KycAmlIntegrationForIgaming

TITLE TAG   : KYC AML Integration for iGaming: US & UK

Compliance Guide 2026

CHARACTERS  : 59 — within 60-char hard limit

META DESC   : KYC AML integration for iGaming explained — document

verification, morph detection, CDD/EDD, SAR filing,

US state rules & UK UKGC compliance. Expert guide 2026.

CHARACTERS  : 154 — within 155-char limit

CANONICAL   : https://www.sudonex.com/kyc-aml-api-integration/

REDIRECT MAP

301 if any of these slugs exist or were previously used:

/kyc-integration/              → /kyc-aml-api-integration/

/aml-compliance-igaming/       → /kyc-aml-api-integration/

/casino-kyc-verification/      → /kyc-aml-api-integration/

/igaming-kyc-guide/            → /kyc-aml-api-integration/

/casino-identity-verification/ → /kyc-aml-api-integration/

A single morphed passport image — two faces algorithmically blended by StyleGAN — can pass a basic 2D facial recognition check and open a shared account that bypasses every unique-ownership safeguard an operator has built. KYC and AML integration for iGaming is no longer a document-collection exercise. It is a multi-layer fraud detection and regulatory compliance architecture, and in 2026 the operators who understand every layer of that stack — from morph-detection neural networks to state-level SAR filing obligations — are the ones who stay licensed.

KYC and AML Integration for iGaming: How the Stack Works

KYC (Know Your Customer) and AML (Anti-Money Laundering) integration in iGaming is the combined technical and compliance infrastructure that verifies player identity, assesses financial risk, monitors ongoing transaction behaviour, and reports suspicious activity to the relevant regulatory authority. It is not a single tool — it is a stack of interconnected systems that must operate in sequence from account opening through the full lifetime of the player relationship.

The integration stack operates across five functional layers. First, identity document capture and OCR verification: the player submits a government-issued document, the system extracts and validates the data against authoritative sources. Second, biometric liveness detection: a live selfie or video capture is compared against the document photo using facial recognition, with morph-detection algorithms screening for synthetic composite images. Third, risk scoring and player profiling: the verified identity is screened against PEP (Politically Exposed Person) lists, sanctions databases, and adverse media feeds to establish a risk tier. Fourth, transaction monitoring: ongoing bet, deposit, and withdrawal patterns are analysed in real time against behavioural baselines to detect laundering indicators. Fifth, regulatory reporting: Suspicious Activity Reports are filed with the relevant authority — FinCEN in the US under the Bank Secrecy Act, the National Crime Agency in the UK — when defined thresholds or behavioural triggers are met.

The distinction between KYC and AML matters operationally. KYC is the identity layer — it answers "who is this person and are they who they claim to be?" AML is the financial behaviour layer — it answers "is this person using the platform to move or obscure illicit funds?" Both must be active simultaneously, and both feed each other: a high-risk KYC profile triggers enhanced AML monitoring, and unusual transaction patterns can trigger re-verification of identity documentation.

Bottom line: KYC/AML integration in iGaming is a five-layer compliance stack, not a one-time document check. Identity verification, biometric screening, risk profiling, transaction monitoring, and regulatory reporting must all operate in an integrated sequence to satisfy regulatory requirements in the US and UK.

Document Verification, Liveness Detection and the MAD Layer

The most technically sophisticated — and most underestimated — component of modern iGaming KYC integration is the morph-detection layer. Document verification and basic facial recognition are table stakes. The MAD (Morph-Attack Detection) layer is what separates platforms that can be defeated by synthetic identity fraud from those that cannot.

What Morph Attacks Are and Why They Work

A morph attack occurs when a fraudster submits a composite identity document — a passport or ID photo algorithmically blended from two real people's faces using tools like StyleGAN. The resulting image is designed to produce high biometric confidence scores for both individuals simultaneously, allowing two conspirators to share a single verified account while bypassing the unique ownership requirements that regulated platforms must enforce. Basic 2D facial recognition systems fail against well-constructed morphs because they are comparing one static image against another — and a skilled morphed composite can match either face at an acceptable confidence threshold.

The risk in iGaming is specific: two individuals using one verified account to pool funds, obscure the source of deposits, or circumvent deposit limit controls that apply per-player rather than per-account.

How Morph-Detection Algorithms Catch Synthetic Identities

Modern MAD systems deployed by identity verification providers use four primary detection mechanisms, each targeting a different forensic signature of the morphing process.

Feature-Blending Artefact Detection. When AI frameworks blend two faces, the mathematical process of averaging and blending pixel structures leaves microscopic noise — artefacts — at the boundaries where the two facial structures meet. MAD neural networks are specifically trained on large datasets of known morphed images to identify these synthetic patterns. These artefacts are invisible to human reviewers but statistically distinct from the noise profiles of genuine photographic images.

Forensic Image-Provenance and Sensor Fingerprint Analysis. Every physical camera sensor leaves a unique digital signature — a sensor fingerprint — embedded in the images it produces. This signature results from microscopic manufacturing imperfections in the sensor array and is consistent across all images captured by that specific device. When a morphed composite is created digitally, it lacks a uniform sensor fingerprint — or presents a signature inconsistent with physical capture. MAD systems perform forensic image-provenance analysis to detect this absence, checking both the sensor fingerprint consistency across the image and the hidden metadata for indicators of digital synthesis rather than direct camera output.

3D Depth-Map Cross-Referencing. Because morphing attacks target the comparison between a 2D document photo and a live capture, advanced liveness detection systems compare the document photo not against a 2D static selfie but against a live video stream or 3D depth-map capture of the player's face. A morphed 2D image cannot maintain biometric consistency when measured against the volumetric, physical structure of a real person's face in three dimensions. The depth map exposes the flatness and blending artefacts that a 2D comparison misses entirely.

Biometric Template Matching. MAD algorithms test the submitted document image against biometric matchers to evaluate whether a single image produces high confidence scores for multiple distinct individuals. A genuine photograph matches one person. A successful morph matches two. When a document image yields high biometric confidence against two separate reference identities — or produces an anomalously wide confidence distribution across multiple identity templates — it is flagged as a likely morphed composite and escalated for human review.

Adversarial Training and the Arms Race

MAD systems do not remain static. Because the AI tools available to fraudsters — including StyleGAN and its successors — continuously produce more convincing morphs, detection algorithms undergo adversarial training: the detection model is continuously retrained using synthetic attack samples generated by the same morphing tools that fraudsters use. By learning the latest iterative adjustments fraudsters make to bypass vendor matchers, the detection model builds resilience to techniques that postdate its original training data. This is an ongoing process, not a one-time calibration.

Operator scenario — the MAD flag workflow. A UK-licensed operator's KYC system receives a passport image from a new account registration. The document passes OCR and data extraction. The facial recognition comparison produces an acceptable match score. But the MAD layer flags two anomalies: the sensor fingerprint is inconsistent across the image (indicating digital composition rather than a single physical capture), and biometric template matching produces unexpectedly high confidence scores against two distinct individuals in the identity database. The system automatically freezes the account pending review, escalates to the compliance team, and triggers the Enhanced Due Diligence workflow. The compliance officer reviews the forensic flags, confirms the morph indicators, rejects the document submission, requests a notarised alternative, and documents the decision chain for potential SAR consideration.

Bottom line: Basic 2D facial recognition is insufficient against sophisticated morph attacks. A complete KYC integration requires a MAD layer that combines feature-blending artefact detection, sensor fingerprint forensics, 3D depth-map liveness comparison, and biometric template matching — all continuously updated through adversarial training.

CDD, EDD and Risk-Based Player Profiling

Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) are the two tiers of identity and risk verification that regulated iGaming operators must apply under the FATF's Recommendation 10 framework, implemented into law through 4AMLD/5AMLD in the UK and EU and through the Bank Secrecy Act in the US.

CDD — the standard verification tier — requires operators to establish the identity of every player, verify that identity against reliable independent sources, and understand the nature of the player's expected activity on the platform. For most players, this means document verification, biometric liveness check, and basic source-of-funds confirmation. The Financial Action Task Force's Recommendation 10 on customer due diligence sets the international standard that both UKGC and FinCEN-regulated operators must meet as their baseline.

EDD — the enhanced tier — applies when CDD identifies elevated risk indicators. These triggers include: the player is classified as a Politically Exposed Person (PEP) or an immediate family member of one; the player's deposit or spend patterns are inconsistent with their stated income or occupation; the player's source of funds cannot be verified through standard documentation; the player is a national of or has financial connections to a high-risk jurisdiction on the FATF grey or black list; or the KYC system has flagged anomalies — including MAD indicators — during document verification.

PEP screening deserves specific attention. A PEP is an individual who holds or has held a prominent public position — a government minister, senior military official, central bank executive, or equivalent — or an immediate family member or close associate of such a person. PEPs are not automatically denied access to iGaming platforms, but their accounts require EDD from the point of identification and ongoing enhanced monitoring throughout the relationship. The screening database must be queried at onboarding, at any significant account change, and on a continuous automated basis thereafter.

Bottom line: CDD applies to every player at onboarding. EDD applies whenever risk indicators are identified — including MAD flags, PEP status, inconsistent source-of-funds, or anomalous spending patterns. The decision to apply EDD must be documented, and for the highest-risk cases, sign-off from a senior compliance officer or Money Laundering Reporting Officer (MLRO) is mandatory.

Transaction Monitoring, SAR Filing and Ongoing AML Obligations

Transaction monitoring is the AML layer that operates continuously after a player's KYC verification is complete. Its function is to detect patterns of financial behaviour that indicate the platform is being used to layer, place, or integrate illicit funds — the three stages of money laundering.

The monitoring system establishes a behavioural baseline for each player based on their verified identity, stated income, and initial activity patterns. Deviations from that baseline trigger alerts: rapid deposit-and-withdrawal cycling without significant gameplay; structuring — breaking larger deposits into multiple smaller amounts to avoid threshold reporting; soft play — deliberately losing at table games to transfer funds to another player; and chip dumping — coordinated multi-player sessions where one player systematically transfers value to another through controlled losses.

SAR Filing Requirements

A Suspicious Activity Report (SAR) is a formal disclosure filed with the relevant financial intelligence unit when the operator has reasonable grounds to suspect that a transaction involves proceeds of crime or is structured to avoid reporting obligations. In the UK, SARs are filed with the National Crime Agency (NCA) under the Proceeds of Crime Act 2002. In the US, SARs are filed with FinCEN under the Bank Secrecy Act — the baseline filing threshold for gambling businesses is transactions of $5,000 or more where the operator knows, suspects, or has reason to suspect that the funds are from illegal activity [VERIFY BEFORE PUBLISHING — FinCEN thresholds subject to regulatory update].

The filing obligation applies regardless of whether the player has been verified through the KYC process. A fully KYC-compliant player whose transaction patterns subsequently indicate suspicious activity still triggers an SAR obligation. KYC and AML monitoring are complementary, not sequential — a clean KYC outcome does not immunise a player from ongoing AML scrutiny.

Critical operational rule: the SAR must be filed without tipping off the subject. Operators who notify the player that a SAR has been filed — or take account action that would signal an investigation — commit a criminal offence in both the US and UK. The account may continue to operate normally while the SAR is under review, or the operator may apply for a Defence Against Money Laundering (DAML) consent from the NCA in the UK before proceeding with a requested withdrawal.

Bottom line: Transaction monitoring is a continuous obligation, not a periodic audit. SAR filing triggers are behavioural, not threshold-only — unusual patterns below the reporting threshold can still require disclosure. The tipping-off prohibition means that internal compliance procedures must be followed silently, without alerting the player under review.

US State iGaming KYC/AML Requirements: 5-Jurisdiction Breakdown

The United States has no single unified federal iGaming KYC/AML standard. The Bank Secrecy Act and FinCEN regulations establish the federal floor — the minimum obligations that apply to all gambling businesses — but each state that has legalised online casino gaming layers additional requirements on top. Operators launching across multiple US states must satisfy both levels simultaneously.

The five most active regulated US iGaming markets each carry distinct KYC and AML obligations beyond the federal baseline.

Three distinctions across this table require operator attention.

New Jersey prohibits provisional play — the model where a player can deposit and begin playing before KYC verification is complete, with withdrawal blocked until verification passes. The NJ DGE requires identity to be verified before any real-money activity begins. Operators who build an integration that permits provisional play in NJ are in breach of DGE requirements from the first transaction.

Michigan's MGCB specifically requires that geolocation verification be integrated within the KYC stack — not operated as a separate vendor that communicates with the main platform via a separate API call. This architectural requirement has practical implications for operators building multi-state integrations with modular vendor stacks.

Nevada brings the most mature enforcement culture. The Nevada Gaming Control Board has applied AML standards developed over decades of land-based casino oversight to its online framework, and its examination processes are more forensically detailed than in newer regulated states. Operators entering Nevada should treat the NV GCB's examination as equivalent in rigour to a UKGC audit.

All five state frameworks require SAR-equivalent filing to the state regulator in addition to FinCEN obligations — meaning a suspicious activity event in a multi-state operation may require parallel filings to multiple authorities simultaneously. [VERIFY BEFORE PUBLISHING — all state-specific thresholds and requirements]

Bottom line: "US compliance" is not a single standard. Each regulated state adds requirements above the FinCEN baseline, and three critical distinctions — NJ's pre-play identity requirement, Michigan's integrated geolocation mandate, and Nevada's enforcement culture — have direct implications for how operators architect their KYC integration stack.

UK KYC/AML Compliance: UKGC, GamStop and Source-of-Funds

The UK Gambling Commission operates one of the most actively enforced KYC/AML frameworks in the world for online gambling. UKGC-licensed operators face obligations that have tightened substantially following a series of high-profile enforcement actions against operators for AML and social responsibility failures — with fines totalling over £100 million across the sector since 2019.

Source-of-Funds Requirements

The UKGC's enhanced player protection framework — updated through 2023 and 2024 guidance — requires operators to conduct source-of-funds (SOF) checks when a player's spending reaches thresholds that indicate potential financial harm or elevated AML risk. SOF checks require the player to provide documented evidence of the origin of their gambling funds: payslips, tax returns, bank statements, or evidence of an inheritance, property sale, or other qualifying source. The operator cannot simply accept a player's self-declaration above these trigger points.

The specific spend thresholds that trigger mandatory SOF checks are subject to UKGC guidance that updates periodically. Operators must maintain current awareness of the operative threshold levels and build trigger logic into their platform architecture that fires at the correct point rather than relying on manual review. [VERIFY BEFORE PUBLISHING — confirm current UKGC SOF trigger thresholds before publication]

GamStop as a KYC Compliance Layer

GamStop — the UK's national online gambling self-exclusion scheme — is not optional for UKGC-licensed operators, and it functions as a component of the KYC compliance stack rather than a standalone responsible gambling tool. Every UKGC-licensed operator must query the GamStop API at account registration and at every subsequent login. A positive GamStop match — a player who has self-excluded — must result in immediate account access denial, regardless of whether the player's KYC documentation is otherwise valid.

This means GamStop integration is an identity compliance obligation: the operator is required to verify not just that the player is who they claim to be, but that the verified individual has not exercised a right to self-exclusion that the operator is legally required to honour. An operator that allows a GamStop-registered player to access real-money play — even for a single session — faces UKGC enforcement action. The financial penalties for GamStop compliance failures now run to millions of pounds per incident in UKGC enforcement decisions.

UKGC AML Reporting

UK operators must file SARs with the National Crime Agency rather than a gambling-specific regulator. The tipping-off prohibition under the Proceeds of Crime Act 2002 applies with the same force as in the US framework. For transactions where the operator wants to proceed but suspects the funds may be criminal proceeds, the DAML (Defence Against Money Laundering) consent process allows the operator to request NCA approval before executing the transaction — a particularly relevant mechanism for large withdrawal requests that arrive after suspicious deposit behaviour.

UKGC-licensed operators must also appoint a named Money Laundering Reporting Officer (MLRO) who bears personal regulatory responsibility for the AML compliance programme. The MLRO's decisions on SAR filing, EDD escalation, and account action must be documented in an auditable compliance log. UKGC examinations can and do review MLRO decision records as part of routine licence assessments.

Regulation, Safety and Responsible Gambling

KYC and AML compliance sits at the intersection of two regulatory obligations that licensed iGaming operators carry simultaneously: the obligation to prevent financial crime, and the obligation to protect players from gambling-related harm. In both the US and UK, regulators are increasingly explicit that these two obligations are not separate tracks — they are integrated, and the data collected for KYC purposes must be used to inform responsible gambling interventions.

In the UK, the UKGC's expectations are clear: operators must use the information gathered through know-your-customer processes to identify markers of harm and act on them. A player whose source-of-funds documentation reveals income inconsistent with their gambling spend is simultaneously an AML concern and a potential harm case. The compliance system must be capable of routing such cases to both the AML and the responsible gambling response workflow.

In the US, the framework is market-specific. Most regulated states require operators to maintain responsible gambling programmes as a licence condition, and several require that self-exclusion databases be queried as part of the identity verification workflow — creating an explicit link between the KYC and RG compliance stacks.

For players using iGaming platforms in regulated markets, the KYC process — document submission, biometric verification, source-of-funds checks — is the mechanism that licensed operators use to confirm both who you are and that the platform is being used within the legal and financial parameters associated with your identity. It is not an obstacle to access. It is the infrastructure that gives licensed platforms the ability to protect players from harm and protect the financial system from abuse.

Responsible gambling support resources for the two markets covered by this guide are as follows. United Kingdom: GamStop (gamstop.co.uk) — national self-exclusion register linked to all UKGC-licensed operators; GamCare (gamcare.org.uk) — 24/7 support and counselling; National Gambling Helpline 0808 8020 133 (free, confidential). United States: National Problem Gambling Helpline — 1-800-522-4700 (24/7, free, confidential); National Council on Problem Gambling (ncpgambling.org); state-specific resources vary — operators must link to the relevant state programme for each jurisdiction in which they are licensed.

Frequently Asked Questions

Q: What is KYC in iGaming?

KYC (Know Your Customer) in iGaming is the identity verification process that licensed operators must complete before allowing players to deposit, play, or withdraw real money. It requires players to submit a government-issued photo ID, proof of address, and — above certain spend thresholds — documentation of the source of their gambling funds. KYC also includes biometric liveness detection to confirm the submitting person matches the document, and in advanced integrations, morph-detection algorithms that screen for synthetic composite identity documents. Both UKGC and US state regulators require KYC before real-money activity begins.

Q: How does AML compliance work at online casinos?

AML (Anti-Money Laundering) compliance at online casinos operates through continuous transaction monitoring that analyses each player's deposit, withdrawal, and betting patterns against behavioural baselines established at account opening. When patterns deviate in ways that suggest layering, structuring, soft play, or chip dumping, the system generates an alert for compliance review. If the operator has reasonable grounds to suspect criminal proceeds, a Suspicious Activity Report must be filed with the relevant authority — FinCEN in the US, the National Crime Agency in the UK — without notifying the player that a report has been made.

Q: What documents are required for casino KYC?

Standard casino KYC requires a government-issued photo ID (passport or national ID card preferred; driving licence accepted in most markets), proof of address dated within the last three months (utility bill, bank statement, or official government correspondence), and in some markets a selfie or live video capture for biometric matching. Above certain deposit or spend thresholds, operators are required to request source-of-funds documentation: payslips, bank statements, tax returns, or evidence of an inheritance or asset sale. The specific documents accepted vary by operator and jurisdiction.

Q: How long does casino KYC verification take?

Automated KYC verification using modern identity verification platforms typically completes within 2 to 10 minutes for clear document submissions from low-risk applicants. Manual review — triggered by document quality issues, MAD flags, PEP status, or source-of-funds requirements — can take 24 to 72 hours. Enhanced Due Diligence cases requiring additional documentation may take several business days. UK operators are prohibited from allowing real-money withdrawals until KYC is complete; New Jersey operators are prohibited from allowing any real-money activity until verification passes. Incomplete or inconsistent document submissions are the most common cause of verification delays.

Q: What is enhanced due diligence in gambling?

Enhanced Due Diligence (EDD) is the elevated verification tier applied to players identified as higher risk during or after standard Customer Due Diligence (CDD). EDD triggers include: PEP status, inconsistent source-of-funds, suspicious transaction patterns, connections to high-risk jurisdictions, or technical flags from biometric verification including morph-detection alerts. EDD requires more extensive documentation than standard KYC — potentially including notarised documents, video verification, or direct senior compliance officer review — and imposes ongoing enhanced transaction monitoring throughout the player relationship. EDD decisions must be approved by a senior compliance officer or MLRO and documented in an auditable record.

Q: How do casinos detect money laundering?

Casinos detect money laundering through a combination of transaction monitoring systems that analyse deposit, withdrawal, and gameplay behaviour in real time, and manual compliance review of flagged accounts. Specific patterns that trigger AML alerts include: rapid deposit-and-withdrawal cycling with minimal gameplay; structuring deposits into amounts below reporting thresholds; soft play at table games to transfer value to another player; inconsistency between stated income and actual platform spending; and connections to known high-risk sources including sanctioned entities or high-risk jurisdictions. Blockchain analytics tools are used for cryptocurrency deposits to screen wallet addresses against risk databases before funds are accepted.

Q: What happens if I fail casino KYC verification?

If KYC verification fails, the operator will typically freeze the account, block any pending withdrawals, and request additional documentation. The specific outcome depends on why verification failed: document quality issues can be resolved by resubmission; source-of-funds concerns require additional documentation; identity mismatches or biometric anomalies — including morph-detection flags — may result in permanent account closure and fund return to the originating payment method. In cases where the operator suspects deliberate identity fraud, the account may be referred for internal investigation and a SAR may be filed with the relevant financial intelligence unit without the player being notified.

Q: What is a morph detection algorithm and why do casinos use it?

A morph-detection algorithm (MAD) is a neural network trained to identify composite identity document images — photos algorithmically blended from two or more real faces — that are used to bypass biometric verification systems. MAD systems work by detecting feature-blending artefacts left by AI morphing tools, analysing camera-sensor fingerprints for inconsistencies that indicate digital synthesis rather than physical capture, comparing 2D document images against 3D depth-map live captures, and running biometric template matching to identify whether a single image produces high confidence scores for multiple distinct individuals. Casinos use MADs to prevent shared accounts where two individuals use one morphed identity to circumvent unique ownership requirements.

Q: How does GamStop integrate with KYC verification in the UK?

GamStop is the UK's national online gambling self-exclusion scheme, and UKGC-licensed operators must query its API at every player login — not just at registration. When a player completes KYC verification and their identity is confirmed, the system simultaneously checks the verified identity against the GamStop database. A positive match requires immediate account access denial regardless of KYC status. This means GamStop integration functions as a component of the KYC compliance stack: verifying identity is insufficient without also verifying that the confirmed identity has not exercised a legally binding self-exclusion. Failure to implement real-time GamStop queries is a UKGC compliance breach carrying significant financial penalties.

Q: What is a Suspicious Activity Report and when must online casinos file one?

A Suspicious Activity Report (SAR) is a formal disclosure filed with a financial intelligence authority when an operator has reasonable grounds to suspect that a transaction involves proceeds of crime or is structured to avoid reporting obligations. In the UK, SARs are filed with the National Crime Agency under the Proceeds of Crime Act 2002. In the US, SARs are filed with FinCEN under the Bank Secrecy Act. The filing obligation is triggered by reasonable suspicion — it does not require certainty or proof. Once a SAR decision is made, the operator is legally prohibited from notifying the player that a report has been filed. The account may continue to operate normally, or the operator may apply for DAML consent before processing a requested transaction.

Q: How do US state iGaming KYC requirements differ from federal rules?

The federal FinCEN and Bank Secrecy Act framework establishes the minimum KYC and AML floor for all US gambling businesses. Each licensed state adds requirements above that baseline. New Jersey requires identity verification before any real-money activity — no provisional play is permitted. Michigan requires geolocation verification to be integrated within the KYC technology stack rather than operated as a separate system. Nevada applies its historically rigorous land-based casino AML examination culture to online operations. Pennsylvania has more explicit source-of-funds documentation requirements than the federal baseline. Operators launching across multiple states must satisfy both the federal floor and each state's specific requirements simultaneously.

Q: What is the difference between CDD and EDD at online casinos?

Customer Due Diligence (CDD) is the standard identity verification tier applied to all players at account opening: document verification, biometric liveness check, PEP and sanctions screening, and basic source-of-funds confirmation. Enhanced Due Diligence (EDD) is a higher-intensity verification process triggered when CDD identifies elevated risk — including PEP status, inconsistent source-of-funds, suspicious transaction patterns, or biometric anomalies from morph-detection systems. EDD requires more extensive documentation, ongoing enhanced transaction monitoring at lower alert thresholds, and sign-off from a senior compliance officer or MLRO. The decision to apply EDD must be documented in an auditable compliance record that regulators can review during licence examinations.

Sources & References

• Financial Action Task Force (FATF) — https://www.fatf-gafi.org — Recommendation 10 (Customer Due Diligence) and Recommendation 16 (Travel Rule) frameworks referenced throughout CDD/EDD and transaction monitoring sections
• UK Gambling Commission — https://www.gamblingcommission.gov.uk — UKGC KYC/AML obligations, source-of-funds requirements, GamStop integration mandate, and MLRO appointment requirements cited in UK compliance section
• FinCEN / US Treasury — https://www.fincen.gov — Bank Secrecy Act obligations, SAR filing requirements, and federal gambling business AML threshold framework cited in US compliance sections
• Identity verification technical research — morph-detection algorithm (MAD) methodology: feature-blending artefact detection, camera-sensor fingerprint forensics, 3D depth-map liveness comparison, biometric template matching, and adversarial training methodology cited in document verification section
• National Crime Agency (UK) — https://www.nationalcrimeagency.gov.uk — SAR filing obligations, DAML consent process, and tipping-off prohibition under the Proceeds of Crime Act 2002 cited in UK AML reporting section