An AML/CFT manual is not a generic compliance document you download and rebrand. It is a living operational framework that must reflect the specific money-laundering and terrorist-financing risks your business model actually generates. For iGaming operators, those risks differ sharply depending on whether you run a licensed casino, a sportsbook, a sweepstakes platform or a crypto-native gaming product, and a manual that ignores those differences will fail both a regulatory review and a real-world audit.
Why the Vertical Shapes the Manual
Regulators increasingly expect AML/CFT documentation to be risk-proportionate, meaning every control must be traceable back to an identified risk in your business risk assessment (BRA). A sportsbook faces in-play bonus abuse and match-fixing layering patterns that simply do not appear in a slot-focused casino. A sweepstakes model operates without fiat deposits in the conventional sense, yet still handles value flows that can attract structuring. A crypto casino introduces pseudonymous wallets, cross-chain swaps and decentralised exchange on-ramps that no traditional casino BRA template covers. Getting the vertical right from the first section of the manual determines whether every subsequent control makes operational sense.
Core Sections Every Manual Must Contain
- Business Risk Assessment: Document your product types, customer segments, deposit and withdrawal channels, jurisdictions served and distribution partners. This section anchors everything else.
- Customer Risk Scoring Model: Define low, medium and high-risk tiers with clear, measurable criteria. Regulators expect the criteria to be tailored, not copied from a generic template.
- Customer Due Diligence and Enhanced Due Diligence procedures: Specify triggers, document checklists, timelines and the escalation path to the MLRO.
- Transaction Monitoring Rules: List the alert scenarios relevant to your vertical, the thresholds, the review workflow and the decision log requirements.
- Suspicious Activity Reporting: Define who can submit an internal SAR, how the MLRO evaluates it, the timeline for external reporting and the tipping-off controls.
- Record-Keeping: State retention periods, storage formats and access controls in line with your licensing jurisdiction.
- Training and Awareness: Describe frequency, content, role-specific modules and how completion is evidenced.
- Governance and Oversight: Assign named roles, set review cycles and document how the board receives AML reporting.
Online Casino: Volume, Bonuses and PEP Exposure
A casino manual must address high-velocity play patterns where a customer can deposit, wager and withdraw within minutes. Transaction monitoring rules should flag rapid cycling, where funds are deposited and withdrawn with minimal game play. Bonus abuse through multiple accounts is both an AML and an integrity risk, so the manual should link identity verification controls to bonus eligibility workflows. Enhanced due diligence triggers for politically exposed persons and their close associates need to be operational from day one, not added reactively after a regulatory finding.
Sportsbook: Layering Through Betting Markets
Sportsbooks attract a specific layering typology: placing opposing bets to generate a near-certain withdrawal, effectively cleaning funds through the bookmaker. The manual must define this scenario explicitly, set stake and frequency thresholds that trigger review, and establish a communication protocol with integrity monitoring services. Where the sportsbook also accepts in-play bets, the monitoring logic needs real-time capability rather than batch processing at end of day.
Sweepstakes: Value Flows Without Traditional Deposits
Sweepstakes platforms operate under promotional prize models rather than traditional wagering, which means the financial flows look different on paper. However, secondary markets for virtual coins, peer-to-peer coin transfers and redemption pipelines all create exposure. The manual must define what constitutes a reportable transaction in jurisdictions where the platform operates, clarify how identity is verified before redemption and document the customer risk scoring logic for high-volume redeemers. Given the current regulatory scrutiny on the sweepstakes model in several US states, having a defensible, well-documented manual is more important than ever.
Crypto Gaming: Wallet Risk and Chain Analysis Integration
A crypto casino manual requires a dedicated section on virtual asset risk. This section should cover the onboarding checks applied to wallet addresses before a deposit is accepted, the blockchain analytics provider or tool used, the risk categories that trigger enhanced due diligence and the policy for declining funds from high-risk wallet clusters. Peer-to-peer transaction channels and privacy coins each warrant their own risk narrative. The manual should also address travel rule compliance where the operator is itself treated as a virtual asset service provider under the applicable jurisdiction.
Keeping the Manual Current
A manual that was accurate at launch becomes a liability if it is not maintained. Build a formal review schedule into the governance section: at minimum annually, and additionally whenever a new product, market or payment channel is introduced. The MLRO should sign off on every version, and version control metadata should be preserved so regulators can trace the history of your controls.
A well-structured AML/CFT manual does not just satisfy a licensing condition. It operationalises your compliance culture, trains your staff indirectly through its procedures and gives your MLRO a defensible record when questions arise.
