Beneficial Ownership Verification in iGaming: Mapping FATF Guidance onto Your KYC Programme

FATF does not issue gambling licences and cannot impose fines on iGaming operators. What it does is set the international standards that 200-plus member jurisdictions are obligated to transpose into domestic law. For iGaming, the practical consequence is that every major licensing regime, UKGC, MGA, GRA Gibraltar, FINTRAC Canada, Curaçao CGA, derives its beneficial ownership obligations from the same source: the FATF Forty Recommendations, and in particular Recommendation 24 on beneficial ownership of legal persons. Compliance teams that approach beneficial ownership verification as a box-ticking onboarding step misread both the standard and the enforcement risk.

Where Casinos Sit in the FATF Framework

FATF Recommendation 22 designates casinos, including online casinos, as Designated Non-Financial Businesses and Professions (DNFBPs). That classification places iGaming operators inside the same AML/CFT obligations that apply to lawyers, accountants, and real estate agents: customer due diligence, record-keeping, suspicious transaction reporting, and beneficial ownership verification. Recommendation 24 then sets the architecture for how beneficial ownership must be determined for legal persons, companies, partnerships, trusts, and similar structures, that open or control accounts with a DNFBP.

The threshold most operators recognise is 25 percent: any natural person holding 25 percent or more of the shares, voting rights, or profit entitlement of an entity is a beneficial owner under the FATF standard. The Curaçao CGA AML/CFT Policy reflects this precisely, requiring casinos to gather “identification information, verification and evidence for all persons holding 25% or more of the shares or voting rights or a person who otherwise exercises ultimate effective control of the customer.” Canada’s FINTRAC guidance under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) mirrors this, defining beneficial owners as individuals who directly or indirectly own or control 25 percent or more of the shares of a corporation, or equivalent interests in other entities.

“Where no natural person is identified under the 25% threshold items, the natural person who holds the position of senior managing official should be identified as the beneficial owner.”, Curaçao CGA AML/CFT Policy

This fallback provision is operationally critical. It prevents the common compliance gap where a complex holding structure produces no identifiable UBO above the percentage threshold, and the file is closed without a named individual. Every corporate account, hedging account, or B2B counterparty file must resolve to at least one named natural person.

What Does FATF Recommendation 24 Actually Require?

Recommendation 24 requires countries to ensure that legal persons created in their jurisdiction are subject to adequate, accurate, and up-to-date information on beneficial ownership, and that this information is accessible to competent authorities on a timely basis. For the iGaming operator, this translates into three distinct obligations: identification of who the beneficial owners are, verification of their identity against a reliable and independent source, and ongoing monitoring to keep that information current throughout the business relationship.

Identification means obtaining the corporate structure, ownership chart, and any shareholder agreements that affect control. Registered company details are a starting point, not the end of the analysis. Nominee arrangements, bearer shares in jurisdictions that still permit them, and complex trust structures all require the compliance team to trace past the first legal layer.

Verification means confirming that the identified beneficial owners are who they claim to be, using information from a reliable and independent source. The Gibraltar AML Code of Practice for Remote Gambling (v.1.0.2026) requires licence holders to apply reasonable steps to verify the identity of the beneficial owner “using information or data obtained from a reliable source.” The Code explicitly states that inferences drawn from payment methods or previous transactional behaviour cannot substitute for effective CDD measures: they can inform the customer risk profile, but they cannot replace the evidential foundation that CDD requires.

Ongoing monitoring is where most programmes fail. A UBO verified at account opening is correct on the day it is recorded. Corporate ownership can change without notification, and unless the operator has a systematic trigger for periodic refresh, typically tied to the customer risk rating, the file will quietly become stale.

How Do Regulators Translate the FATF Standard into Domestic Obligations?

Each major iGaming regulator reaches the same underlying requirement through different primary legislation, but the operational demand is consistent: identify, verify, and monitor. The table below maps how five regulators have implemented beneficial ownership obligations derived from the FATF standard.

Regulator	Primary Legislative Instrument	UBO Threshold	Notification / Reporting Obligation
UKGC (Great Britain)	LCCP Condition 12.1.1 / 15.2.1, Proceeds of Crime Act 2002	5% for shareholder notification, 25% for AML CDD	Report ownership changes at 5% threshold, suspicious activity via SAR
MGA (Malta)	Gaming Act (Chapter 583); PMLA / FIAU AML obligations	Qualifying UBO (any holding triggering MGA fit-and-proper assessment)	MGA must hold current list of Qualifying UBOs, changes notifiable under Regs 36, 37 Authorisations Directive
GRA / Gambling Commissioner (Gibraltar)	Gambling Act 2005, Proceeds of Crime Act 2015, AML Code v.1.0.2026	25% shares/voting rights, otherwise senior managing official	B2B and B2C licence holders must apply internal due diligence to commercial suppliers, joint venture changes reportable to Gibraltar Licensing Authority
Curaçao CGA	LOK (Landsverordening op de Kansspelen, 2024); NORUT, NOIS, MLTFPO	25% shares/voting rights or ultimate effective control	UBO changes attract per-UBO application fee (EUR 128 per change); CGA approval required
FINTRAC (Canada)	Proceeds of Crime (Money Laundering) and Terrorist Financing Act, PCMLTFR SOR/2002-184	25% direct or indirect ownership or control	Beneficial owner records retained, unusual transactions reported via FINTRAC reporting regime

The Proxy Account Problem: Beneficial Ownership at the Player Level

Beneficial ownership analysis in iGaming has two dimensions that compliance programmes must treat separately. Recommendation 24 is concerned with the ownership of legal persons, the entity that holds the account or the licence. But iGaming also faces a distinct risk at the individual player account level: the use of a third party’s identity to conceal who is actually funding and controlling the account.

The Gibraltar AML Code of Practice v.1.0.2026 addresses this directly at section 6.17, defining proxy account risk as “the use of third party identities by the true beneficial owner or controller of account(s) to mislead a Licence Holder as to the ownership or control of the account, the source of funds, or into accepting business that the Licence Holder might otherwise have monitored or refused.” The Code requires licence holders to implement controls specifically targeting this risk, not merely to include it within a general fraud framework.

In practice, proxy account indicators include mismatches between the registered account holder’s payment methods and their documented income, third-party deposits from individuals with no apparent connection to the account holder, and withdrawal requests to bank accounts in different names. These signals require investigation under the CDD framework, not just flagging as fraud. The underlying question, who is actually controlling and benefiting from this account, is a beneficial ownership question.

Corporate Accounts, B2B Relationships, and the White-Label Risk

The most underweighted beneficial ownership risk in iGaming compliance programmes is not the individual high-value player. It is the corporate account and the white-label partnership. The Curaçao CGA AML/CFT Policy explicitly distinguishes between ordinary consumer gaming accounts and “business participant” accounts such as hedging accounts opened by companies to manage matchbook exposure. For the latter, the casino must obtain satisfactory evidence to identify the business participants and take reasonable steps to verify the beneficial owner of the company.

The Gibraltar Code at section 5.8 extends this obligation to all commercial relationships, requiring both B2B and B2C licence holders to “apply internal due diligence measures to establish and be satisfied with the ultimate beneficial ownership and control of their commercial suppliers or commercial users of their gambling services.” This is not a licensing-stage-only obligation. The Code requires ongoing monitoring, and any significant management or control changes in a joint venture or content supply arrangement must be reported to the Gibraltar Licensing Authority.

The UKGC’s 2026 money laundering risk assessment identified insufficient scrutiny of white-label partnerships as an active money laundering risk in the British licensed market. According to iGamingBusiness, 31 July 2026, the UKGC’s concern was that principal licensees were failing to conduct adequate due diligence on the beneficial owners behind white-label operators, creating a gap through which the controls of LCCP Condition 12.1.1 could be circumvented. LCCP Condition 15.2.1 requires licensees to report any person who becomes a shareholder holding 5 percent or more of the issued share capital of the licensee or its holding company, a threshold that is considerably more sensitive than the 25 percent FATF floor.

Mauritius moved in April 2026 to make this explicit at the licensing stage, passing the Anti-Money Laundering, Combatting the Financing of Terrorism and Countering Proliferation Financing (Miscellaneous Provisions) Bill, which requires beneficial ownership details to be submitted by gambling operators as part of the licence application itself. According to iGamingBusiness, 22 July 2026, that approach, front-loading the UBO assessment before authorisation is granted, reflects the direction regulators are moving globally. Operators navigating the post-LOK Curaçao regime should note that the CGA similarly requires UBO integrity assessment in Phase 1 of its two-phase application process, as set out in the Curaçao LOK framework transition guidance.

FATF Grey-Listing and Enhanced Due Diligence

Recommendation 19 requires countries to apply enhanced due diligence to business relationships and transactions with natural and legal persons from jurisdictions identified by FATF as having strategic AML/CFT deficiencies. For iGaming operators, this creates a continuous monitoring obligation that extends beyond onboarding.

The Gibraltar AML Code addresses this directly at section 8.3, noting that FATF publishes a list of high-risk jurisdictions subject to a call for action and that licence holders must apply enhanced due diligence in respect of those jurisdictions. The Code also references the grey list of countries under increased monitoring, requiring heightened scrutiny even where a full call for action has not been issued. Following the February 2026 FATF plenary, Kuwait and Papua New Guinea joined the increased monitoring list, bringing the total to 22 jurisdictions. Compliance teams must translate that figure into updated jurisdiction risk matrices and, where necessary, revised CDD procedures for customers connected to those countries.

The practical implication for beneficial ownership verification is that a UBO who is a national of, or whose assets are located in, a grey-listed jurisdiction cannot be verified to the same standard as a UBO in a low-risk jurisdiction. Enhanced measures are required: additional source-of-wealth documentation, more frequent ongoing monitoring reviews, and MLRO-level approval for account continuation rather than delegated sign-off.

Operationalising the Beneficial Ownership Workflow

Compliance programmes that treat beneficial ownership as a static data collection exercise consistently fail regulatory inspection. The FINTRAC guidance under the PCMLTFR (as effective from October 2025) requires casinos to maintain ongoing monitoring activities commensurate with the risk profile of the client, and to ensure that the beneficial ownership information in the client file reflects what is currently known about the entity and its control structure.

A functional beneficial ownership workflow in iGaming must address four distinct scenarios. Consumer accounts require verification of the account holder as the beneficial owner of the funds used, particularly where third-party funding sources are detected. Corporate or business participant accounts require full UBO mapping to the natural-person level, with fallback to senior managing official where no individual exceeds the percentage threshold. B2B counterparties in content supply, payment processing, and white-label arrangements require the same UBO mapping applied to commercial relationships. Ongoing account relationships require a documented refresh cycle, risk-rated to trigger enhanced review when a customer’s jurisdiction risk, PEP status, or ownership structure changes.

The MGA Compliance Audit Manual makes the tracking dimension explicit: the MGA expects to hold a current list of Qualifying Ultimate Beneficial Owners for each licensee at all times, and any discrepancy between the MGA’s records and the actual current ownership structure is treated as a regulatory finding under Regulations 36 and 37 of the Authorisations and Compliance Directive. That same logic applies to the operator’s own customer files: the file must reflect current reality, not historical verification.

A beneficial ownership file that was accurate at account opening but has not been reviewed in 18 months is not a compliant file. It is a liability waiting to be discovered in the next audit.

PEP Intersection with Beneficial Ownership

A beneficial owner who is a Politically Exposed Person creates a compounded risk that standard CDD cannot adequately address. Both the FATF standard and the Gibraltar AML Code require that, where a beneficial owner is identified as a PEP, the account must be subject to MLRO or senior-manager-level approval, enhanced source-of-funds and source-of-wealth assessment, and ongoing monitoring at an elevated intensity. The Gibraltar Code at section 8.2 requires that, under the Proceeds of Crime Act (Gibraltar), when determining CDD measures, licence holders must take into account whether a customer or beneficial owner is a PEP. The obligation attaches to the beneficial owner, not just to the named account holder.

This is where UBO databases, adverse media screening, and PEP list providers become operationally necessary. An operator cannot fulfil MLRO-approval requirements for PEP-UBO accounts without a systematic process for identifying PEP status at the beneficial owner level, separately from the account holder level. A customer who is themselves clean on PEP screening but whose UBO is a former government minister requires the same enhanced treatment as a direct PEP account.

Documentation Standards That Survive Regulatory Inspection

The FINTRAC guidance identifies specific records that must be maintained for entity identification. For a corporation, the certificate of incorporation and any record confirming the corporation’s existence, containing its name, address, and names of directors, must be retained. The registration number, type of identification document consulted, and, where an electronic database was used, the name of the database and the date it was searched must all be recorded. For more complex structures, the confirmation-of-existence method must be supported by documents that are authentic, valid, and current.

In practice, compliance teams should structure their UBO files to answer the question an auditor or regulator will ask: “Show me, from your records, who ultimately owns and controls this account or counterparty, and show me when that was verified.” A file that contains only a company registration certificate without a UBO chart, signed declaration, or verification of the named individuals will not satisfy this test. Where reliance is placed on a third party, an affiliate onboarding agent, a KYC vendor, or an introduced-business referral, the operator must have a written agreement with that party and must be satisfied that the verification was conducted in accordance with the applicable standard at the time it was performed.

Compliance teams operating across multiple jurisdictions should note that the standards described above represent the FATF-aligned floor. Some regulators impose materially more sensitive thresholds or more prescriptive verification methods. The UKGC’s 5 percent shareholder notification requirement under LCCP Condition 15.2.1 is the most prominent example: it does not replace CDD on beneficial owners above the 25 percent threshold but operates in parallel as a distinct regulatory notification obligation. Operators should consult qualified legal counsel to confirm which regime governs any given commercial relationship and which jurisdiction’s AML standards take precedence where multiple regulatory frameworks apply.

Spillemyndigheden and the Risk-Based Approach to UBO Verification

Denmark’s Spillemyndighed AML guidance (Version 1.2) references the FATF Risk-Based Approach Guidance for Casinos as a primary framework for how online gambling providers should assess players and counterparties for ML/TF risk. The guidance acknowledges that applying a risk-based approach means that on occasion an operator’s defences may be breached by those determined to identify and exploit control weaknesses. The required response is not to lower verification standards but to ensure that when weaknesses are identified, remedial action is taken promptly to prevent systemic failure.

That framing is instructive for compliance programme design. A beneficial ownership verification process that relies on a single data source, applies no escalation for complex corporate structures, and treats the 25 percent threshold as a hard cutoff rather than a risk indicator will satisfy the letter of the FATF standard in low-risk cases. It will fail in exactly the cases where the standard matters most: where an operator is targeted by sophisticated actors who have specifically structured their ownership to remain below regulatory thresholds while retaining actual control.

Key Resources

FATF Forty Recommendations (updated 2023), The primary international standard, available at fatf-gafi.org. Recommendations 22, 24, and the accompanying Interpretive Notes are the core beneficial ownership provisions applicable to DNFBPs including casinos.

Gibraltar AML Code of Practice for Remote Gambling, v.1.0.2026, The most detailed English-language regulatory implementation of FATF beneficial ownership obligations specifically for remote gambling. Issued by the Gibraltar Gambling Commissioner under section 6(6)(f) of the Gambling Act 2005 and updated January 2026. Available via gibraltar.gov.gi.

FINTRAC Casino Client Identification and KYC Requirements (effective October 2025), Canada’s FINTRAC guidance under the PCMLTFA, setting out the confirmation-of-existence method, reliance arrangements, and beneficial owner record-keeping for casinos. Available at fintrac-canafe.gc.ca.

UKGC Licence Conditions and Codes of Practice (effective 6 April 2026), LCCP Condition 12.1.1 (AML prevention) and 15.2.1 (reporting key events, including ownership changes). Available via the UKGC LCCP explorer on this site.

For a broader overview of how the AML framework intersects with licensing, source-of-funds obligations, and transaction monitoring across jurisdictions, see the AML and Financial Compliance hub. To begin implementing a beneficial ownership workflow tailored to your licensing jurisdictions, use the UBO Implementation Guide.