Crypto deposits are now a standard feature at many iGaming brands, but accepting digital assets without a rigorous wallet screening process exposes operators to regulatory sanctions, banking relationship losses, and reputational damage. This guide sets out the practical steps every licensed crypto gaming operator should have in place by 2026.
Why Tainted Funds Are a Specific Risk in Crypto Gaming
Unlike traditional payment rails, blockchain transactions carry a visible, permanent history. Regulators and financial intelligence units can trace funds through multiple hops, meaning an operator who accepts a deposit that originated from a darknet market, ransomware wallet, or sanctioned address is potentially holding proceeds of crime, even if the depositing customer appears legitimate on the surface. Ignorance of provenance is not a defence under most licensing regimes, including those issued by the MGA, UKGC, and Curacao e-Gaming authority.
The practical consequence is clear: operators must treat wallet screening not as an optional enhancement but as a core component of the customer due diligence process, equivalent to ID verification or source-of-funds checks on fiat deposits.
Step One: Choose a Blockchain Analytics Provider
Several established vendors offer transaction monitoring APIs specifically built for crypto businesses. When evaluating a provider, operators should assess the following criteria:
- Coverage of chains: Bitcoin, Ethereum, Litecoin, USDT on Tron, and BNB Chain are the minimum for most casino operations in 2026.
- Risk scoring methodology: understand whether scores are rule-based, cluster-analysis-based, or a hybrid model, and how frequently the risk database is updated.
- Sanctions list integration: the tool must cross-reference OFAC, UN, EU, and HM Treasury lists in near real time.
- Exposure categories: look for granular categorisation covering mixers, peer-to-peer exchanges, gambling, darknet markets, and ransomware.
- API response time: screening should return a result in under two seconds to avoid disrupting deposit flows.
Step Two: Define Your Risk Appetite in a Screening Policy
Technology alone is not sufficient. Operators must document a written wallet screening policy that defines acceptable and unacceptable fund exposure levels. A practical framework uses three bands:
- Low risk (0 to 25 percent indirect exposure): deposit proceeds automatically, flag for routine monitoring.
- Medium risk (26 to 50 percent indirect exposure): hold the deposit pending a manual review by the MLRO or a nominated deputy, request source-of-funds documentation if the amount exceeds a defined threshold.
- High risk or direct exposure to prohibited categories: block the deposit immediately, preserve the blockchain data, file a Suspicious Activity Report where required, and do not tip off the customer.
These thresholds are illustrative. Each operator must calibrate them against their own licence conditions, player demographic, and average deposit value. The key requirement is that thresholds are documented, approved at senior management level, and reviewed at least annually.
Step Three: Integrate Screening Into the Deposit Journey
The optimal integration point is before funds are credited to a player account. Many gaming platforms support a pending deposit state where the system waits for a compliance signal before releasing the balance. Operators using third-party wallet infrastructure should confirm with their provider that a pre-credit hold is technically possible and can be triggered by the screening API response.
For withdrawals, outbound screening matters too. Sending funds to a wallet that a later investigation identifies as belonging to a sanctioned entity creates secondary liability. A lightweight outbound check on the destination address adds minimal latency and closes a compliance gap that regulators increasingly scrutinise.
Step Four: Build the Audit Trail
Every screening decision, whether automated or manual, must produce a timestamped record that includes the wallet address, the transaction hash, the risk score returned, the action taken, and the operator employee or system that authorised that action. This record forms the evidence base if a regulator or law enforcement agency later requests documentation of how a specific deposit was handled.
Regulators do not expect operators to catch every bad actor. They do expect operators to demonstrate a documented, proportionate, and consistently applied process. The audit trail is how you prove that process existed.
Common Operational Pitfalls to Avoid
- Screening only the immediate deposit address without tracing one or two hops back in the transaction graph.
- Using a single provider without a fallback, creating a single point of failure that halts deposits during an API outage.
- Failing to update risk thresholds after a regulatory guidance update or a major enforcement action in the sector.
- Treating screening as an IT project rather than a compliance programme with MLRO ownership and board-level accountability.
How OnlineShine Supports Crypto Compliance
OnlineShine provides MLRO-as-a-service and AML programme design for iGaming operators accepting crypto deposits. Our compliance team can assess your current screening setup, draft or update your wallet screening policy, and integrate with your preferred blockchain analytics vendor. Operators launching new crypto deposit capabilities or responding to a regulatory review can engage us on a project or retainer basis from our base in Groningen, the Netherlands.
