An AML/CFT manual is not a box-ticking exercise. For an online casino, it is the operational backbone of your entire compliance programme, the document that regulators will scrutinise first when something goes wrong and the reference point your team relies on daily. Getting it right from the start saves significant time, cost and reputational risk down the line.
Why the Manual Matters More Than the Policy
Most operators understand they need an AML policy. Fewer appreciate the difference between a policy and a manual. A policy states intentions; a manual translates those intentions into step-by-step procedures that staff can follow without ambiguity. Regulators across Malta, Gibraltar, Curacao and the Netherlands are increasingly expecting operators to demonstrate not just that rules exist, but that those rules are embedded in daily operations. A well-structured manual is the primary evidence of that embedding.
Core Components Every Manual Must Cover
Regardless of jurisdiction, a compliant AML/CFT manual for an online casino should address the following areas in dedicated sections:
- Governance and ownership: Name the MLRO, deputy MLRO and board-level sponsor. Define escalation lines and decision-making authority clearly.
- Risk appetite statement: Set out the operator's documented tolerance for customer risk, product risk and geographic risk. This section anchors every subsequent procedure.
- Customer Due Diligence (CDD) procedures: Describe standard CDD, enhanced due diligence (EDD) for high-risk customers and simplified measures where permitted. Include trigger thresholds, document checklists and turnaround time expectations.
- Source of funds and source of wealth: Specify when these checks are required, what documentation is acceptable and how credibility assessments are conducted and recorded.
- Transaction monitoring: Detail the rules or scenarios active in your monitoring system, the alert triage process and the timeframes for escalation and investigation.
- Suspicious Activity Reporting (SAR): Walk through the internal SAR process from suspicion identification to submission to the financial intelligence unit. Include tipping-off controls.
- Sanctions screening: Confirm screening frequency, the lists used, and the process for handling potential matches and false positives.
- Record keeping: State retention periods, storage formats and access controls, aligned with your licensing jurisdiction's requirements.
- Training: Outline mandatory training schedules, role-specific content, pass standards and how completion is recorded.
- Independent audit and review cycle: Confirm how often the manual is reviewed, who conducts the review and how findings are reported to the board.
Common Weaknesses Regulators Identify
In practice, auditors and regulators frequently flag the same recurring gaps. Procedures are written at a high level but do not specify who does what, by when and what system entries are required. Thresholds for EDD or source of funds checks are absent or inconsistent with the risk appetite statement. The SAR section describes the legal obligation but gives no practical guidance on writing a quality internal report. Training records exist but cannot be linked to specific procedure versions. Any one of these gaps can convert a routine supervision visit into a formal investigation.
Structuring for Operational Use
A manual no one reads is a liability rather than an asset. Structure matters as much as content. Use numbered sections so that training materials and audit findings can reference specific clauses. Include process flowcharts for CDD, EDD and SAR workflows alongside the written text. Maintain a version control log on the front page showing the date, author and nature of each amendment. Separate customer-facing jurisdictions into appendices where local rules differ, rather than attempting a single global procedure that satisfies no regulator fully.
Keeping the Manual Current
Regulatory guidance, typology reports from bodies such as FATF and Egmont, and product changes all create obligations to update the manual promptly. A practical approach is to assign ownership of each section to a named individual, schedule a formal review at least annually and conduct an ad-hoc review whenever a material regulatory change occurs or an internal incident reveals a procedural gap. Document every review, even if no changes result, so that regulators can see the governance process functioning continuously.
A compliance manual should be written as if the regulator will read it the morning after an incident. Clarity, specificity and evidence of regular review are the three qualities that distinguish a defensible document from one that creates further exposure.
Where OnlineShine Fits In
Building a manual from scratch is resource-intensive, particularly for operators entering new markets or expanding their product suite. OnlineShine provides MLRO-led compliance support that covers manual drafting, gap analysis against current regulatory expectations and ongoing maintenance. The output is a jurisdiction-specific, operationally practical document that your team can actually use, not a template filled with generic language that leaves your staff guessing.
