening: EUR 1,000–3,000/year (included in many KYC platforms)
• Crypto AML (if applicable): EUR 5,000–15,000/year (blockchain analysis)
• Estimated total: EUR 5,000–10,000/year for startup-level operators

Compared with manual compliance teams, automated tools reduce operational costs by up to 60% while increasing verification accuracy and speed. Additionally, automation generates complete audit trails, facilitating accountability to regulators.

8. Requirements Comparison by Jurisdiction

AML/KYC requirements vary significantly across major iGaming jurisdictions. See how Curaçao compares:

Analysis: Curaçao offers an AML/KYC framework aligned with international standards, yet with significantly lower implementation costs than Malta or the UK. The jurisdiction is particularly attractive for operators accepting cryptocurrencies, thanks to clear Crypto AML regulations — something the UKGC simply does not allow.