Purpose and status
This draft outlines the intended anti-money laundering, counter-terrorist financing, sanctions, and identity-verification framework for [Operator Name]. It is not an operational policy and no customer due diligence is currently performed because no gambling account or payment service is available.
The final framework must be approved by accountable management and aligned with the law, regulatory guidance, risk assessment, and reporting duties of [Jurisdiction].
Risk-based approach
Before launch, the operator should document risks relating to customers, products, payment methods, geography, delivery channels, affiliates, game activity, and source of funds. Controls should be proportionate, consistently applied, tested, and reviewed when risk changes.
Customer due diligence
The final process should define when and how identity, age, address, payment ownership, beneficial ownership, source of funds, and source of wealth are verified. Enhanced due diligence should apply where higher risk is identified.
- Identity and date-of-birth verification using reliable evidence.
- Screening for sanctions, politically exposed persons, and adverse information where lawful.
- Ongoing review and re-verification based on risk and trigger events.
- Restrictions on transactions until required checks are complete.
Monitoring and reporting
Transaction and gameplay monitoring rules must be defined before payments are enabled. Alerts should be reviewed by trained staff with access controls, documented decisions, and escalation to the nominated reporting officer.
Suspicious activity reporting, tipping-off restrictions, regulatory deadlines, and law-enforcement cooperation must follow applicable law. Nominated officer: [MLRO Name and Contact].
Records, training and assurance
The operator should define retention periods for verification evidence, risk assessments, alerts, decisions, reports, and staff training. Independent testing, role-based access, incident response, and periodic board reporting should be specified in the final policy.
Regulatory details
Supervising authority: [Regulator]. Licence: [License Number]. Registered office: [Registered Address]. Compliance contact: [Compliance Email].