What due diligence is for
Customer due diligence establishes who the customer is, understands the nature of the relationship, and gives the operator a baseline against which later behaviour can be judged. Everything downstream depends on it: monitoring compares behaviour to an expectation, and there is no expectation without a baseline.
Most frameworks require the same core elements, and the UK's Money Laundering Regulations 2017 are a representative example of how they are written into law. Identify the customer and verify that identity from reliable, independent sources. For a corporate customer, identify the beneficial owners and take reasonable measures to verify them. Understand the purpose and intended nature of the relationship. Conduct ongoing monitoring, including keeping the information current.
That last element is the one treated as optional in practice. Customer due diligence is frequently run as an onboarding event, completed, and filed. It is a continuing obligation, and the gap between those two readings is where most findings live.
Identification and verification are different things
Identification is collecting the attributes: name, date of birth, address, and whatever else the framework requires. Verification is establishing that those attributes are genuine and belong to the person presenting them. The UK government's identity standard makes the same distinction: matching a claimed identity against records proves that the identity exists, but not that it belongs to the person claiming it. Confusing the two produces a file that looks complete and proves nothing.
Electronic verification matches the customer's declared details against independent data sources such as credit reference, electoral or government databases. It is fast, it can produce an auditable record of what was checked, and its quality depends entirely on the coverage and independence of the underlying sources. A single source matching a single attribute is weak; multiple independent sources matching several attributes is strong, and frameworks frequently specify what counts. The Gambling Commission's guidance for casinos, for example, says a single check against the electoral roll is not enough on its own, and sets a standard of one match on full name, date of birth and current address plus a second match on full name and either current address or date of birth.
Document verification examines an identity document, increasingly with automated authenticity checks on the security features, and increasingly paired with a liveness check that binds the document to the person presenting it: for a remote photo match, the UK identity standard requires that the person is present when the image is captured and that it has not been replayed. Document plus liveness is materially stronger than document alone, because a stolen or purchased document defeats document-only checks.
The thin-file problem is real and is where inexperienced teams cause harm. Young customers, recent arrivals in a country and people who are not on credit or electoral registers fail electronic verification through no fault of their own; as the Gambling Commission puts it, the amount of electronic information available about individuals varies with their electronic footprint. Treating an electronic verification failure as a suspicion indicator rather than as a data coverage problem produces both discrimination and wasted alerts. The correct response is escalation to a different method, not an inference about the customer.
Timing. In mature online regimes, verification is expected before the customer can deposit or play, rather than at first withdrawal. In Britain, remote operators must verify a customer's identity before the customer is permitted to gamble, and must not demand information at withdrawal that they could reasonably have requested earlier; a separate code requires age verification before the customer can deposit. The older model allowed a customer to lose money before anyone checked who they were, and it produced exactly the problems you would expect.
Beneficial ownership, and the point of it
Where the customer is a company, trust or other legal arrangement, the obligation runs through the entity to the natural persons behind it. Identify the beneficial owners, typically those holding or controlling more than a defined percentage of ownership or voting rights (more than 25 per cent of the shares or voting rights in UK law), and those otherwise exercising control.
Two points are worth internalising.
Structures exist to defeat this. Layered holding companies across several jurisdictions, nominee directors and shareholders, and bearer instruments where they persist are all methods of putting distance between the entity and the person. Reaching a name at the top of a chain is not the same as understanding who controls it, and a structure whose complexity has no commercial explanation is itself a risk indicator: UK law lists nominee shareholders, shares in bearer form and a corporate structure that is unusual or excessively complex among the factors pointing to higher risk.
Registers are a starting point, not an answer. Public beneficial ownership registers vary enormously in coverage, verification and accessibility. In the European Union, the Court of Justice ruled in November 2022 that giving the general public access to beneficial ownership information in all cases was invalid, and the 2024 anti-money laundering directive makes access conditional on a legitimate interest (Article 12). A register entry is evidence, weighed with everything else, not a conclusion, and UK law says so directly: a business does not meet its beneficial ownership duty by relying solely on information filed with the companies registrar.
In online B2C gambling, corporate customers are rare and this work concentrates in B2B relationships, affiliate and agent arrangements, and payment partnerships. Those relationships often receive less scrutiny than customer accounts, which is the wrong way round given the value moving through them. The Gambling Commission has reported operators failing to carry out sufficient due diligence on third-party business relationships, including white-label partners and investors.
Politically exposed persons
A politically exposed person holds or has held a prominent public function, and the category extends to immediate family members and known close associates. UK law, for example, excludes middle-ranking and more junior officials, and names spouses or civil partners, children and their spouses or civil partners, and parents as family members. The rationale is exposure to bribery and corruption risk by virtue of position, not an allegation about any individual.
Several points are routinely misunderstood.
PEP status is not an accusation and is not a reason to refuse a relationship by default: the FCA's PEP guidance (FG25/3, July 2025), which the Gambling Commission advises casino operators to consult, says it expects that a firm will not decline or close a business relationship merely because the person is a PEP. It is a reason to apply enhanced due diligence, obtain senior management approval, establish source of wealth and source of funds, and monitor the relationship more closely.
Domestic and foreign PEPs are treated differently in some frameworks, with some regimes applying a risk-based approach to domestic PEPs rather than automatic enhanced measures. The UK keeps enhanced measures for domestic PEPs, but since January 2024 the starting point is that a domestic PEP presents a lower risk than a foreign one, and less extensive measures apply where no other risk factors are present.
Screening is only as good as the list and the matching. Commercial PEP databases vary in coverage, currency and false-positive rate, and name matching across transliterations, diminutives and common names is genuinely difficult. A screening process that produces an unmanageable volume of weak matches will be worked around.
Status changes. A customer who was not a PEP at onboarding may become one. Screening has to be periodic, not just initial. It also works the other way: in the UK, enhanced measures must continue for at least 12 months after a PEP leaves office, or longer where the risk warrants it.
Enhanced and simplified due diligence
Enhanced due diligence applies where risk is higher: PEPs, high-risk jurisdictions, unusually complex or unusually large transactions, unusual patterns of transactions, transactions with no apparent economic or legal purpose, and customers found to have provided false or stolen identity documents, relationships conducted in unusual circumstances, and whatever else the operator's own risk assessment identifies. It typically means additional identity evidence, establishing source of funds and source of wealth, senior approval to enter or continue the relationship, and closer ongoing monitoring.
Simplified due diligence applies where risk is demonstrably low, permitting reduced measures. It does not permit no measures: UK law allows an operator to adjust the extent, timing or type of the measures, but not to drop them, and still requires enough monitoring to detect unusual or suspicious transactions, and the Gambling Commission has criticised operators for not recording their rationale and decision making on AML matters. In practice, simplified measures are hard to justify for remote gambling customers: the Gambling Commission's casino guidance says remote customer relationships cannot be considered low risk if no safeguards are in place, UK law lists non-face-to-face relationships without safeguards such as an electronic identification process as a higher-risk factor, and an operator applying simplified measures broadly should expect to be asked why.
The recurring error with enhanced due diligence is treating it as a document-collection exercise. Obtaining a payslip and filing it is not enhanced diligence if nobody assesses whether the payslip explains the activity. The Gambling Commission has reported bank statements showing significant third-party deposits, or outgoings higher than income, that operators collected without identifying or acting on the risk. The measure is the assessment, not the artefact.
Ongoing due diligence
This is the element most often neglected in practice.
The obligation is to keep the information current and to ensure transactions remain consistent with what is known about the customer, its business and its risk profile. That requires a trigger model and a periodic model, working together.
Event triggers should include a material change in transaction behaviour, a new payment instrument, a change of jurisdiction, a screening hit, a monitoring alert, a third-party deposit attempt, a failed verification, and information from outside the operator such as a law enforcement request or adverse media.
Periodic review should be risk-rated: high-risk relationships reviewed frequently, low-risk relationships at longer intervals. What matters is that the interval is defined, justified and actually met, and that every review is recorded: the Gambling Commission runs its compliance assessments on a "show me, don't tell me" basis and has criticised operators that did not record the outcome of risk reviews on particular customers.
A review that changes nothing is fine. A review that never happens is not, and a review process with a large backlog is a control the operator has documented itself as failing to operate.
Where due diligence meets responsible gambling
The two disciplines share evidence and are frequently run by overlapping teams, so the distinction has to be held deliberately.
Due diligence asks who the customer is and where the money came from. Responsible gambling asks whether the customer can bear the loss and whether they are being harmed. A customer with impeccable source of funds can be experiencing severe harm. A customer who can plainly afford their play can be moving criminal proceeds.
The practical consequence is that the two processes must be able to reach opposite conclusions about the same customer without one overriding the other, and the operator must act on both. The failure mode is a single team running one process, labelling it with both names, and resolving every case in the direction of whichever discipline it knows better.
There is also a hard constraint the other way. Tipping-off provisions mean a customer cannot be told that a suspicious activity report has been made, or that a money laundering investigation is under way or contemplated, where that is likely to prejudice an investigation; in the UK, doing so is a criminal offence in the regulated sector. A responsible gambling interaction with such a customer has to be conducted without disclosing the financial crime concern. The Gambling Commission's view is that reasonable and tactful enquiries, including those driven by social responsibility concerns, should not amount to tipping off provided they do not reveal the report or the investigation, and the teams need a protocol for that situation rather than improvising it.