Gambling payments face higher regulatory scrutiny than many other online payment flows. Operators handle deposits and withdrawals, often across borders and through several payment methods. This creates more opportunities for fraud, money laundering and misuse of gambling accounts.
The rules aren't universal. AML requirements depend on the jurisdiction, gambling licence, payment setup, and each company's role in the transaction. A gambling operator and its payment provider may also have different compliance obligations.
The issue has received renewed regulatory attention in 2026. In September, the Financial Action Task Force (FATF) published new risk indicators for the iGaming and Gambling sectors, including its first detailed examination of online and illegal gambling. The report covers suspicious payment patterns, multiple accounts and payment methods, identity discrepancies and complex ownership structures.
In July, the UK Gambling Commission also published its 2026 assessment of money laundering and terrorist financing risks in the British Gambling industry. It points to developments such as artificial intelligence, illegal gambling websites, and changing payment activity as areas operators need to account for in their risk assessments and controls.
Key compliance areas to check and prove in 2026:
- Gambling licence and business verification
- KYC and KYB
- Customer due diligence (CDD) and enhanced due diligence (EDD)
- Transaction monitoring
- Sanctions and PEP screening
- Source-of-funds checks where required
- Suspicious activity detection and reporting
- Record keeping and audit trails
- Jurisdiction-specific gambling and AML requirements
Why gambling payments require stricter compliance controls
AML compliance checklist for gambling payments
AML compliance in gambling covers the full payment flow, from merchant onboarding and customer verification to transaction monitoring and suspicious activity reporting. Different checks apply at different stages, and the merchant and payment provider may have different responsibilities.
The checklist below maps the main compliance areas across that flow. Exact requirements and ownership depend on the jurisdiction, licence and payment model.
These areas cover different stages of the payment flow, from onboarding to ongoing monitoring. Below, we look at five of them in more detail and explain what they mean for gambling payments.
KYC and identity verification
Know Your Customer (KYC) checks establish who the customer is and whether they meet the requirements to use a gambling service. Depending on the jurisdiction, this can include verifying identity, age, and location, as well as detecting duplicate accounts, false identities or discrepancies between the account holder and payment details.
KYC is only the starting point. FATF's 2026 risk indicators include multiple accounts or payment methods used under different identities and inconsistencies between customer and payment information. A customer who passes verification can still show suspicious behaviour later, which is why identity checks need to work alongside ongoing transaction monitoring.
KYB and gambling merchant onboarding
For a gambling payment provider, compliance starts before processing begins. Know Your Business (KYB) checks help establish who owns and controls the merchant, where it operates, and whether its gambling activities are properly licensed for the markets it serves.
Onboarding can cover the legal entity, ultimate beneficial owners (UBOs), gambling licences, operating markets, websites and domains, expected transaction volumes and payment flows. FATF's 2026 report also identifies complex ownership structures that obscure beneficial ownership as a risk indicator, making ownership checks particularly relevant when assessing gambling merchants.
Customer due diligence and enhanced due diligence
Customer due diligence (CDD) goes beyond confirming an identity. It involves assessing the customer's risk profile and understanding whether their activity is consistent with what the business knows about them. The level and scope of CDD depend on applicable regulations and the identified risk.
Enhanced due diligence (EDD) involves additional checks when the risk is higher. Triggers vary by jurisdiction and may relate to factors such as customer profile, geography, transaction behaviour, or source of funds. This is why gambling AML compliance is generally risk-based: the same level of scrutiny isn't necessarily appropriate for every customer or transaction.
Transaction monitoring and AML red flags
Transaction monitoring looks for payment activity that doesn't fit the expected use of an account. In gambling, one particularly relevant signal is the relationship between deposits, withdrawals and actual gambling activity. Moving funds through an account with little or no genuine play can warrant further review.
FATF's 2026 indicators include depositing and withdrawing funds without meaningful gambling activity, splitting activity across multiple smaller transactions, using multiple accounts or payment methods under different identities, discrepancies between customer and payment information, and unusual cross-border activity. These are risk indicators, not automatic proof of money laundering; they provide a reason to examine the transaction or customer more closely.
Sanctions, PEP and source-of-funds checks
Sanctions screening, politically exposed person (PEP) checks, and source-of-funds checks address different types of financial crime risk. Sanctions screening checks relevant parties against applicable restrictions, while PEP screening identifies customers or other relevant individuals whose public functions may require additional risk assessment.
Source-of-funds checks focus on where the money used for a transaction or gambling activity comes from. Whether these checks are required, and how far they need to go, depends on the jurisdiction, the customer's risk profile and the circumstances of the transaction.
Gambling regulation: what changes between jurisdictions?
No single regulatory framework covers gambling payments. AML and gambling requirements vary by jurisdiction, licence type, business model, and the company's role in the payment flow. A gambling operator may therefore face different compliance requirements when entering a new market, even if its payment setup remains largely the same.
FATF provides an international AML/CFT framework, but it isn't a global gambling regulator. Its standards are implemented through national legal and regulatory systems. In September 2026, FATF also published new risk indicators specifically covering gaming and gambling, including online platforms, payment channels and illegal operators. The report highlights the risks created by differences between regulatory approaches across jurisdictions, particularly for cross-border and online activity.
For merchants and payment providers, this makes jurisdiction part of the compliance assessment. Before processing starts, payment teams need to understand who regulates the gambling business, what licence it holds, which activities that licence covers and which AML requirements apply to the relevant payment flow.
Compliance checklist for choosing a gambling payment provider
Before integrating a gambling payment provider, ask:
- Does the provider accept licensed gambling businesses?
- Which jurisdictions can it legally support?
- What KYB documents are required?
- How are UBOs screened?
- How do you handle sanctions and PEP checks?
- What transaction monitoring is performed?
- How are suspicious transactions escalated?
- What transaction records are available?
- Which payment methods and settlement currencies do you support?
- How are compliance responsibilities divided between provider and merchant?
FAQ for merchants, gambling operators and payment providers
What AML checks are required for online gambling?
AML requirements for online gambling depend on the jurisdiction, licence and business model. Common controls include KYC and identity verification, customer due diligence (CDD), risk assessment, transaction monitoring, sanctions and PEP screening, and enhanced due diligence (EDD) for higher-risk customers. Operators may also need source-of-funds checks, suspicious activity procedures and appropriate record-keeping. Effective gambling AML compliance is risk-based, so the level of scrutiny should reflect the customer, payment method, geography and transaction behaviour.
What transactions are considered suspicious in gambling?
No single transaction type or value automatically indicates money laundering. AML red flags in gambling can include depositing and withdrawing funds with little or no genuine gambling activity, frequent small transactions, unusual transaction velocity, multiple payment methods or accounts under different identities, and discrepancies between customer and payment information.
FATF's 2026 risk indicators also highlight suspicious cross-border activity and the misuse of online gambling platforms and payment channels. These patterns should trigger further assessment rather than automatically being treated as proof of financial crime.
Does KYC alone make a gambling business AML compliant?
No. KYC is an important part of gambling AML compliance, but verifying a customer's identity doesn't cover all AML requirements for gambling operators. Depending on the applicable regulation, businesses may also need ongoing customer and transaction monitoring, CDD and EDD, sanctions and PEP screening, source-of-funds checks, suspicious activity reporting and record-keeping.
The 2026 risk assessments from FATF and the UK Gambling Commission also show why ongoing monitoring matters: financial crime risks can emerge after a customer has successfully passed initial KYC.
Are gambling payment regulations different by country?
Yes. Gambling regulation and AML requirements vary by country and can also differ by licence type, gambling activity and payment model. FATF sets international AML/CFT standards and publishes risk guidance, but individual jurisdictions implement these principles through their own laws and regulatory frameworks.
For gambling payment processing, merchants and payment providers therefore need to check the relevant regulator, licence requirements, permitted activities, AML obligations and payment rules in every market they serve.
Conclusion
AML compliance in gambling isn't a one-time check. Regulations, risk indicators, and payment methods keep changing, and requirements differ between markets and licences. For merchants, this means compliance must remain part of the payment setup, from onboarding through ongoing transaction monitoring.
SPAYZ.io provides payment infrastructure for High-Risk businesses, including iGaming, with local payment methods, a single API integration and compliance-focused tools and processes. Contact our team to discuss a payment setup for your markets and business model.
