iGaming compliance is the set of controls a licensed operator or supplier runs to meet its licence conditions and the laws around them. In practice it breaks into nine functions: licensing and regulatory reporting, anti-money laundering, customer identification, safer gambling, marketing, data protection, game and system integrity, payments and player funds, and supplier oversight. Regulators name the people responsible for several of these and approve them individually.
Below, each function with what regulators actually write down. Sources were checked on 4 November 2026.
Who owns what
| Function | Typical owner | Regulator anchor |
|---|---|---|
| Licensing and reporting | Head of compliance | MGA reporting calendar; CGA reporting duties |
| AML/CTF | MLRO | Malta PMLFTR and FIAU procedures; UK Money Laundering Regulations |
| KYC and age verification | Compliance or payments/risk | CGA policy requirements; MGA due diligence on a risk basis |
| Safer gambling | Compliance or a dedicated RG lead | Licence conditions in every regime |
| Marketing and affiliates | Compliance with marketing | UK LCCP and CAP/BCAP codes, imposed on affiliates through contracts |
| Data protection | DPO | GDPR; the DPO is an MGA key function |
| Games and systems | Technology lead | Testing labs approved by the regulator; system audits |
| Payments and player funds | Finance and payments | Segregation rules |
| Supplier oversight | Compliance and procurement | CGA prior approval; UKGC supply-chain enforcement |
In Great Britain, the people heading these areas, including regulatory compliance, gambling IT and security, and the AML function, need a personal management licence (UKGC). In Malta, compliance, MLRO, DPO, legal, technology and internal audit are key functions, each needing an MGA certificate and annual CPD (MGA).
1. Licensing and regulatory reporting
Keeping the licence is a calendar. The MGA’s fact sheets list monthly gaming tax and compliance contribution returns, player funds and B2B compliance reports, half-yearly industry performance returns, audited financial statements within six months of year-end, and an auditor’s report on player funds and gaming revenue.
Curaçao’s licence conditions require change reports, incident reports within 24 hours, player transaction, complaints and ADR reports, and periodic reports by CGA-approved independent experts on AML compliance and on system design and responsible gambling (CGA conditions, effective 28 October 2026). Changes to owners, key persons, domains, games and suppliers need prior approval.
2. Anti-money laundering
Gambling operators fall under anti-money laundering law in both the EU and the UK. The MGA lists what its licensees must do under Malta’s PMLFTR and the FIAU’s Implementing Procedures:
- Conduct an AML/CFT business risk assessment.
- Draw up a customer acceptance policy.
- Keep AML/CFT policies and procedures.
- Carry out customer due diligence on a risk-sensitive basis once the threshold is reached.
- Build a customer risk profile.
- Report suspicious transactions to the FIAU.
- Train staff on an ongoing basis.
- Keep records.
The MLRO is appointed by the company and, in Malta, assessed by the MGA, including an interview on the operator’s procedures.
AML duties apply to suppliers too. In July 2026 the UK Gambling Commission announced that Evolution Malta Holding Limited, which holds GB software and game host licences, would pay £4.75 million after its games appeared on six unlicensed websites accessible from Great Britain. The Commission found its money laundering risk assessment did not consider the risk of games reaching unlicensed operators, and that its customer due diligence fell short (UKGC, 23 July 2026).
3. KYC and age verification
Identity, age and address checks sit at registration and again at triggers such as deposit thresholds or withdrawals, depending on the market. Curaçao requires a written policy on customer identification and verification, and that players register and log in before playing. Most operators buy this capability: see our KYC providers comparison.
4. Safer gambling
Rules vary most here, but the common core is: deposit and other limits, self-exclusion, reality checks, staff interaction with players showing harm markers, and clear information about where to get help. Curaçao’s licence conditions require player terms to include the responsible gaming policy (with deposit limits and self-exclusion) and the public site to show information about gambling addiction and support. Track market-specific rules, such as stake limits and bonus restrictions, through the regulator’s own updates.
5. Marketing and affiliates
Operators are responsible for their marketing, including what affiliates publish. That is why affiliate terms import licence conditions. Betsson Group Affiliates, for example, requires affiliates promoting to Great Britain to follow the LCCP, the CAP/BCAP codes and the industry code “as if they were bound by the same licence conditions” (terms). Compliance teams need approval workflows for creative, bonus terms disclosure and monitoring of affiliate sites.
6. Data protection
Player data includes identity documents, financial data and behavioural data used for safer gambling. In the EU that means GDPR, and Malta lists the DPO as a key function requiring at least two years as DPO or data protection lead with a relevant qualification, or three years’ experience.
7. Game and system integrity
Games and platforms are tested by labs the regulator approves. In Curaçao, every game, including third-party games, must be certified by a CGA-approved testing laboratory, and the operator must disclose its game suppliers on the CGA portal. Malta requires an external system audit before go-live. Sportsbooks add integrity monitoring: MGA Type 2 licensees report through the MGA’s Suspicious Betting Reporting Mechanism.
8. Payments and player funds
Player money must be protected. Curaçao requires player funds in a segregated account and all payments to run through the player account; currencies accepted must trade on regulated markets, and the operator may not convert between virtual and fiat currencies for players. Malta’s licensees file player funds reports and an auditor’s player funds report.
9. Supplier oversight
The Evolution case shows regulators now test the supply chain in both directions: operators must vet their suppliers, and suppliers must vet who they sell to. Curaçao requires prior CGA approval before a licensee works with platform, game content or payment suppliers. Aggregation adds a layer, which our game aggregator explainer covers.
Building the function
Read the regulator’s list of named roles first. Under the MGA’s key functions and the UKGC’s personal management licence roles, a new licensee needs people accountable for compliance, AML, data protection and technology from day one, with external auditors and legal advisers around them. Smaller operators may want one person to hold two roles; check the regulator’s conflict rules before planning that (the MGA publishes a conflict matrix). Our licensing guide shows where each role is assessed during the application.
Industry coverage for readers aged 18+. If gambling is causing harm, find support through our responsible gambling page or the National Gambling Helpline on 0808 8020 133, available day and night.