AML Red Flags iGaming Operators Miss Until the Audit

Monitoring rules built for launch, not for the current customer base

Transaction monitoring thresholds set at licensing are often never revisited as the customer base grows and diversifies. A rule set calibrated for a small, early customer pool can miss patterns that would clearly warrant review at current volumes — not because the rules were wrong, but because they were never updated.

Enhanced due diligence triggers that exist on paper but aren't operationally applied

It's common to find an AML policy that correctly lists the triggers for enhanced due diligence — high-risk jurisdictions, PEP status, unusual deposit patterns — while the operational team applying it day to day has never been trained on how to actually recognise them in the platform's own data. A policy document and an operational practice are two different things, and auditors test the second one.

Escalation workflows with no clear ownership

A flagged transaction is only as good as what happens to it next. We regularly find escalation processes where it's unclear who reviews an alert, within what timeframe, and what the threshold is for filing a suspicious activity report. Regulators ask for this workflow specifically, and 'it depends who's on shift' is not an answer that holds up.

Source-of-wealth checks that stop at source-of-funds

Source-of-funds (where did this specific deposit come from) and source-of-wealth (how did this customer accumulate their overall wealth) are related but distinct checks, and regulators increasingly expect both for higher-risk or higher-value customers. Programmes that only ever ask the source-of-funds question are increasingly exposed on this point.

What to do before the audit, not during it

None of these gaps are visible from the policy document alone — they show up when someone tests the operational reality against it. A structured gap analysis, run on a schedule rather than only when a regulator audit is announced, is the difference between finding these issues on your own terms and finding them on the regulator's.