Source of wealth and source of funds checks are among the most scrutinised areas in iGaming AML enforcement right now. Regulators across the UK, Malta, Gibraltar and the Netherlands are routinely citing deficient high-roller due diligence in licensing decisions, fines and formal warnings. If your compliance team cannot articulate a clear, documented process for these checks, you are exposed. The checklist below is designed to be actionable this week, not in the next compliance cycle.
Understanding the Difference: Source of Funds vs. Source of Wealth
These two terms are related but distinct, and conflating them is a common operator error that regulators notice immediately.
- Source of funds (SOF) refers to the specific origin of the money a player deposits into their account. A salary payment, a property sale or a dividend transfer are all examples.
- Source of wealth (SOW) refers to the broader picture of how a player accumulated their total net worth over their lifetime. This includes career history, business ownership, inheritance and investment portfolios.
A player may have a legitimate source of funds for a single deposit but still present an unexplained wealth profile overall. Both layers require independent verification at enhanced due diligence (EDD) level.
When to Trigger the Checks
Operators often wait too long before escalating to EDD. Your risk-based policy should define clear thresholds, but the following triggers should prompt immediate review regardless of cumulative deposit levels:
- A single deposit or a series of deposits within 30 days that exceeds your internal EDD threshold (commonly set between 2,000 and 5,000 EUR, depending on your licence jurisdiction).
- Rapid escalation in bet sizes or deposit frequency that is inconsistent with a player's stated occupation or prior behaviour.
- Any suspicious transaction report (STR) flag raised by your platform or payments team, even if the amount is below threshold.
- A player who withdraws large amounts without proportionate play, suggesting a potential layering pattern.
- Inconsistencies between a player's stated profession and their observed spending capacity.
The Operator Checklist: Steps to Complete This Week
1. Review and Segment Your High-Roller Cohort
Pull a report of all players who have deposited above your EDD threshold in the last 90 days. Segment them by those who have completed full SOW documentation versus those with gaps or expired records. Any player in the gap category should receive an outreach communication within five working days.
2. Define Acceptable Evidence for Each Income Type
Your compliance team needs a documented evidence matrix. Common income types and acceptable proof include:
- Employment: recent payslips covering at least three months, plus an employer confirmation letter if deposits are unusually high relative to salary.
- Business ownership: latest filed company accounts, directorship confirmation and, where necessary, management accounts.
- Property sale: solicitor completion statement or land registry document.
- Inheritance: grant of probate and solicitor correspondence confirming the amount received.
- Investment income: brokerage account statements showing liquidation or dividend history.
3. Apply a Proportionality Standard
Documentation requests should be proportionate to the risk presented. A player depositing 3,000 EUR from a clearly documented salary does not require the same depth of scrutiny as a player depositing 50,000 EUR with a vague claim of being a consultant. Over-requesting from low-risk players damages retention; under-requesting from high-risk players creates regulatory liability.
4. Set a Response Deadline and a Suspension Protocol
Your policy must specify how long a player has to provide documentation before their account is restricted. Fourteen calendar days is a common industry standard. If a player fails to respond or provides documents that cannot be verified, account suspension and an internal SAR review should follow automatically, not as a discretionary step.
5. Document Everything in the Player Record
Every decision made during an EDD review, including the rationale for accepting or rejecting evidence, must be recorded in the player's compliance file. Regulators expect to see a clear audit trail showing who reviewed the documents, on what date, and what conclusion was reached. A verbal sign-off that is not logged offers no protection during an inspection.
Common Failure Points Regulators Target
Based on published enforcement actions across multiple regulated markets, the most frequently cited failures in operator SOW and SOF processes include: accepting self-certification without documentary corroboration; failing to update SOW files when a player's deposit behaviour changes significantly; and treating EDD as a one-time event rather than an ongoing obligation. Periodic reviews of existing high-roller files should be built into your compliance calendar at least every 12 months, or sooner if risk indicators change.
Compliance is not a gate that players pass through once. For high-value accounts, it is a continuous relationship between your team and the risk profile of that individual.
How OnlineShine Supports Operators on EDD
Our MLRO and compliance team works with operators to build risk-based EDD frameworks that satisfy regulatory expectations without creating unnecessary friction for legitimate high-value players. From threshold calibration to evidence matrix design and ongoing file reviews, we provide managed compliance support that scales with your operation.
