Sanctions screening and politically exposed person checks sit at the core of every iGaming compliance programme, yet the precise requirements, risk appetite and operational mechanics vary considerably depending on whether you run a licensed casino, a sportsbook, a sweepstakes platform or a crypto-native gaming product. Getting the calibration wrong in any direction creates real exposure: regulatory fines, payment processing suspension or reputational damage that is difficult to reverse.
Why Vertical Context Changes the Risk Calculation
All four verticals must screen players against sanctions lists such as OFAC, the UN Consolidated List, the EU Consolidated List and the UK Financial Sanctions Register. The legal obligation is largely the same. What differs is the customer journey, the deposit method, the average transaction size and the regulatory body that scrutinises the outcome. Those variables shape how frequently screening must run, how automated it can safely be and how much human review is appropriate before a match is escalated.
Licensed Casino Operators
Traditional online casino operators working under MGA, UKGC or Curacao licences face the most prescriptive screening environment. Regulators expect real-time sanctions checks at registration, at each login in some jurisdictions, and whenever a player crosses a predefined deposit or withdrawal threshold. PEP screening in this vertical must capture not only Class 1 heads of state but also Class 2 senior public officials and their close associates, because high-value recreational gamblers frequently include individuals in public-sector adjacent roles.
- Run automated screening at onboarding against a minimum of three recognised sanctions databases.
- Apply enhanced due diligence for any PEP match, regardless of deposit level, and document the rationale for accepting or declining the relationship.
- Re-screen the full active player base whenever a new sanctions designation is published, not only on fixed monthly cycles.
Sportsbook Operators
Sportsbooks share the same licensing environment as casinos in most jurisdictions but face two additional considerations. First, the volume of accounts is typically higher and transaction frequency is greater, which makes manual review pipelines impractical. Second, in-play betting means funds can be committed, settled and withdrawn within minutes. This compresses the window for intervention if a sanctions hit emerges mid-session. Operators should ensure their screening vendor supports API-based checks that return results in under two seconds so that in-play wager acceptance is not affected by compliance latency.
PEP risk in sportsbook operations is often underestimated. Sponsorship relationships, affiliate arrangements and VIP hospitality programmes all create indirect PEP exposure that goes beyond the standard player screening workflow.
Sweepstakes Platforms
Sweepstakes operators occupy a legally distinct space, particularly in the United States, where players purchase coins or entries rather than gambling directly with money. The argument sometimes made is that reduced financial risk means reduced AML obligation. Regulators and payment processors are increasingly rejecting this interpretation. OFAC compliance is a US government requirement that applies to any business touching US persons, regardless of whether gambling law applies to the product. Sweepstakes operators must screen for sanctions and should apply a proportionate PEP process, particularly because the customer base is US-centric and the OFAC SDN list is the primary relevant instrument.
- Screen at account creation and at any point a player redeems prizes above a defined threshold.
- Maintain a written sanctions compliance policy even if you operate under a sweepstakes model rather than a gambling licence.
- Coordinate with your payment processor on their own screening expectations, as many processors impose contractual screening obligations independently of local law.
Crypto Gaming Operators
Crypto-native casinos and gaming platforms face the widest sanctions surface area. Blockchain transactions create jurisdiction ambiguity: a wallet address does not carry a nationality flag, and players routinely use mixers or privacy coins to obscure the origin of funds. OFAC has sanctioned specific wallet addresses, not only individuals or entities, which means crypto operators must screen both counterparty identities and wallet addresses against published address lists.
PEP screening is complicated by the pseudonymous onboarding many crypto platforms have historically offered. Regulators in the EU, under the forthcoming MiCA framework, and in markets like Malta and Gibraltar are moving toward full KYC requirements for crypto gaming, which will align the standard closer to that of licensed casinos. Operators who have not yet built a PEP workflow around wallet-linked identity verification should treat this as a near-term priority.
Building a Cross-Vertical Screening Programme
For operators running multiple verticals under one holding group, the most efficient approach is a centralised compliance function that maintains a single customer risk record updated across all products. Screening logic can then be applied at the group level with vertical-specific thresholds layered on top. This prevents a sanctioned individual from accessing one product after being blocked on another and reduces the duplication of vendor costs.
A compliance programme that treats each vertical in isolation will always have blind spots at the edges. The most resilient operators build a unified customer risk view first and apply product-specific rules on top of it.
