Every licensed online casino must maintain a documented AML/CFT manual that satisfies its regulator, survives an audit, and actually guides day-to-day decisions. The strategic question is not whether to have one, but who should produce it and who should keep it current. The three options, building in-house, purchasing a template, or outsourcing to a managed compliance partner, each carry distinct trade-offs in cost, quality, and operational risk.
What an AML/CFT Manual Must Cover
Before choosing a production route, operators need clarity on what the document must contain. At a minimum, regulators across Malta, Gibraltar, the Isle of Man, Curacao, and most European licensing jurisdictions expect the following:
- A risk appetite statement aligned with the business model and player base
- Customer due diligence and enhanced due diligence procedures, with decision trees for higher-risk profiles
- Source-of-funds and source-of-wealth verification thresholds and escalation paths
- Politically exposed persons screening and ongoing monitoring protocols
- Suspicious activity recognition criteria and internal reporting workflows to the MLRO
- Staff training requirements, frequency, and record-keeping obligations
- Record retention schedules, typically five years from the end of the business relationship
- Governance arrangements, including who owns the manual and how often it is reviewed
A manual that ticks regulatory boxes without connecting to your actual platform, payment methods, and player segments is a liability, not an asset. Regulators and examiners increasingly test whether procedures are genuinely embedded in operations.
Option One: Building In-House
Operators with an experienced MLRO on staff and an established compliance function sometimes choose to author the manual entirely from scratch. The advantages are clear: the document reflects exact workflows, integrates with proprietary systems, and ownership is unambiguous.
The costs are equally clear. Producing a comprehensive, regulator-ready manual typically takes a qualified MLRO between 60 and 120 hours of drafting, peer review, and legal sign-off. At senior compliance salaries common in iGaming, that represents a meaningful budget line before ongoing maintenance is considered. Jurisdictional updates, FATF guidance revisions, and regulatory circulars can each trigger partial rewrites. Without a dedicated team, in-house manuals drift out of date quickly, which is one of the most cited findings in regulatory inspections.
In-house development suits large operators with multiple licenses, complex group structures, and the internal bandwidth to sustain the document over time.
Option Two: Purchasing a Template
A growing number of legal consultancies and compliance vendors sell jurisdiction-specific AML/CFT manual templates for online gambling operators. Prices range from a few hundred euros for a basic framework to several thousand for a layered, multi-jurisdiction package.
Templates accelerate the starting point, but they introduce a risk that operators consistently underestimate: the gap between a generic framework and an auditable, operational procedure. Regulators expect a manual to describe your processes, your thresholds, your systems. A template that still contains placeholder text or references generic payment methods rather than your actual providers is worse than no template at all, because it signals that compliance is performative rather than embedded.
If a template is the chosen route, budget at least as much time customising it as you saved by not starting from scratch. Assign a named compliance officer to own every section.
Option Three: Outsourcing to a Managed Compliance Partner
Operators without a full-time MLRO, those launching in a new jurisdiction, or businesses scaling rapidly often find that outsourcing AML/CFT manual production and maintenance to a specialist partner delivers the best risk-adjusted outcome.
A reputable managed compliance provider contributes three things a template cannot: current regulatory intelligence, direct examiner experience, and accountability. At OnlineShine, our MLRO-as-a-Service approach means the manual is produced by practitioners who have authored documentation accepted by MGA, UKGC-adjacent structures, and Curacao eGaming, and who monitor regulatory change as a core function rather than an afterthought.
An outsourced manual should never feel generic. The partner's job is to translate regulatory requirements into your specific operational reality, not to deliver a document that could belong to any operator.
Ongoing maintenance is where outsourcing delivers compounding value. When FATF updates its guidance on virtual assets, when a jurisdiction amends its reporting thresholds, or when your platform adds a new payment channel, the manual is updated proactively rather than reactively.
Choosing the Right Route: A Decision Framework
Operators should assess four factors before deciding:
- Internal capacity: Is there a qualified MLRO who has time to own this fully, including ongoing maintenance?
- License complexity: A single-jurisdiction startup faces different documentation demands than a multi-license group.
- Speed to market: Outsourcing or a well-customised template typically reduces time to regulator submission by four to eight weeks compared to pure in-house drafting.
- Risk exposure: Higher-risk player segments, VIP programs, and crypto payment acceptance all elevate the cost of getting the manual wrong.
For most small to mid-size operators, a hybrid approach, outsourcing initial production and MLRO oversight while training internal staff to handle first-line monitoring, delivers the strongest balance of cost and compliance quality.
