Sanctions and politically exposed person (PEP) screening sit at the core of any credible AML programme. For iGaming operators, getting this right is not optional: regulators in the UK, Malta, the Netherlands and beyond treat screening failures as a primary audit trigger. This guide walks through the operational steps your compliance team needs to implement a screening framework that holds up to scrutiny.
Why Screening Failures Are So Costly
Fines for inadequate sanctions controls in the gaming sector have climbed steadily over the past three years. Beyond financial penalties, a publicised screening failure erodes player trust and can result in licence suspension. Regulators expect operators to demonstrate not just that screening tools are in place, but that they are configured correctly, updated in near-real time, and backed by documented escalation procedures.
Understanding the Two Categories
Sanctions Lists
A sanctioned individual or entity is one that is prohibited from transacting entirely. The primary lists that gaming operators must screen against include:
- OFAC (United States Treasury)
- HM Treasury Consolidated List (United Kingdom)
- EU Consolidated Sanctions List
- UN Security Council Consolidated List
- Local lists mandated by your licensing jurisdiction (for example, the Dutch Sanctions Act list maintained by the FIOD)
A match against a sanctions list requires immediate account freezing and, in most jurisdictions, mandatory reporting to the relevant financial intelligence unit before any action is communicated to the player.
Politically Exposed Persons
A PEP is an individual who holds or has held a prominent public function, such as a head of state, senior politician, senior judicial officer, or senior military official. Close family members and known associates are treated as PEPs by extension. Unlike a sanctions match, a PEP designation does not prohibit the relationship; it requires enhanced due diligence (EDD) and closer ongoing monitoring. The commercial risk is not the PEP status itself but the elevated corruption and bribery exposure that accompanies it.
Building Your Screening Workflow
Step 1: Choose a Fit-for-Purpose Data Provider
Free or static sanctions lists are inadequate for a live gaming operation. Choose a commercial data provider that aggregates and normalises lists from all relevant jurisdictions and pushes updates at least daily. Evaluate providers on list coverage, update frequency, match accuracy, and API reliability. Always run a proof-of-concept with anonymised real player data before going live.
Step 2: Define Your Matching Thresholds
Fuzzy matching is essential because names are transliterated differently across passports and databases. A threshold that is too tight will miss genuine hits; one that is too loose will drown your compliance team in false positives. Most operators find a starting threshold of around 85 percent similarity workable, but you should calibrate this against your actual player base. Document the rationale for whatever threshold you choose, because a regulator will ask for it.
Step 3: Map Screening to Your Customer Lifecycle
Screening must occur at three minimum points:
- Registration, before the account is fully activated
- On each deposit or withdrawal above your defined threshold
- Continuously in the background, because lists change and a player who was clean yesterday may be added to a list today
Ongoing screening, sometimes called retrospective or batch screening, is the most commonly overlooked element. Schedule it to run against your full active player base at least once every 24 hours.
Step 4: Build a Clear Escalation Matrix
Every alert needs a defined owner and a maximum response time. A typical escalation matrix looks like this:
- Potential sanctions hit: account suspended automatically, MLRO notified within one hour, no player communication until MLRO clears or instructs
- Potential PEP match: account flagged for manual review, EDD initiated within 24 hours, customer relationship paused pending review
- False positive confirmed: alert closed with documented rationale, account cleared, audit trail retained for five years
Step 5: Train and Test Regularly
Tools are only as effective as the people operating them. Run quarterly scenario-based training for your compliance and customer support teams. Conduct annual end-to-end testing of your screening system using synthetic test cases, and document the results. Regulators treat evidence of regular testing as a strong mitigating factor if an issue does arise.
Common Operational Pitfalls
- Screening only at registration and never again
- Using a single jurisdiction list when players are drawn from multiple markets
- Failing to screen beneficial owners and directors of corporate accounts
- Not retaining audit logs that prove when and how each alert was resolved
- Treating all PEP matches identically, regardless of the level of public function or the jurisdiction
A screening programme is only as strong as its documentation. If you cannot show a regulator exactly what happened with every alert, the alert might as well not have been raised.
How OnlineShine Supports Operators
OnlineShine provides managed MLRO and compliance services that include screening programme design, vendor selection support, escalation procedure drafting, and staff training. Our team works with operators across regulated European markets to ensure that sanctions and PEP controls meet regulatory expectations on day one and remain fit for purpose as lists and regulations evolve.
