Appointing a Money Laundering Reporting Officer is not a box-ticking exercise. For an iGaming operator, the MLRO sits at the intersection of regulatory licence conditions, financial crime prevention, and daily operational decisions. Getting the function right from day one requires a structured approach, and a 90-day roadmap is the most reliable way to move from appointment to a fully embedded compliance programme.
What an MLRO Actually Does in an iGaming Context
The MLRO is the individual accountable for receiving internal suspicious activity reports, evaluating them, and submitting Suspicious Activity Reports to the relevant financial intelligence unit, such as FIOD in the Netherlands or the NCA in Great Britain. Beyond that core duty, the MLRO owns the operator's AML and Counter-Terrorist Financing policies, oversees the Customer Due Diligence and Enhanced Due Diligence frameworks, liaises directly with the regulator on compliance matters, and provides the board with written risk assessments. In an iGaming setting, this role is complicated by high transaction volumes, anonymous payment instruments, and the cross-border nature of the player base.
Days 1 to 30: Foundation and Risk Assessment
The first month is about establishing authority and understanding the risk landscape the operator actually operates in, not a theoretical one.
- Formal appointment: Issue a board resolution naming the MLRO, define their reporting line (typically direct to board level), and notify the relevant regulator where required by licence conditions.
- Risk appetite statement: Work with the board to produce or update the Business-Wide Risk Assessment. This document must reflect the operator's specific player geographies, payment methods accepted, and product verticals such as live casino, sports betting, or poker.
- Gap analysis: Audit existing AML policies, CDD procedures, transaction monitoring rules, and SAR logs against current regulatory expectations. Document every gap as a numbered remediation item with an owner and a deadline.
- Regulatory mapping: Confirm which jurisdictions the operator holds licences in and calendar every reporting deadline, renewal date, and obligatory regulatory submission for the next 12 months.
Days 31 to 60: Policy, Controls, and Technology
Once the MLRO understands the risk profile, the focus shifts to building or overhauling the control environment.
- Policy suite: Produce or revise the AML/CFT Policy, CDD and EDD procedures, Politically Exposed Persons screening protocol, and the internal SAR submission process. Each document must carry a version number, an effective date, and the MLRO's sign-off.
- Transaction monitoring calibration: Review the rules set in the platform's transaction monitoring tool. iGaming-specific typologies, such as rapid deposit-withdrawal cycles, multi-account structuring, and bonus abuse used as a layering vehicle, must be reflected in alert thresholds.
- Third-party due diligence: Assess payment processor, affiliate, and software supplier relationships for AML exposure. Where enhanced due diligence is warranted, document the rationale.
- Staff training launch: Deliver role-specific AML training across customer support, payments, VIP, and finance teams. Training records must be retained for regulatory inspection.
Days 61 to 90: Embedding, Testing, and Reporting
The third phase converts policy into operational habit and produces the first compliance reporting cycle.
- SAR process dry run: Simulate an internal suspicious activity report from a frontline employee through to the MLRO's triage decision. Identify any procedural gaps before a live case arises.
- Management information framework: Define the monthly metrics the MLRO will present to the board: SAR volumes, CDD completion rates, EDD cases open, monitoring alerts reviewed versus escalated, and training completion percentages.
- First MLRO annual report: Even if only a partial-year report, draft the MLRO's written report to the board covering risk assessment findings, policy changes made, training delivered, and any regulatory communications received.
- Independent review: Commission an external compliance review or internal audit of the new framework before the 90-day window closes. Findings feed directly into the next quarter's remediation plan.
The Operational Reality Operators Underestimate
The MLRO role in iGaming demands genuine seniority and enough resource to function independently. A compliance officer asked to perform the MLRO function as a secondary duty alongside customer operations or legal work is a regulatory risk in itself. Regulators increasingly scrutinise whether the MLRO has unfettered access to transaction data, management, and the board. Operators who treat the appointment as a formality, rather than a structural investment, tend to discover this during enforcement reviews rather than during licence renewals.
A well-resourced MLRO who reports directly to the board, and who operates with documented authority over policy and escalation decisions, is one of the most cost-effective risk controls an iGaming operator can maintain.
Where OnlineShine Fits In
OnlineShine provides outsourced and fractional MLRO services to iGaming operators who need a credentialled, experienced compliance function without the overhead of a full internal hire. Our practitioners work within your operational systems, attend your board meetings, and produce the regulatory documentation your licence demands. The 90-day roadmap above reflects the exact sequence we follow when deploying compliance support for a new or remediation-stage operator.
