An AML/CFT manual is the operational backbone of a licensed online casino's compliance programme. Yet regulators across Malta, Gibraltar, the Isle of Man and Curacao continue to issue sanctions against operators whose manuals look thorough on paper but collapse under scrutiny. Based on our experience supporting casinos through licensing audits and regulatory inspections, the problems tend to cluster around the same avoidable mistakes.
Mistake 1: Treating the Manual as a One-Time Document
The most frequent error we see is a manual that was drafted at licensing stage and never meaningfully updated. Financial crime typologies shift constantly. New payment methods, evolving sanctions lists and updated FATF guidance all require corresponding revisions to your procedures. Regulators expect to see version control, a dated review log and evidence that senior management signed off on each revision. A manual with a single creation date and no amendment history signals to an inspector that compliance is treated as a box-ticking exercise rather than a living practice.
A practical fix is to schedule a formal quarterly review, assign ownership to the MLRO, and document what was reviewed even when no changes were made. The audit trail matters as much as the content itself.
Mistake 2: Copy-Paste Risk Assessments
A business-wide risk assessment is not a template you download and personalise with your logo. It must reflect your actual player base, your active markets, the payment channels you accept and the products you offer. Generic language about "high-risk jurisdictions" without a defined methodology for how you classify those jurisdictions will not satisfy an MLRO review or a regulatory inspection.
Your risk assessment should map specific risk categories, assign scoring criteria and link each risk to a documented control. When the assessment changes because you added a new payment method or entered a new market, that change needs to be recorded formally and reflected in your customer due diligence thresholds.
Mistake 3: Vague Customer Due Diligence Triggers
Many manuals describe CDD and enhanced due diligence in broad terms without specifying the precise thresholds, triggers and timelines that staff must follow. Phrases like "large transactions" or "unusual behaviour" are not operational instructions. Frontline compliance staff and your platform's automated rules engine both need concrete parameters.
- Define monetary thresholds for standard CDD, enhanced CDD and source-of-funds requests in your base currency.
- List specific behavioural indicators that trigger a review, such as deposit velocity patterns, rapid withdrawal requests after minimal play or multiple failed payment attempts.
- Set maximum timeframes within which each review stage must be completed and escalated.
- Document what happens when a player does not respond to a CDD request within the defined window.
Mistake 4: Inadequate SAR and Internal Reporting Procedures
The suspicious activity reporting chain is often described too loosely. Staff need to know exactly how to escalate a concern internally, what information to include, how quickly to act and critically, that they must not tip off the customer. Your manual should contain a step-by-step internal reporting flowchart and clarify the MLRO's decision timeline for submitting an external SAR to the relevant financial intelligence unit.
Equally important is documenting what happens after a SAR is filed. Can the account continue to operate? Who authorises that decision? These questions must have written answers.
Mistake 5: Missing or Superficial Staff Training Records
A regulator reviewing your manual will also ask to see training records. If your manual references annual AML training but your records show patchy attendance, outdated materials or no assessment of comprehension, the manual's credibility is undermined. Training must cover typologies relevant to your specific products, not generic financial crime awareness content.
Building a Manual That Withstands Scrutiny
A defensible AML/CFT manual is precise, product-specific and maintained actively. It connects your risk assessment to your controls, your controls to your monitoring logic and your monitoring logic to your reporting chain. Every element should be traceable. Regulators are not looking for perfect compliance; they are looking for evidence that you understand your risks and manage them systematically.
A manual written for a regulator is not the same as a manual written for your operations team. The strongest programmes produce a single document that serves both purposes simultaneously.
At OnlineShine, our MLRO and compliance team works with operators to audit existing manuals, identify gaps against current regulatory expectations and rebuild procedures that are both audit-ready and operationally practical. If your manual has not been reviewed in the past twelve months, that review is overdue.
