iGaming Compliance Checklist: What a Licensed Operator Has to Do

A gambling licence is a list of things the operator must do continuously. This checklist organises them by area, states what each requires in practice, and says what evidence a regulator will ask for. It is written for compliance teams building or reviewing a framework and for anyone in an operator who wants to know what the licence actually obliges. The specifics differ by jurisdiction; the structure does not. Where a market's rule differs materially from the pattern, the regulator's own conditions and guidance govern.

1. Licensing and governance

• Every licence held is listed, with its conditions, renewal date, fees and the entity that holds it.
• Every person in a key role (chief executive, compliance head, money-laundering reporting officer, responsible gambling lead, directors, significant shareholders) holds the personal licence or approval the regulator requires, and changes are notified within the required period.
• Ownership is disclosed to the ultimate beneficial owner and changes above the threshold are approved in advance.
• A compliance framework exists in writing: policies, procedures, controls, training, monitoring and reporting, with named owners.
• A board or committee receives compliance reports on a schedule and minutes show it considered them.
• Regulatory correspondence is logged and information requests answered on time.

Evidence: the licence register, personal licence records, the framework document, board minutes, the correspondence log.

2. Customer verification

• Age, identity and location verified before play or before the point the licence requires, against independent sources, with failed checks blocking play and refunding deposits.
• Customers in unlicensed jurisdictions blocked by geolocation, continuously where required.
• Enhanced checks (source of funds, source of wealth, politically exposed person and sanctions screening) applied at the thresholds and triggers the policy sets.
• Duplicate and excluded accounts detected at registration and on an ongoing basis.
• Re-verification triggered by changes in customer data or risk.

Evidence: verification statistics, sampled customer files showing the checks, threshold logic, geolocation logs, duplicate-detection records.

3. Anti-money laundering

• A written business-wide risk assessment covering products, customers, payment methods and jurisdictions, reviewed annually.
• Customer risk rating with due diligence proportionate to it.
• Transaction monitoring rules and models for the known patterns: deposit-withdrawal with minimal play, structuring, multiple instruments, third-party payments, spend inconsistent with profile.
• Alerts investigated, decisions recorded, escalations to the MLRO, suspicious activity reports filed with the financial intelligence unit and not disclosed to the customer.
• Records retained for the statutory period; staff trained annually with records kept.
• Independent audit of the AML programme where required.

Evidence: the risk assessment, alert and investigation logs, SAR statistics, training records, audit reports.

4. Responsible gambling

• Tools offered to every customer: deposit, loss, wager and time limits; reality checks; time-outs; self-exclusion; account statements; information and signposting.
• National self-exclusion scheme checked at registration and continuously, and honoured.
• Markers of harm monitored (escalation, chasing, limit increases, cancelled withdrawals, unusual hours, support contact signals), with interactions at defined tiers, recorded with outcomes.
• Marketing and VIP treatment suppressed for customers above the risk threshold, automatically.
• Affordability checks at the spend thresholds the market sets, with action where spend is unaffordable.
• VIP or high-value programmes subject to enhanced checks, trained staff, and compliance sign-off on continuation.
• Staff trained, with escalation to specialists; outcomes measured and reported.

Evidence: tool uptake statistics, interaction logs with outcomes, suppression rules and proof they fire, affordability check records, VIP governance records, evaluation reports.

5. Marketing and promotions

• Every campaign reviewed and approved against the applicable code before release, per market, with a record of who approved it.
• No content or placement appealing to or reaching children; nobody under 25 in a gambling role where the rule applies.
• Significant bonus terms shown with the offer; wagering requirements and promotional rules within the market's limits; no promotions to self-excluded, limited or at-risk customers.
• Direct marketing only with consent, with unsubscribe, and with excluded customers suppressed.
• Affiliates approved, contracted to the rules, monitored, and terminated for breaches; a current list of affiliates and what they publish.
• Sponsorship and broadcast placements compliant with the market's restrictions.

Evidence: the approval log, the affiliate register and monitoring reports, suppression proof, complaint statistics.

6. Product and technical standards

• Every game certified by an approved testing house for the market, with RTP published where required and the certification current after changes.
• Random number generators certified; live casino equipment and studios approved where required.
• Restricted features (autoplay, turbo, slam stop, losses disguised as wins, and others per market) removed or configured per market.
• Stake, prize and speed limits applied where the market sets them.
• Platform tested and certified; change control records for every release; regulator notified of material changes.
• Uptime, security and penetration testing to the technical standard.

Evidence: certification certificates by game and market, change control logs, test reports.

7. Player funds

• Customer balances held separately from operating cash at the protection level the licence requires, disclosed to customers in the terms.
• Daily reconciliation of the player ledger to the segregated accounts.
• Bonus and loyalty liabilities recorded.

Evidence: bank and trust arrangements, reconciliation records, the terms.

8. Data protection and security

• Records of processing, lawful bases, privacy notices, and data protection impact assessments for new models and systems.
• Data minimisation and retention schedules, including for verification documents and round recordings.
• Breach detection and notification within the statutory window.
• Rights requests (access, erasure, objection to automated decisions) handled within time limits; human review for significant automated decisions.

Evidence: the record of processing, DPIAs, breach log, rights request log.

9. Complaints and disputes

• A complaints process customers can find and use, with response times; escalation to the independent dispute body the market requires.
• Complaint statistics reviewed for patterns (bonus terms, withdrawals, closures) and reported where required.

Evidence: the complaints log, ADR referrals, statistics.

10. Reporting and incidents

• The regulatory calendar: returns, fees, renewals, tax filings, assurance statements, audits, each with an owner and a deadline.
• Event-driven reporting within the required periods: key person changes, ownership changes, breaches, material business changes, regulatory action elsewhere, financial deterioration.
• Incident management: detection, containment, root cause, remediation, self-reporting to the regulator where required, and a record.

Evidence: the calendar with completion records, notification records, incident logs.

11. Culture

• Compliance represented at executive level and reporting to the board without filtering.
• Compliance decisions documented and not reversed by commercial staff; where a decision is escalated, the outcome and reasons are recorded.
• The MLRO and responsible gambling lead have the authority to restrict and close accounts.
• Resourcing proportionate to markets and customers.

Evidence: organisation charts, escalation records, resourcing against volumes.

Using the checklist

Run it per licence, because each jurisdiction's specifics differ, and run it on a schedule, because the rules move. The regulator's test of every line is the same: not whether the policy exists but whether the operator can show, with records, that it did what the policy says. Where a line has no evidence, that is the finding.

Frequently asked questions

What is the most common compliance failure? Policies that exist and are not followed: source-of-funds checks not done at the operator's own thresholds, harm flags not acted on, marketing sent to excluded customers.

How often should the checklist be run? Continuously for the operational lines, and as a formal review at least annually per licence and after any regulatory change.

Who owns compliance? A named head of compliance with board access, with the MLRO and responsible gambling lead holding their own statutory or licence-defined responsibilities.

Does one framework cover every market? One framework with market-specific overlays: the structure is common, the thresholds, rules and reporting differ.

What does a regulator ask for first? Usually the evidence: sampled customer files, interaction logs, the affiliate register, board minutes.

Related on iGaming Times

KYC and AML Checks in Online Gambling and Responsible Gambling Tools Explained cover sections 2 to 4 in depth; the Gambling Regulation Basics course is the introduction; Law and Compliance and AML and Financial Crime are the advanced courses.

---

Regulation, tax and market figures move quickly, sometimes mid-year. Where this guide gives a number, treat it as a starting point and confirm the current position with the named primary source before you rely on it.