An AML/CFT manual is not a formality you file and forget. Regulators across Malta, Gibraltar, the Isle of Man and the Netherlands now scrutinise whether a manual is genuinely operational, meaning staff use it, management reviews it and it evolves with the business. If your current document is a generic template gathering dust, the checklist below gives you a structured way to rebuild it into something defensible before your next audit or licence renewal.
Why the Manual Matters More Than Ever
Gambling operators remain a primary target in national risk assessments. The FATF has repeatedly flagged the sector for exposure to proceeds of crime, particularly through high-volume depositors, bonus abuse networks and crypto funding channels. A regulator that finds gaps between your written policy and your actual controls will treat that gap as an aggravating factor in any enforcement action. A well-constructed manual closes that gap by making your risk appetite, your controls and your escalation paths explicit and testable.
The Core Sections Every Manual Must Include
1. Business Risk Assessment
Your manual should open with a documented risk assessment that covers your player demographics, funding methods, geographic footprint and product mix. This is not a one-time exercise. Schedule a formal review at least annually, and trigger an ad hoc review whenever you add a new payment method, enter a new market or experience a significant change in player volume. Link every subsequent control in the manual back to the risk ratings you establish here.
2. Governance and Accountability
Name your Money Laundering Reporting Officer (MLRO) explicitly, together with their deputy. Document the reporting line to senior management and the board. Specify how often the MLRO reports upward, what metrics are included and how the board formally acknowledges those reports. Regulators want to see that compliance is not siloed inside the operations team.
3. Customer Due Diligence and KYC Procedures
- Define your standard CDD triggers: registration, first deposit, reaching a cumulative deposit threshold and returning after a dormancy period.
- Define your Enhanced Due Diligence (EDD) triggers: politically exposed persons (PEPs), high-value players, unusual source-of-funds patterns and players from higher-risk jurisdictions.
- Document acceptable identity evidence, verification tools and the maximum time allowed before account restrictions apply if verification is incomplete.
- Include a simplified due diligence section where your licence permits lower-risk exemptions, but cap those exemptions with hard deposit limits.
4. Transaction Monitoring Rules
List the specific scenarios your transaction monitoring system is configured to flag. Common rules include: structuring below reporting thresholds, rapid deposit-and-withdrawal cycles, sudden increases in deposit frequency and use of multiple payment methods in a short window. For each rule, document the threshold value, the alert priority and the review workflow. Avoid vague language such as "unusual activity"; regulators expect quantified triggers.
5. Suspicious Activity Reporting
Your manual must describe the full SAR lifecycle: who raises a suspicion, how it reaches the MLRO, the tipping-off prohibition, the decision to file or not to file, and your record-keeping obligations after filing. Include template escalation forms so that frontline staff have no ambiguity about what information to capture.
6. Record-Keeping
State clearly which records are retained, in what format, for how long and who has access. Most EU-aligned regimes require a minimum of five years from the end of the business relationship. Cloud storage is acceptable provided you can produce records promptly on regulatory request.
7. Training and Competency
Document your training schedule by role. Customer support agents, payments staff and the MLRO each need different training depth. Record completion, test scores and refresh cycles. If a regulator asks whether your team can recognise structuring, you need evidence, not assertions.
This Week's Action Items
- Pull your current manual and check whether each section above exists and is dated within the last twelve months.
- Confirm your MLRO contact details are current and that their appointment is formally documented with your regulator.
- Test one transaction monitoring rule end-to-end to verify that an alert actually reaches a reviewer.
- Check that your KYC thresholds match the current version of your licence conditions, not an older iteration.
- Schedule a thirty-minute management briefing to present the most recent MLRO report summary.
At OnlineShine, our MLRO-as-a-Service team conducts gap analyses against jurisdiction-specific AML frameworks and rebuilds manuals that pass regulatory scrutiny. A defensible manual is not lengthy, it is precise, current and evidenced.
Common Mistakes to Avoid
Operators frequently copy manuals from peer operators without adjusting the risk ratings for their own player base. Others set transaction monitoring thresholds in the system but never document them in the manual, creating a disconnect that examiners notice immediately. A third common failure is treating training as a checkbox rather than a competency exercise: if your staff cannot explain what smurfing means, your training record is irrelevant.
Building a compliant AML/CFT manual takes focused effort over a few days, not months. Start with the structure above, assign owners to each section and set a deadline for the first complete draft. Regulators reward operators who demonstrate proactive, documented compliance over those who react only when a deficiency notice arrives.
