GGR Tax Filings and AML: Feeding Duty Data into Your KYC Risk Framework

Duty returns, promotional ledgers and player-level deposit data belong in one reconciled control, and the 2026 UKGC enforcement record shows why. No UKGC, MGA or ADM instrument reviewed for this article requires a licensee to feed tax filing data into its KYC risk framework. The obligation is indirect. LCCP licence condition 12.1.1 requires the money laundering risk assessment to be reviewed after material changes, and on the better reading the rise in Remote Gaming Duty from 21% to 40% on 1 April 2026 is one. Licensees that hold tax, finance and AML in separate silos hold the evidence regulators ask for and cannot produce it in one place. This article rests on a reading of the LCCP, HMRC duty guidance, MGA guidance and its Compliance Audit Manual, and the UKGC settlements published between July and October 2026.

What each regime requires of the tax return and the KYC file

The UKGC does not prescribe a tax-to-KYC data flow. It prescribes a risk assessment, and the text is specific about when it must change.

“Licensees must conduct an assessment of the risks of their business being used for money laundering and terrorist financing. Such risk assessment must be appropriate and must be reviewed as necessary in the light of any changes of circumstances, including the introduction of new products or technology, new methods of payment by customers, changes in the customer demographic or any other material changes, and in any event reviewed at least annually.”

Whether a tax rate change counts as a “material change” is an interpretation, not a statement in the condition. A duty rate of 40% changes promotional intensity, product mix and the economics of high-value customers, and each of those feeds the customer risk profile that 12.1.1 requires the licensee to assess.

As of November 2026, the three regimes compare as follows on the points where tax data and AML data meet.

Item (as of November 2026)	UKGC / HMRC	MGA	ADM (Italy)
Online gaming tax rate	Remote Gaming Duty 40% for accounting periods beginning on or after 1 April 2026 (21% from April 2019)	5% gaming tax on revenue from players in Malta, 15% for Type 1 and 10% for Types 2 to 4 from 1 October 2026, per advisory commentary on Legal Notices 84 and 86 of 2026	24.5% GGR tax on online sports and virtual betting (from 24%); PREU on amount played of 24% for AWP and 8.6% for VLT
Tax base	Profits: stakes received less winnings paid, UK-resident customers, including freeplays	Gaming revenue from players located in Malta	GGR for online, amount played for PREU
Filing and records	Return within 30 days of period end, records kept 4 years per HMRC guidance	Monthly, with regulatory returns containing the data to calculate tax	Stakes recorded on counters connected to the national collection network
Deposit or CDD trigger	No fixed figure in 12.1.1, set through the licensee’s risk assessment	€2,000 cumulative deposit flag, daily or rolling 180 days, tested under Compliance Audit Manual 6.18.3	Not established in the sources reviewed
AML audit touchpoint	Risk assessment, source of funds evidence, SAR timeliness, PML oversight	Audit Manual tests tax declarations (3.2.1), funds reconciliation, MLRO and STR to FIAU (6.19)	Concession terms and ADM audit, confirm AML reporting mechanics with counsel

The table draws on HMRC’s policy paper of 26 November 2025 and operator guidance, the MGA guidance note on licence fees and taxation and its FAQ, the MGA Compliance Audit Manual (August 2018, v1), and SBC News reporting on Italian rates in July 2026. Because the €2,000 flag appears in the 2018 manual, confirm it against the current FIAU Implementing Procedures before hard-coding it. The Italian sources reviewed cover ADM’s tax and concession side only. Legislative Decree 231/2007 governs suspicion reporting there, and Italian counsel should confirm the mechanics of reporting to the UIF.

Malta’s gaming tax is levied on revenue from players located in Malta, so an MGA licensee serving the UK or Italy files its material duty returns with HMRC or ADM, not with the MGA. That data has to be routed to the MLRO deliberately, because the MGA’s own returns do not carry it.

The 2026 UKGC enforcement record

The UKGC published its 2026 money laundering and terrorist financing risk assessment at the end of July 2026. According to iGamingBusiness, the report drew on data from 1 April 2023 to 31 October 2025, kept remote casinos and betting among the highest-risk subsectors, and recorded remote casino gross gambling yield of £5 billion between April 2024 and March 2025, with slots accounting for £4.2 billion. The report also identified inadequate or improperly set AML thresholds and weak monitoring of linked or duplicate accounts as operator-side failings.

L&L Europe agreed a £900,000 settlement in October 2026. iGamingBusiness reported that its customer due diligence procedures were not followed, including acceptance of a customer’s source of funds without adequate evidence, and that the shortcomings breached licence condition 12.1.1. The reporting also described large, rapid deposits in new accounts without source of funds verification.

QuinnBet (Gibraltar) Limited agreed £609,104 in August 2026 after a review of its remote licence covering March 2023 to August 2025. The settlement included a disgorgement payment of £193,118. iGamingBusiness reported that the failings included inadequate source of funds assessments and delays in filing Suspicious Activity Reports. John Pierce, the Commission’s Director of Enforcement, said the case showed “the serious consequences of relying on systems and controls that are unable to identify and respond to indicators of harm and financial crime quickly enough”.

Rank Group agreed a £5 million settlement in October 2026, with SBC News reporting outdated money laundering policies, inadequate source of funds checks, and high-risk customers including crypto users misclassified as standard risk. Evolution settled for £4.75 million in July 2026 over an AML risk assessment that did not capture supply chain exposure. Speaking at the Gambling Anti-Money Laundering Group conference, Pierce also warned that AI tools generating Suspicious Activity Reports often fail to deliver compliance on their own, and that Personal Management Licence holders were not providing sufficient oversight of AML controls.

Which deposit threshold triggers source of funds checks?

As of November 2026, the MGA Compliance Audit Manual tests whether the licensee’s system can flag a deposit when cumulative deposits reach €2,000, calculated either daily since the start of the business relationship or over a rolling 180 days. The UKGC sets no fixed figure in licence condition 12.1.1, and ADM’s threshold is not established in the sources reviewed here. UKGC thresholds are therefore the licensee’s own, and the 2026 risk assessment criticises thresholds that are inadequate or improperly set.

The Audit Manual also asks whether the licensee requests source of wealth and source of funds for high-risk profile players (6.17.12) and whether enhanced due diligence is applied to politically exposed persons (6.17.11). The same manual tests gaming tax calculations against the Gaming Tax Regulations (S.L. 583.10) using a sample of at least three Monthly Gaming Revenue Declaration forms (3.2.1), and reconciles Monthly Player Funds reports to back-office and payment institution statements (3.1.7).

In practice, UKGC licensees should calibrate thresholds to the customer’s evidenced income and not to a flat deposit figure. The L&L Europe and QuinnBet findings turn on rapid deposits that outran the evidence on file.

Can a tax return trigger a suspicious activity report?

A tax return cannot trigger a suspicious activity report on its own. It is aggregate, filed in arrears, and carries no customer identity, so it cannot establish knowledge or suspicion about a named person. UK returns are due within 30 days of the accounting period end and Maltese gaming tax is returned monthly, so by filing the transaction has usually settled.

The counter-argument deserves a direct answer. Tax data cannot time a SAR, and a rule that tried to force it would invite tipping-off and data-protection problems. Its value lies in testing the controls that do generate SARs. A duty return is already reconciled to cash, which makes it the cheapest control test an AML function has. A break between the dutiable profit in the return and the sum of player-level ledger movements shows that either the tax calculation or the transaction monitoring dataset is incomplete, and incomplete datasets are what the UKGC identified in linked and duplicate accounts and in thresholds that were never calibrated.

Italy shows what a data gap looks like when the regulator finds it first. ADM and the Guardia di Finanza closed two clandestine betting collection centres in Agrigento in July 2026 and imposed fines above €20,000, according to SBC News. Terminals seized there were not connected to the national gaming collection network and lacked identification codes, so they bypassed the counters that record stakes and plays, which potentially enabled evasion of PREU.

Bonuses, freeplays and the reconciliation that exposes abuse

As of November 2026, HMRC’s operator guidance states that Remote Gaming Duty applies to gaming provider profits from UK customers and “will include any freeplays you offer”. The OBR describes the 2016 reform as making the nominal stake value of a customer’s first use of any free play taxable. Promotional value therefore enters the UK duty base at the point of first use, and the duty return and the promotional ledger must agree on the same events.

The tax-base treatment of bonuses is not uniform across regimes. The Maltese definition under the Gaming Tax Regulations (S.L. 583.10) and the Italian rules should be confirmed with counsel before any cross-border model is built on the UK treatment.

The promotional ledger answers an AML question as well as a tax question, because it records which accounts received value, which wagered it, and which withdrew. This is analysis, not UKGC or MGA text. Accounts that receive and cash out promotional value with minimal risk activity match the typology in the Gibraltar Gambling Commissioner’s AML Code of Practice for Remote Gambling (2026 update), which describes criminal funds recycled through gambling facilities “through engaging in minimal or very low risk activity”. FATF’s 2026 report, Risks of Gaming and Gambling, adds deposits structured below reporting thresholds and moving money without actually gambling. Those descriptions define what a transaction monitoring scenario should look for.

The 40% rate raises the cost of getting this wrong. A £1 million misclassification of dutiable profit now represents £400,000 of duty, against £210,000 at 21%. HMRC’s guidance warns of penalties for returns that are not accurate and for payments not made by the due date. According to iGamingBusiness, provisional HMRC statistics put April to June 2026 Remote Gaming Duty receipts at £376 million, against £360 million in the final quarter at 21%.

The duty change also reshapes promotional behaviour. iGamingBusiness reported in the weeks after the change that advisers expected the effects to surface first through customer economics and promotional intensity. A licensee that cuts bonuses and raises VIP spend to protect margin has changed its high-value customer population, and the risk assessment should record that change with a date and an owner. The UKGC and MGA licence cost comparison sets out the wider duty effect on cost modelling.

What compliance teams should change

The following changes need no new regulatory text. Each rests on obligations already in force.

Add a standing reconciliation between the duty return and the player-level ledger to the monthly MLRO or nominated officer pack. Under the UKGC regime the AML function should receive the same dutiable profit figure the finance team submits to HMRC. Under the MGA regime it should receive the Monthly Gaming Revenue Declaration data alongside the Monthly Player Funds report. Any unexplained break should be logged as a monitoring dataset exception.

Re-run the licence condition 12.1.1 risk assessment for the 1 April 2026 duty change and document the conclusion, including promotional and VIP mix. Repeat the exercise ahead of the General Betting Duty rate of 25% on remote betting from 1 April 2027, which HMRC’s policy paper confirms with an exclusion for remote bets on UK horse racing. Record the review date, because the condition requires review at least annually and after material changes.

Back-test every deposit threshold against the customer evidence actually held, such as payslips and bank statements. The enforcement cases involved accepted source of funds without adequate evidence and large rapid deposits in new accounts. For MGA licensees, include the €2,000 cumulative flag and the rolling 180-day variant in the scenario library, and verify both against the current FIAU Implementing Procedures.

Measure SAR timeliness on a single clock that records when the first alert fired, when the case was opened, and when the report was filed. QuinnBet’s settlement cited delays in filing Suspicious Activity Reports. Where AI tools generate alerts or draft SARs, retain evidence that they deliver compliance, which is what Pierce asked for in his GAMLG remarks.

Extend due diligence to white-label and B2B partners. The UKGC’s 2026 risk assessment identifies insufficient scrutiny of white-label partnerships as a risk contributor, and the Evolution settlement concerned a risk assessment that omitted supply chain exposure.

Operators serving several markets should assign one owner for each destination tax regime and give the MLRO read access to each filing. Qualified legal and tax counsel should review the Italian reporting mechanics under Legislative Decree 231/2007 and any model that applies one jurisdiction’s tax treatment of bonuses to another.

Key Resources

UKGC, Licence Conditions and Codes of Practice, condition 12.1.1, with conditions 15.1.2 and 15.2.1 on reporting. UKGC, The 2026 money laundering and terrorist financing risks within the British gambling industry. UKGC public statement on QuinnBet (Gibraltar) Limited. HMRC, Changes to Gambling Duties policy paper (Autumn Budget 2025), and HMRC operator guidance on General Betting Duty, Pool Betting Duty and Remote Gaming Duty. The General Betting, Pool Betting and Remote Gaming Duties (Returns, Payments, Information and Records) Regulations 2014 (SI 2014/2912). MGA, Compliance Audit Manual (MGA/G/001, August 2018 v1) and Gaming Tax Regulations (S.L. 583.10). FIAU Implementing Procedures for the remote gaming sector. Gibraltar Gambling Commissioner, AML Code of Practice for Remote Gambling (2026 update).

Frequently asked questions

Does the UKGC require gambling tax data to be used in KYC risk assessments?

No instrument reviewed for this article requires it. LCCP licence condition 12.1.1 requires a risk assessment reviewed at least annually and after material changes, and the 40% Remote Gaming Duty from 1 April 2026 falls within that review trigger as a matter of interpretation.

What is the MGA deposit threshold that triggers source of funds checks?

As of November 2026, the MGA Compliance Audit Manual (August 2018, v1) tests whether systems flag a deposit when cumulative deposits reach €2,000, calculated daily or over a rolling 180 days. Confirm the figure against the current FIAU Implementing Procedures.

Are freeplays taxable under UK Remote Gaming Duty?

Yes. HMRC’s operator guidance says duty on gaming provider profits includes any freeplays offered, and the OBR describes the nominal stake value of a customer’s first use of a free play as taxable following the 2016 reform.

Does an MGA licensee pay Maltese gaming tax on UK or Italian players?

No. Maltese gaming tax is calculated on revenue from players located in Malta. Revenue from UK players falls under Remote Gaming Duty, and revenue from Italian players falls under ADM’s tax regime.