Anti-Money Laundering Policy

1. Purpose & Scope Ch. 10

This Anti-Money Laundering (AML) policy outlines the procedures, controls, and organizational measures that a licensed iGaming operator must implement to prevent its platform from being used for money laundering, terrorist financing, or other financial crimes.

In a real operation, this policy applies to all employees, contractors, and third-party service providers. It covers all products offered — sports betting, casino games, poker, and any other gambling services — across all channels (desktop, mobile, retail).

The three pillars of AML compliance in iGaming are:

• Prevention — KYC checks, source-of-funds verification, and risk-based onboarding
• Detection — Automated transaction monitoring, behavioral analytics, and threshold alerts
• Reporting — Suspicious Activity Reports (SARs), threshold reporting, and regulatory communication

2. Regulatory Framework Ch. 9-10

iGaming AML compliance operates within a layered regulatory environment. Key frameworks include:

EU Anti-Money Laundering Directives (AMLD)

• 4th AMLD (2015/849) — Brought gambling under full AML scope; risk-based approach mandated
• 5th AMLD (2018/843) — Lowered anonymous prepaid card thresholds; expanded beneficial ownership registers
• 6th AMLD (2018/1673) — Harmonized predicate offenses; introduced criminal liability for legal persons
• AMLA Regulation (2024) — Establishes EU-wide AML Authority (AMLA) with direct supervision powers

Malta Gaming Authority (MGA)

The MGA requires licensees to implement a Player Due Diligence (PDD) framework with tiered verification based on deposit/withdrawal thresholds. Operators must appoint a designated Money Laundering Reporting Officer (MLRO) and submit annual compliance reports.

Dutch Kansspelautoriteit (KSA)

The Netherlands' KSA enforces the Wet op de kansspelen (Gambling Act) alongside the Wet ter voorkoming van witwassen (Wwft). Dutch-licensed operators face strict requirements including mandatory IBAN-only deposits, enhanced affordability checks, and CRUKS (self-exclusion register) integration.

3. KYC (Know Your Customer) Procedures Ch. 11

3.1 Identity Verification Tiers

3.2 Source of Funds Verification

When a player's deposit activity exceeds defined thresholds or triggers risk indicators, the operator must verify the legitimate origin of funds. Acceptable documentation includes:

• Recent payslips (last 3 months)
• Bank statements showing salary credits
• Tax returns or accountant letters
• Sale of property — contracts and settlement statements
• Inheritance — probate documents or solicitor letters
• Investment returns — brokerage statements

3.3 Enhanced Due Diligence (EDD)

EDD is triggered for high-risk customers, including those from high-risk jurisdictions (FATF grey/black list), players with unusual transaction patterns, and politically exposed persons. EDD measures include:

• Senior management approval for establishing or continuing the relationship
• More frequent and intensive ongoing monitoring
• Source of wealth verification (not just source of funds)
• In-person or video verification for high-value accounts

4. Transaction Monitoring Ch. 12

4.1 Automated Alert System

Real-time transaction monitoring systems analyze player behavior against predefined rules and machine-learning models. Common alert triggers include:

• Large single transactions — Deposits or withdrawals exceeding €2,000 in a single transaction
• Cumulative thresholds — Total deposits exceeding €10,000 within a rolling 24-hour period
• Structuring — Multiple deposits just below reporting thresholds (e.g., three €1,900 deposits)
• Rapid deposit-withdrawal — Depositing and withdrawing with minimal play (pass-through)
• Payment method mixing — Using multiple unrelated payment methods on a single account
• Velocity changes — Sudden dramatic increase in deposit frequency or amounts
• Geographic anomalies — Login locations inconsistent with registered address or known patterns

4.2 Threshold Reporting

4.3 Suspicious Activity Reports (SARs)

When monitoring identifies activity that cannot be satisfactorily explained through normal gambling behavior, the MLRO must assess whether a SAR should be filed. The decision to file is based on reasonable grounds for suspicion — not certainty. Common SAR scenarios in iGaming:

• Player deposits large amounts and withdraws with minimal gameplay
• Third-party deposits (someone else funding the account)
• Player provides inconsistent or falsified documentation
• Chip dumping in poker (deliberately losing to transfer funds to another player)
• Use of multiple accounts (multi-accounting) to obscure fund flows

5. Risk Assessment Methodology Ch. 10

A risk-based approach is the foundation of modern AML compliance. The operator conducts both enterprise-wide and individual customer risk assessments:

Customer Risk Factors

Scores are recalculated dynamically as new data becomes available. Thresholds determine the level of ongoing monitoring: low-risk customers receive standard monitoring, medium-risk customers are reviewed quarterly, and high-risk customers require continuous enhanced monitoring.

6. PEP (Politically Exposed Persons) Screening Ch. 11

Politically Exposed Persons present elevated money laundering risk due to their positions of influence. PEP screening must occur at onboarding and continuously thereafter. Categories include:

• Domestic PEPs — Heads of state, senior politicians, judicial officials, military officers
• Foreign PEPs — Same roles in other countries (higher risk due to reduced transparency)
• International Organization PEPs — Senior figures in organizations like the UN, EU, World Bank
• RCA (Relatives and Close Associates) — Family members and known associates of PEPs

Operators typically integrate third-party PEP screening databases (e.g., Dow Jones, Refinitiv World-Check, ComplyAdvantage) via API to automate checks against registration data. A PEP match does not automatically mean rejection — it triggers Enhanced Due Diligence and senior management review.

7. Record Keeping Requirements

All AML-related records must be retained for a minimum period as defined by applicable regulations:

• Customer identification records — 5 years after the business relationship ends (EU standard; 10 years in some jurisdictions)
• Transaction records — 5 years from the date of the transaction
• SAR/STR records — 5 years from filing date, stored separately with restricted access
• Risk assessment documentation — Retained for the duration of the relationship plus 5 years
• Training records — Duration of employment plus 5 years

Records must be stored securely, readily retrievable for regulatory requests, and protected under applicable data protection laws (GDPR). The tension between AML record-keeping obligations and GDPR data minimization principles is a key challenge explored in the book.

8. Staff Training

All staff must receive AML training appropriate to their role. The training program includes:

• Induction training — All new employees within 30 days of start date
• Annual refresher — Mandatory for all staff, covering regulatory updates and case studies
• Role-specific training — Enhanced training for customer-facing, payments, and compliance staff
• MLRO specialized training — External certification courses, regulatory workshops, FIU briefings

Training must cover: recognizing suspicious behavior, internal reporting procedures, tipping-off prohibitions (never alerting a customer that a SAR has been or may be filed), and the personal criminal liability that staff may face for non-compliance.

Training Effectiveness Measurement

Operators must track training completion rates and assess comprehension through testing. Key metrics include:

• Completion rate targets: 100% for mandatory modules, tracked by department
• Post-training assessments with minimum passing scores (typically 80%)
• Scenario-based testing using anonymized real cases
• Annual audit of training records by external compliance reviewers

The MLRO is responsible for maintaining the training calendar, updating materials when regulations change, and reporting training metrics to the board on a quarterly basis. In jurisdictions like Malta and the UK, regulators may request training records during license reviews.

8.1 Internal Reporting Structure

A clear internal reporting chain is essential for effective AML compliance. The typical structure in an iGaming operation:

• First Line of Defense — Customer-facing staff, payment processors, and game operators who identify initial red flags
• Second Line of Defense — Compliance team reviews escalated cases, conducts enhanced investigations
• MLRO (Money Laundering Reporting Officer) — Makes final determination on SAR filing, reports directly to the board
• Board of Directors — Receives quarterly compliance reports, approves AML policy updates, ensures adequate resourcing

Internal reports must be filed within 24 hours of identifying suspicious activity. The MLRO then has a jurisdiction-specific deadline to decide whether to file an external report. All internal reports are logged in a secure, access-controlled system with full audit trail capabilities.

9. Responsible Gambling & AML Connection Ch. 15

Responsible gambling (RG) and AML are distinct compliance domains, but they share significant overlap in practice:

• Affordability checks serve both RG (protecting vulnerable players) and AML (verifying legitimate fund sources)
• Behavioral monitoring systems detect both problem gambling patterns and suspicious transaction activity
• Self-exclusion data can indicate potential multi-accounting when cross-referenced with AML alerts
• Source of funds documentation protects against both laundering and irresponsible spending

Modern compliance platforms increasingly integrate RG and AML monitoring into unified systems, allowing a single behavioral analytics engine to serve both purposes — reducing false positives and operational overhead.

Shared Data Points

9.1 Cryptocurrency & AML Challenges Ch. 12

Crypto-accepting operators face additional AML challenges due to the pseudo-anonymous nature of blockchain transactions:

• Blockchain analytics — Tools like Chainalysis and Elliptic trace transaction histories to identify high-risk wallets (mixers, darknet markets, sanctioned addresses)
• Travel Rule compliance — FATF Recommendation 16 requires VASPs to share originator/beneficiary data for transfers above applicable thresholds
• Wallet screening — Real-time screening of deposit addresses against sanctions lists and risk databases
• Conversion monitoring — Tracking crypto-to-fiat conversion patterns that may indicate laundering

Many jurisdictions now require crypto-accepting gambling operators to hold additional licenses or meet enhanced compliance requirements. The Dutch KSA, for example, restricts the use of cryptocurrency payments for licensed operators entirely.

10. How This Simulation Demonstrates AML Concepts

AcmetoCasino is a fully simulated environment designed to illustrate the technical infrastructure behind AML compliance. In this simulation:

• The Dashboard shows simulated transaction monitoring with bot-generated activity patterns
• Player accounts use localStorage — demonstrating how session data flows through verification pipelines
• The bot system generates realistic deposit/withdrawal patterns that would trigger various AML alert rules in a production environment
• No real money is processed — all transactions are simulated to demonstrate data flows
• The API endpoints (/api/stats.json, /api/transactions.json) mirror the data structures that feed into real AML monitoring dashboards