An AML/CFT manual is only as strong as the metrics used to test it. For online casino operators, writing a compliance manual is the starting point, not the finish line. The real question regulators and senior management should be asking is: how do you know it is working? Concrete, measurable KPIs transform a static document into a living compliance programme that can be audited, improved and defended.
Why KPIs Belong Inside Your AML/CFT Manual
Most casino compliance manuals describe policies, procedures and controls in detail but say very little about how those controls will be evaluated. Regulators across jurisdictions, including the MGA, UKGC and Dutch KSA, increasingly expect operators to demonstrate outcomes, not just intentions. Embedding KPIs directly into the manual signals to supervisors that your programme is designed for continuous oversight rather than one-time box-ticking.
Beyond regulatory optics, KPIs give your MLRO practical tools to identify where the compliance framework is under-performing before an external audit does it for them.
Core KPI Categories for an Online Casino AML Programme
1. Customer Due Diligence Efficiency
- CDD completion rate: the percentage of accounts that complete standard CDD within your defined onboarding window, target above 95 percent.
- Enhanced Due Diligence (EDD) trigger rate: the proportion of players escalated to EDD; a sudden spike or sustained drop both warrant investigation.
- Average time to clear EDD: measured in business hours; prolonged clearance times indicate resource or process bottlenecks.
2. Transaction Monitoring Effectiveness
- Alert volume per 1,000 active accounts: establishes a baseline and flags calibration issues in your monitoring rules.
- True positive rate: the share of alerts that result in a Suspicious Activity Report (SAR) or internal escalation; industry guidance generally expects this above 10 to 15 percent for a well-tuned ruleset.
- Alert closure time: how long analysts take to review and close alerts; a target of under five business days is common in mid-sized operations.
- SAR filing timeliness: percentage of SARs submitted within the regulatory deadline, typically 30 days from the date suspicion arises; this should be 100 percent.
3. Training and Staff Competency
- Training completion rate: percentage of relevant staff completing annual AML training on schedule; regulators expect 100 percent with documented evidence.
- Post-training assessment scores: average pass rates and identification of staff who repeatedly score below threshold.
- Escalation accuracy rate: how often frontline staff correctly identify and refer suspicious behaviour, measured through periodic case reviews.
4. Risk Assessment Currency
- Business-wide risk assessment review cycle: confirm the assessment is updated at least annually or after a material change such as a new payment method or market entry.
- High-risk customer file review frequency: percentage of high-risk accounts reviewed within the period defined in your manual, normally every six to twelve months.
5. Regulatory and Audit Outcomes
- Number of regulatory findings per audit cycle: track trends over time rather than treating each audit in isolation.
- Repeat findings rate: any finding that recurs signals a systemic gap, not an isolated incident.
- Remediation closure rate: percentage of audit action points closed within the agreed timeframe.
How to Structure KPI Reporting in Your Manual
Each KPI should specify the metric definition, data source, measurement frequency, owner and escalation threshold. Monthly dashboards reviewed by the MLRO, with quarterly reporting to the board or compliance committee, create an auditable governance trail. Annual benchmarking against prior periods shows regulators a programme that learns and adapts.
A compliance manual without measurement thresholds is a policy statement. With defined KPIs and an escalation protocol, it becomes an operational control system that can defend itself under scrutiny.
Common Mistakes Operators Make with AML KPIs
- Setting targets that are too easily met, such as a true positive rate of two percent, which masks poor alert calibration.
- Measuring volume instead of quality, for example counting SARs filed without assessing whether the underlying analysis was sufficient.
- Failing to assign a named owner to each KPI, so accountability becomes diffuse when a threshold is breached.
- Treating KPIs as an annual compliance exercise rather than a live management tool reviewed at regular intervals.
Practical Next Steps for Operators
Start by auditing your existing manual to identify which controls currently have no measurable output. Prioritise CDD timeliness and SAR filing rates first, as these carry the highest regulatory risk if they slip. Build your KPI dashboard into your compliance technology stack so data is pulled automatically rather than compiled manually each month. Finally, schedule a structured review with your MLRO at least quarterly to assess whether thresholds remain appropriate as your player base and product mix evolve.
OnlineShine supports operators in designing AML frameworks that are both regulator-ready and operationally practical, including KPI architecture, MLRO-as-a-service and transaction monitoring calibration across multiple jurisdictions.
