An anti-money laundering and counter-financing of terrorism manual is not simply a regulatory checkbox. For online casino operators, it is the operational backbone that determines how your team identifies suspicious activity, protects the business from regulatory sanction, and demonstrates genuine compliance culture to licensing authorities. If you are building one for the first time, this guide sets out the core concepts and practical components you need.
What AML/CFT Actually Means
Anti-money laundering, abbreviated as AML, refers to the policies, controls and procedures a business uses to detect and prevent criminals from disguising illegally obtained funds as legitimate income. Counter-financing of terrorism, abbreviated as CFT, addresses the parallel obligation to prevent funds, whether clean or dirty, from being channelled to terrorist activity. Regulators treat these two risk areas together because they share many of the same detection mechanisms.
In the iGaming context, money laundering typically involves a player depositing proceeds of crime, generating apparent winnings through gameplay, and then withdrawing funds that appear to originate from a licensed gambling platform. The casino becomes an unwitting vehicle for the scheme if adequate controls are not in place.
Why a Written Manual Is a Regulatory Requirement
Most jurisdictions that issue online gambling licences require operators to maintain a documented AML/CFT policy or manual. The Financial Action Task Force, the global standard-setter for AML, expects businesses in the gambling sector to adopt a risk-based approach and to record that approach in writing. Regulators in Malta, Gibraltar, the Isle of Man, Curacao and across Europe all expect to inspect a live, version-controlled document during audits. A manual that has never been updated since the licence application date is itself a compliance red flag.
Core Components of an Online Casino AML/CFT Manual
1. Scope and Governance
Open the manual by defining which legal entities, brands and jurisdictions it covers. Identify the Money Laundering Reporting Officer, commonly called the MLRO, by name and role. This person holds statutory responsibility for internal suspicious activity reports and for making external disclosures to the relevant financial intelligence unit. The manual should also describe the escalation path so that any member of staff knows exactly who to approach with a concern.
2. Risk Assessment Framework
The risk-based approach requires you to assess and document the specific money laundering and terrorism financing risks your operation faces. Relevant risk factors include the jurisdictions your players come from, the payment methods you accept, your average deposit and withdrawal volumes, and your product types. A sportsbook carries different risk characteristics than a high-stakes live casino. Your manual must explain how you score and categorise these risks and how that scoring feeds into your customer due diligence decisions.
3. Customer Due Diligence Procedures
Customer due diligence, known as CDD, is the process of verifying that players are who they claim to be. Standard CDD typically involves confirming identity and address through official documents. Enhanced due diligence, or EDD, applies when a player presents elevated risk, for example a politically exposed person, a player from a high-risk jurisdiction, or someone transacting at unusually high volumes. The manual must specify the triggers for each level of diligence and the documents or data points required to satisfy each level.
4. Transaction Monitoring
Your manual should describe the systems and rules used to flag unusual financial behaviour. Common indicators in online gambling include rapid deposit and withdrawal cycles with minimal play, structuring deposits just below reporting thresholds, use of multiple payment methods, and sudden spikes in activity that are inconsistent with a player's established profile. Detail how alerts are reviewed, who reviews them, and what the timelines are for escalation and resolution.
5. Suspicious Activity Reporting
Set out the internal reporting process clearly. When a staff member suspects money laundering or terrorist financing, they submit an internal suspicious activity report to the MLRO. The MLRO then evaluates the report and decides whether to file an external disclosure with the relevant authority. Your manual must include the forms used, the retention requirements for those records, and the tipping-off prohibition, which forbids informing a subject that a report has been made about them.
6. Staff Training Requirements
A manual is only as effective as the people implementing it. Document how frequently training is conducted, what topics are covered, and how completion is recorded. New staff should receive AML/CFT training before handling player accounts. Existing staff should receive refresher training at least annually, and immediately following any significant regulatory change.
7. Record Keeping
Most licensing regimes require AML-related records to be retained for a minimum of five years. Your manual should specify exactly what records must be kept, in what format, and where they are stored. This includes CDD documents, transaction records, internal reports and training logs.
Keeping the Manual Current
Regulation evolves continuously. Schedule a formal review of the manual at least once per year, and trigger an ad-hoc review whenever a licensing regime updates its AML requirements, your business enters a new market, or your product offering changes significantly. Version control every update with a date and the name of the approving officer.
At OnlineShine, our MLRO-as-a-service model means operators gain a qualified, experienced reporting officer without the overhead of a full-time hire, supported by documentation frameworks that are already structured to satisfy the audit expectations of major licensing jurisdictions.
Building this manual well from the outset is considerably less costly than remedying deficiencies identified during a regulatory inspection. Treat it as a living operational document rather than a static filing requirement, and it will serve as a genuine management tool for your compliance programme.
