Regulatory audits rarely arrive with generous notice, and the operators who fare best are those who treat audit readiness as a continuous operational state rather than a last-minute scramble. The 90-day roadmap below gives compliance officers and casino operators a structured, milestone-driven approach to closing documentation gaps, stress-testing controls, and presenting a coherent compliance narrative to any licensing authority.
Why 90 Days Is the Right Planning Horizon
Three months is long enough to remediate systemic gaps but short enough to maintain urgency. Most licensing bodies, including the Malta Gaming Authority, the UK Gambling Commission, and Curacao's new Curacao Gaming Authority, reserve the right to conduct an audit on relatively short notice. Operators who begin preparation only after receiving an audit letter are already behind. A rolling 90-day readiness cycle ensures controls are tested, staff are trained, and records are current at any given moment.
Days 1 to 30: Discovery and Gap Analysis
Conduct an Internal Compliance Inventory
Start by cataloguing every policy, procedure, and control currently in place. This includes your AML and CTF programme, responsible gambling framework, player verification workflows, data protection records, and any third-party supplier agreements. Assign ownership to each document and record the last review date.
- Identify policies that have not been reviewed within the past 12 months.
- Flag any procedures that reference superseded regulatory guidance.
- Map your data flows against your current privacy notices and data processing agreements.
- Confirm that your MLRO appointment is formally documented and that the role holder meets the regulator's fit-and-proper requirements.
Run a Shadow Audit
Engage an independent reviewer, whether an external consultant or a senior compliance professional from outside your immediate team, to replicate the questions a regulator is likely to ask. Common focus areas include the quality of your suspicious activity reports, the calibration of your transaction monitoring rules, and the completeness of your customer due diligence files. Document every finding with a priority rating and an assigned owner.
Days 31 to 60: Remediation and Control Strengthening
Close Policy Gaps and Update Procedures
Work through the gap analysis findings in priority order. High-risk gaps, such as missing enhanced due diligence records for politically exposed persons or undocumented source-of-funds decisions, must be resolved before anything else. Mid-priority issues, like outdated training materials or incomplete board sign-off on policy revisions, can be scheduled across this phase.
- Rewrite or update all flagged policies and obtain formal sign-off from senior management or the board.
- Refresh staff training and record completion with dated evidence.
- Test your transaction monitoring thresholds against a sample of historical player data to confirm they are appropriately calibrated.
- Verify that your KYC provider's data outputs are stored in a format your compliance team can retrieve and present quickly.
Organise Your Evidence Architecture
Regulators expect to receive requested documents promptly, often within 24 to 48 hours of a request. Build a structured evidence repository, whether a dedicated compliance folder hierarchy or a purpose-built GRC platform, so that any file can be located without a cross-departmental search. Index documents by category, version, and approval date.
Days 61 to 90: Testing, Rehearsal, and Ongoing Monitoring
Run Live Control Tests
Create a set of test scenarios that mirror known regulatory examination techniques. This includes submitting synthetic player profiles at different risk levels to verify that your onboarding triggers fire correctly, and reviewing a random sample of active accounts to confirm ongoing monitoring is functioning as documented. Record the results formally; a regulator may ask to see evidence that you test your own controls.
Conduct a Pre-Audit Rehearsal
Brief your senior team on the audit process itself, including who speaks to whom, how information requests are logged, and how escalation decisions are made during an inspection. Designate a single point of contact for the regulator and ensure deputies are named. Run at least one tabletop exercise in which your team responds to a simulated information request under time pressure.
Audit readiness is not a destination. It is a documented, tested, and continuously monitored operational posture that a regulator can observe at any point in your licence cycle.
Establish a Maintenance Cadence
Once the 90-day cycle closes, lock in a quarterly review schedule so the process repeats automatically. Assign the next shadow audit date before the current cycle ends. Monitor regulatory publications, licence condition updates, and enforcement decisions relevant to your jurisdiction so that emerging requirements enter your gap analysis immediately rather than six months after publication.
Where OnlineShine Fits In
Our managed compliance service provides operators with an experienced MLRO function, structured gap analysis, and evidence-repository design that can be deployed at any point in the 90-day cycle. Whether you are starting from a clean baseline or recovering from a previous regulatory finding, we work within your existing operational structure to close gaps efficiently and build a compliance posture that holds up under scrutiny.
