Crypto AML Requirements for iGaming: What Operators Need to Know

The practical objective is straightforward:

Build an AML process that can identify risk before or during the payment decision, connect that risk to the player record, and preserve enough evidence to explain what happened later.

Why crypto changes the AML conversation for iGaming

Most established iGaming operators already have an AML framework.

It may include:

• Customer identification and verification

• Customer risk scoring

• Source-of-funds checks

• Source-of-wealth checks

• Deposit and withdrawal monitoring

• Velocity and threshold rules

• Suspicious activity escalation

• Enhanced due diligence

• Record keeping

• AML training

• MLRO or equivalent oversight

Adding crypto does not mean throwing that framework away.

It means extending it to account for characteristics that are different from traditional payment methods.

With a bank transfer, an operator may receive information about the originating account and payment institution.

With an on-chain crypto transaction, the payment can instead be associated with a blockchain address and transaction history.

That creates another source of information for the operator's risk assessment.

The important question becomes:

What does the operator know about the transaction, the wallet, the player, and the surrounding activity at the point a payment decision is made?

What are crypto AML requirements for iGaming operators?

There is no single set of crypto AML requirements that applies to every online casino or sportsbook.

The applicable requirements can depend on:

• Gaming licence

• Country of operation

• Player location

• Type of gaming activity

• Payment structure

• Custody model

• Whether the operator directly accepts crypto

• Whether a third-party payment provider is involved

• Whether crypto is converted into fiat

• Applicable virtual-asset or financial-services regulation

Despite those differences, a strong crypto AML framework generally needs to address several core areas.

1. Customer due diligence

The operator needs to understand who the customer is and assess the customer's risk in accordance with the applicable rules.

This can include:

• Identity verification

• Customer risk classification

• Beneficial ownership checks where relevant

• Geographic risk

• Sanctions screening

• Ongoing customer monitoring

• Enhanced due diligence for higher-risk customers

Crypto does not replace KYC.

Instead, crypto transaction information can become another input into the customer's overall risk profile.

2. Crypto transaction monitoring

Transaction monitoring should look beyond simple deposit amounts.

Depending on the operator's risk model and available data, relevant indicators can include:

• Unusual player deposits

• Rapid movement of funds

• Large changes in transaction behaviour

• Multiple wallets associated with one customer

• Unusual deposit and withdrawal patterns

• Transactions involving higher-risk counterparties

• Activity inconsistent with the customer's known profile

• Suspicious changes in payment behaviour

Blockchain analytics can provide additional information about wallet activity and transaction provenance. AI payment monitoring can add another layer by identifying unusual patterns across payment activity and helping operators surface transactions that may require further review.

However, blockchain screening should not be treated as a replacement for customer-level monitoring.

The strongest approach connects on-chain signals with the player's broader activity.

3. Wallet and counterparty screening

One of the main differences between crypto and traditional payment methods is the availability of blockchain transaction data.

Depending on the network and monitoring solution, an operator may be able to identify exposure to categories of addresses associated with:

• Sanctioned entities

• Known scams

• Fraud

• Stolen assets

• Illicit marketplaces

• High-risk services

• Other risk categories identified by the analytics provider

The existence of an exposure does not automatically mean that every transaction should be treated identically.

Risk should be assessed according to the operator's policies, applicable rules, the nature of the exposure, and the available evidence.

That is why a useful screening system needs more than a simple "pass" or "fail" result.

4. Source of funds and source of wealth

Source-of-funds checks are important when an operator needs to understand where a customer's gambling funds came from.

Crypto can make this more complex because funds can move through multiple addresses or services before reaching the operator.

Depending on the customer's risk profile and applicable requirements, additional information may be necessary to understand:

• Where the funds originated

• How the customer acquired the crypto

• Whether the activity is consistent with the customer's profile

• Whether the transaction history raises additional concerns

• Whether supporting documentation is required

Source of funds should not be treated as a one-time checkbox.

A significant change in customer behaviour can create a reason to reassess the available information.

5. Enhanced due diligence

Higher-risk customers or transactions may require additional investigation.

Potential risk factors can include:

• Unusual transaction patterns

• High-value activity

• Higher-risk jurisdictions

• Significant crypto exposure

• Complex transaction structures

• Adverse information

• Sanctions-related concerns

• Unexplained changes in source of funds

• Activity inconsistent with the customer's known profile

Enhanced due diligence should be based on the operator's risk framework and applicable requirements rather than a universal transaction threshold.

6. Suspicious activity escalation and reporting

When activity reaches the relevant suspicion threshold, operators need a defined process for escalation and reporting.

The exact reporting mechanism and timelines vary by jurisdiction.

A useful operational process should establish:

1. How an alert is generated

2. Who reviews it

3. What information the reviewer can access

4. When additional information is requested

5. When the transaction or account is restricted

6. When the matter is escalated internally

7. When a report must be considered or submitted

8. How the investigation is documented

The objective is to make suspicious activity handling a controlled workflow rather than an ad hoc decision.

7. Record keeping

AML compliance is difficult to demonstrate if the operator cannot reconstruct what happened.

For each relevant payment or investigation, the business should be able to establish, subject to applicable retention requirements:

• Customer identity

• Transaction details

• Wallet information where available

• Screening result

• Risk indicators

• Source-of-funds information where collected

• Decision made

• Date and time of relevant actions

• Escalation history

• Investigation notes

• Reporting outcome where applicable

Keeping only a final "approved" or "rejected" status may not provide enough context.

The stronger evidence trail shows how the decision was reached.

How crypto AML differs from traditional payment monitoring

Crypto does not necessarily require an entirely separate AML programme.

Instead, it introduces another data layer.

The important point is that crypto monitoring should complement the existing AML framework rather than operate as an isolated dashboard.

What does the iGaming operator remain responsible for?

This is one of the most important questions when a third-party crypto payment provider is involved.

A payment provider may supply:

• Payment processing

• Wallet infrastructure

• Blockchain screening

• Transaction monitoring

• Risk signals

• Settlement

• Payment reporting

• API integrations

That does not automatically mean the provider assumes every AML responsibility associated with the gaming operation.

The operator should establish contractually and operationally:

• Who performs KYC?

• Who performs transaction screening?

• Who makes the final payment decision?

• Who monitors player behaviour?

• Who handles suspicious activity escalation?

• Who retains the relevant records?

• Who provides information during an audit or regulatory review?

• Who is responsible for reporting?

• Who controls the funds during settlement?

• What happens when a provider flags a transaction?

This division of responsibilities should be documented before the payment integration goes live.

Why payment-provider due diligence matters

Choosing a crypto payment provider is therefore also a compliance decision.

Before integrating a crypto payment gateway, operators should understand:

Regulatory status

Determine what regulated activities the provider performs and which entity performs them.

Custody

Establish whether the provider holds or controls customer or operator funds.

Screening

Understand what wallet and transaction screening is available and when it occurs.

Data

Determine whether the operator receives the information needed for its own monitoring and record keeping.

Escalation

Find out what happens when a transaction generates a high-risk result.

Auditability

Ask whether historical screening decisions can be retrieved with timestamps and transaction references.

Business continuity

Understand what happens to funds, payment flows, and records if the provider experiences an outage.

A provider should be treated as part of the operator's compliance and payment architecture, not simply as a checkout supplier.

When should crypto screening happen?

Timing matters.

Consider two payment flows.

Post-settlement screening

A player sends crypto.

The transaction confirms.

The funds are credited to the player's balance.

The transaction is then screened.

If a problem is identified, the operator has to determine what happened after the player balance has already been affected.

Pre-credit or pre-settlement decisioning

The transaction is screened before the relevant payment event is completed.

The system can then apply a defined outcome, such as:

• Accept

• Hold

• Reject

• Escalate for review

The exact implementation depends on the payment architecture.

But from an operational perspective, screening is most useful when its result can influence the payment flow rather than simply create a report after the fact.

What evidence should an operator be able to produce?

Imagine a regulator, auditor, banking partner, or internal compliance team asks:

Why did you accept this crypto deposit?

A strong answer should not require searching across several disconnected systems.

The operator should ideally be able to connect:

Player → Payment → Wallet → Risk result → Decision → Action

For example:

• Player identifier

• Deposit identifier

• Asset and network

• Wallet/address information

• Transaction hash

• Screening timestamp

• Risk result

• Relevant risk indicators

• Decision

• Manual reviewer, if applicable

• Resulting action

This creates an audit trail that can be understood without reconstructing the entire event manually.

How AML controls should fit into the payment architecture

A practical crypto AML setup should connect the player's account, payment flow, blockchain activity, risk controls, and compliance workflows.

An iGaming payment gateway can sit at the centre of this architecture, connecting players and payment networks while passing relevant transaction and risk information to the systems responsible for monitoring and decision-making.

Player platform

Stores the customer relationship, account information, balance, and gaming activity.

KYC and compliance layer

Manages identity verification, customer risk, source-of-funds processes, and compliance workflows.

Payment gateway

Processes deposits and withdrawals and communicates payment states to the operator.

Blockchain analytics

Provides relevant on-chain risk signals and transaction information.

Risk engine

Combines payment, customer, and other available signals to support risk decisions.

Case management

Provides a controlled workflow for alerts, investigations, escalations, and outcomes.

Reporting and audit layer

Preserves the information required to reconstruct important decisions.

The key is integration.

A well-designed payment risk management process connects these systems so that risk information can influence the payment decision and remain available as evidence afterwards.

Common crypto AML mistakes in iGaming

Treating KYC as the entire AML programme

KYC establishes who the customer is.

It does not explain everything that happens after the customer has been verified.

Screening only at onboarding

A customer can become higher risk after onboarding.

Transaction monitoring needs to operate throughout the customer relationship where required by the applicable framework.

Treating every crypto transaction as equally risky

Crypto is not a single risk category.

Bitcoin from one source and a transaction involving a high-risk counterparty can present very different risk signals.

Relying entirely on the payment provider

Third-party infrastructure can support compliance, but the operator needs to understand its own responsibilities and the controls it is relying on.

Keeping only the final decision

"Approved" does not explain why.

Preserving the relevant inputs, timestamps, risk indicators, and actions creates much stronger evidence.

Running AML and payments as separate systems

If compliance information never reaches the payment flow, risk alerts may arrive too late to influence the transaction.

Using fixed thresholds without a risk rationale

A threshold should exist because it makes sense within the operator's risk framework and applicable requirements, not simply because another operator uses the same number.

How LightningPay can fit into crypto AML operations

LightningPay provides payment infrastructure for iGaming operators handling Bitcoin, Lightning, and stablecoin transactions, including stablecoin payment gateway capabilities. Its monitoring tools provide visibility across deposits, withdrawals, swaps, on-ramp, and off-ramp activity, with anomaly detection and suspicious payment identification.

For operators where crypto custody is part of the payment architecture, LightningPay also provides custody infrastructure covering digital assets, key management, and treasury operations.

The key point: technology should support an operator's AML programme, not replace its regulatory responsibilities.

Crypto AML requirements by licence: what changes?

There is no universal crypto AML standard that can simply be copied across every iGaming licence.

Malta

Malta's gaming AML framework uses a risk-based approach, with gaming licensees subject to AML/CFT obligations and supervision involving the MGA and FIAU. Operators accepting virtual financial assets also need to consider the specific requirements applicable to those payment arrangements.

The MGA states that B2C gaming licensees must apply risk-based AML/CFT measures and maintain appropriate policies, procedures, and controls.

Operators should therefore assess crypto within their broader business risk assessment rather than treating it as a separate payment feature.

United Kingdom

The UK Gambling Commission has specifically highlighted risks associated with cryptoassets.

Operators are expected to understand the payment services they use and assess the AML risks associated with new payment methods.

The Commission has also stated that funds originating from cryptoassets can be a relevant high-risk indicator requiring appropriate scrutiny and due diligence.

For UK operators, the important lesson is that accepting crypto can affect the customer's risk assessment and source-of-funds analysis.

Curaçao and other jurisdictions

Crypto AML obligations in Curaçao and other gaming jurisdictions should be assessed against the current local framework rather than relying on assumptions based on another licence.

The relevant questions include:

• Is crypto an approved payment method?

• What AML legislation applies?

• What customer due diligence is required?

• What reporting obligations apply?

• What payment providers may be used?

• Does the payment arrangement introduce separate virtual-asset regulation?

• What records must be retained?

Operators should confirm the current requirements for the exact licence and entity structure they operate under.

US sweepstakes and other models

US sweepstakes businesses require particular care because the regulatory analysis can involve multiple federal and state regimes rather than one universal gaming AML framework.

Depending on the business model and payment structure, considerations can include:

• FinCEN requirements

• State money transmission rules

• Sanctions obligations

• Consumer protection requirements

• Gaming or sweepstakes-specific rules

• Payment-provider requirements

Operators should obtain jurisdiction-specific legal and compliance advice before assuming that a crypto payment arrangement falls within a particular regulatory category.

How to build a practical crypto AML framework

A strong programme can be organised into six stages.

Stage 1: Risk assessment

Identify the crypto-related risks associated with:

• Customers

• Jurisdictions

• Assets

• Networks

• Payment methods

• Custody

• Deposits

• Withdrawals

• Third parties

Stage 2: Customer controls

Define:

• KYC requirements

• Customer risk scoring

• Source-of-funds triggers

• Enhanced due diligence triggers

• Sanctions screening

Stage 3: Transaction controls

Define:

• Deposit monitoring

• Withdrawal monitoring

• Wallet screening

• Transaction thresholds

• Velocity rules

• High-risk exposure handling

• Manual review triggers

Stage 4: Decisioning

Establish what happens when a transaction is:

• Low risk

• Unclear

• High risk

• Potentially suspicious

• Sanctions-related

Stage 5: Investigation and reporting

Define who investigates alerts, who approves outcomes, who escalates cases, and who handles applicable reporting.

Stage 6: Evidence and review

Make sure the business can retrieve the relevant information later and periodically test whether the controls are actually working.

Crypto AML compliance checklist for iGaming operators

Before launching or expanding crypto payments, confirm that you have addressed:

• Applicable gaming licence requirements

• Applicable virtual-asset or financial-services requirements

• Business risk assessment

• Customer risk assessment

• KYC and CDD

• Source-of-funds procedures

• Casino withdrawals monitoring

• Enhanced due diligence

• Sanctions screening

• Wallet and transaction screening

• Deposit monitoring

• Withdrawal monitoring

• Suspicious activity escalation

• Record retention

• Audit trail

• Payment-provider due diligence

• Custody model

• Compliance ownership

• Incident and escalation procedures

• Data access and export

• Periodic testing and review

Signing off

Crypto does not replace an iGaming operator's AML framework.

It changes the information available to that framework.

A strong crypto AML programme connects KYC, customer risk, source of funds, transaction monitoring, wallet intelligence, sanctions screening, payment controls, investigation workflows, and record keeping into one process.

The most important question is not whether an operator has an AML policy.

It is whether the operator can demonstrate what happened when a real crypto transaction presented a risk.

Who was the customer?

Where did the funds come from?

What did the monitoring system identify?

What decision was made?

When was it made?

Who reviewed it?

And can the operator produce the evidence later?

That is the standard a well-designed crypto payment and compliance architecture should be built to support.