Sanctions and politically exposed person screening have always sat at the heart of gaming compliance, but 2025 has brought a sharper regulatory focus on how operators actually execute these checks, not just whether they have a policy that says they do them. Regulators across the UK, Malta, the Netherlands and other key licensing jurisdictions have made clear that good-faith effort is no longer sufficient: operators need demonstrable, real-time processes with documented outcomes.
What Has Changed in 2025
More Frequent Sanctions List Updates
The pace of geopolitical change has pushed OFAC, the UK Office of Financial Sanctions Implementation and EU sanctions authorities to issue consolidated list updates far more frequently than in previous years. Where quarterly or monthly reconciliation cycles were once considered acceptable by many compliance teams, regulators now expect screening systems to consume updated lists within hours of publication. Operators relying on batch-file integrations with legacy KYC vendors should audit whether those vendors are pushing daily or intraday refreshes.
PEP Definition Broadening
Several jurisdictions have expanded their working definitions of politically exposed persons to include mid-tier regional officials, board members of state-owned enterprises, and close associates of domestic PEPs, not just foreign heads of state or senior ministers. This matters operationally because it increases the volume of players who trigger enhanced due diligence workflows. Operators who built their risk-scoring models around a narrow PEP definition need to revisit those parameters and re-screen existing customer books against updated databases.
Regulatory Scrutiny of False-Negative Rates
Supervisory bodies in Malta and the Netherlands have begun asking operators to evidence their false-negative rates, meaning how often a sanctioned individual or PEP passes through screening undetected. This is a meaningful shift from auditing whether a process exists to auditing whether the process is effective. If your screening tool uses fuzzy-matching thresholds that are set too conservatively to reduce alert fatigue, you may be creating regulatory exposure at the same time.
Practical Implications for Operators
- Real-time list consumption: Confirm with your KYC or identity-verification vendor that sanctions list updates are applied within four hours of official publication, and obtain written confirmation of their SLA on this point.
- Re-screening obligations: Your AML policy should specify how often existing customers are re-screened against updated lists. Monthly is increasingly regarded as a minimum; higher-risk segments warrant weekly or even event-triggered rescreens.
- PEP database coverage: Not all commercial PEP databases cover the same jurisdictions or tiers of seniority. Cross-reference your primary vendor with at least one supplementary source for geographies where your player base is concentrated.
- Alert calibration: Document the logic and thresholds behind your fuzzy-matching configuration. If you adjust settings to reduce alert volume, record the business rationale and have your MLRO sign off on the change.
- Escalation timelines: Where a sanctions match is confirmed, most licensing jurisdictions require a report to the relevant financial intelligence unit within a defined window. Ensure your internal escalation chain can meet that deadline, including during weekends and public holidays.
The Operational Reality Most Operators Underestimate
Screening technology is only as useful as the human and procedural layer around it. Vendors sell tools; regulators judge processes. An operator can have a best-in-class API integration but still receive a regulatory finding if the compliance team cannot explain how a specific alert was reviewed, by whom, when, and what conclusion was reached. Case management documentation, therefore, is not a nice-to-have: it is the audit trail that determines whether a finding becomes a fine.
Regulators are no longer satisfied by a vendor contract and a compliance policy. They want to see the decision log that proves your team reviewed the alert, applied judgment, and reached a defensible outcome.
Where OnlineShine Fits In
As a managed-services partner for iGaming operators, OnlineShine provides MLRO support and AML framework reviews that specifically address screening configuration, re-screening cadence and alert-management documentation. For operators who lack an in-house compliance function or who need to stress-test their existing setup against current regulatory expectations, an independent review against the 2025 supervisory benchmarks is a practical starting point. The cost of a gap analysis is substantially lower than the cost of a remediation order or licence condition.
