iGaming Compliance Checklist

Compliance in online gambling is not a single department, it is a set of functions that have to run continuously and prove themselves on demand. This checklist covers the areas a regulated operator is expected to have in place. Treat it as a structure to pressure-test your own programme, not as legal advice for a specific market.

Licensing and corporate

• Hold a valid licence in every market you take players from, and understand each one's local-presence and reporting duties.
• Keep key-person and ownership disclosures current; regulators expect to know who controls the business.
• Track licence conditions and renewal dates so nothing lapses.

Anti-money-laundering and KYC

• Verify identity, age and, where required, source of funds before players can transact freely.
• Run risk-based customer due diligence, with enhanced checks on higher-risk players.
• Screen against sanctions and politically-exposed-person lists.
• Monitor transactions for structuring, unusual patterns and rapid deposit-withdrawal cycling.
• File suspicious-activity reports where the law requires and keep an auditable trail.

Responsible gambling

• Offer deposit, loss and time limits, plus time-outs and self-exclusion.
• Connect to national self-exclusion schemes where they exist.
• Detect markers of harm in play data and intervene, with records of the intervention.
• Make help resources and reality checks visible, not buried.

Data protection and security

• Establish a lawful basis for processing personal data and honour data-subject rights.
• Minimise and retain data according to a defined policy, not indefinitely.
• Secure data in transit and at rest, and control access on a need-to-know basis.
• Have an incident-response and breach-notification plan you have actually tested.

Technical standards and game integrity

• Certify random number generators and return-to-player values with an accredited test house.
• Control game and platform changes through documented release management.
• Protect against fraud, bonus abuse and collusion.

Marketing and player-facing conduct

• Keep advertising accurate, not misleading, and clear of vulnerable and underage audiences.
• Present bonus terms, wagering requirements and odds transparently.
• Suppress marketing to self-excluded and opted-out players.

Payments and geolocation

• Use compliant payment providers and apply the market's rules on accepted methods.
• Enforce geolocation so only players in permitted jurisdictions can bet.
• Reconcile player funds and, where required, keep them segregated from operating funds.

Reporting and governance

• Meet regulatory reporting deadlines for revenue, tax and player-protection data.
• Keep policies version-controlled and staff trained against them.
• Run internal audits and close findings on a schedule you can evidence.

The test of a compliance programme is not whether the policies exist, but whether you can demonstrate them working when a regulator asks.

---

Regulation, tax and market figures move quickly, sometimes mid-year. Where this guide gives a number, treat it as a starting point and confirm the current position with the named primary source before you rely on it.