Politically Exposed Persons in iGaming: EDD Requirements Across FINTRAC, UK MLR 2017, and the EU Framework

Politically exposed persons represent one of the highest-risk customer categories an iGaming operator will encounter, and PEP screening failures appear repeatedly in enforcement actions across every major jurisdiction. The compliance obligation is not simply to screen against a list, it is to understand the elevated corruption risk a PEP presents, extend that assessment to their family members and close associates, obtain senior management approval before establishing or continuing a business relationship, and document a credible source of wealth. The precise mechanics of each of those steps differ materially between FINTRAC, the UK Money Laundering Regulations 2017, and the EU anti-money laundering framework that governs MGA licensees. This article sets out those differences in operational terms.

What Is a PEP? The Definition Problem That Trips Up Multi-Jurisdiction Operators

The FATF Recommendation 12 standard establishes the conceptual foundation: a politically exposed person is an individual who is or has been entrusted with a prominent public function. The practical definition each jurisdiction implements from that foundation carries meaningful differences that affect who triggers EDD in your system.

Under FINTRAC guidance effective 1 June 2021, the framework distinguishes sharply between foreign and domestic politically exposed persons. A foreign PEP is a person who holds or has held one of the enumerated offices in or on behalf of a foreign state. The foreign PEP category includes heads of state or government, members of a foreign legislature, senior military officials, senior executives of state-owned enterprises, heads of government departments, and judges of foreign supreme courts, among others. A domestic PEP is a person who currently holds, or has held within the last five years, a specific office in or on behalf of the Canadian federal, provincial, territorial, or municipal government, including members of the Senate or House of Commons, members of a provincial legislature, deputy ministers, ambassadors, senior military officers at the rank of general or above, and presidents of corporations owned by the federal Crown.

The UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692) does not draw this domestic/foreign binary for the purposes of triggering EDD. Regulation 35 applies to any customer or beneficial owner determined to be a PEP, a family member of a PEP, or a known close associate of a PEP. The practical consequence under UK law is that a British MP triggers the same regulatory obligation as a foreign minister, which differs from the FINTRAC model where domestic PEPs may be assessed as lower risk unless specific high-risk indicators are present.

The EU framework, transposed across member states from the Fourth Anti-Money Laundering Directive (4AMLD, Directive 2015/849) and strengthened by the Fifth (5AMLD, Directive 2018/843), adopts a harmonised but still broad definition that covers national PEPs, foreign PEPs, and persons entrusted with a prominent function by an international organisation. MGA licensees operating under Maltese law must comply with the Prevention of Money Laundering Act and implementing regulations that transpose these directives, with AML supervision shared between the Malta Gaming Authority and the Financial Intelligence Analysis Unit (FIAU). Operators should consult qualified legal counsel when assessing which national transposing measure applies across multiple EU markets simultaneously.

What Are the Enumerated Positions?

Getting the position list right matters because PEP screening vendors cover these lists with varying completeness, and operators cannot rely solely on database hits to discharge the obligation to take reasonable measures.

FINTRAC’s domestic PEP category covers the Governor General, lieutenant governors, and heads of government, members of the Senate, House of Commons, or a provincial/territorial legislature, deputy ministers or equivalent rank, ambassadors and their attachés or counsellors, military officers at the rank of general or above, presidents of Crown corporations, and heads of a government agency. The five-year lookback means a recently retired cabinet minister or a former federal deputy minister still falls within the definition and must trigger a PEP determination at account opening.

For foreign PEPs, FINTRAC’s list includes heads of state or government, members of any foreign legislature, senior military officials, presidents, vice-presidents, and senior executives of foreign state-owned enterprises, heads and deputy heads of foreign government departments, and judges of foreign supreme courts or other senior courts. The expansiveness of “state-owned enterprise” is operationally significant for casinos serving customers from jurisdictions with large public sectors, including Gulf states and former Soviet republics, where the overlap between political connection and commercial activity is often substantial.

Under UK MLR 2017, the positions triggering PEP status are defined by reference to Schedule 2 of the Regulations and include heads of state or government, government ministers, members of Parliament or equivalent bodies, members of governing bodies of political parties, judges of supreme courts, members of courts of auditors or boards of central banks, ambassadors, high-ranking military officers, members of administrative, management, or supervisory boards of state-owned enterprises, and directors, deputy directors, or board members of international organisations. The UK list has been interpreted broadly by the Gambling Commission, and the Commission’s money laundering and terrorist financing risk assessments have consistently identified PEP-related failures as a recurring theme in casino casework.

Family Members and Close Associates: The Screening Perimeter

Every framework extends the EDD obligation beyond the PEP to a defined circle of connected persons. This is where many compliance teams underestimate their exposure.

FINTRAC defines a family member of a PEP or head of an international organisation to include a spouse or common-law partner, a child of the PEP, the PEP’s mother or father, and the spouse or common-law partner of a child of the PEP. A close associate is defined as a person who is closely connected to a PEP for personal or business reasons, which FINTRAC guidance explains encompasses business partners, persons who jointly hold beneficial ownership of legal entities with the PEP, and persons who are otherwise known to be close to the PEP. The phrase “known to be close” introduces a reasonable-measures standard: casinos are not required to conduct exhaustive investigative journalism, but they must act on information that is reasonably available.

Under FINTRAC’s guidance, close associate determinations for domestic PEPs require the casino to determine status for close associates only when the casino has already determined that the domestic PEP relationship is high-risk. For foreign PEPs, close associate status must be assessed in any relevant account-opening or transaction scenario. This asymmetry is one of the most frequently misapplied distinctions in Canadian casino compliance programmes.

UK MLR 2017 Regulation 35 requires relevant persons to manage the enhanced risks arising from business relationships or transactions with “a family member or a known close associate of a PEP.” The Regulations do not provide an exhaustive statutory definition of “known close associate” within Regulation 35 itself, but guidance from HM Treasury and the Gambling Commission’s casino AML publications consistently apply the position that operators must use reasonable judgment based on publicly available information, screening results, and information provided at onboarding. The obligation is to determine close associate status as part of risk-management systems and procedures.

MGA licensees under the FIAU’s implementing guidance face comparable requirements. The FIAU’s Implementing Procedures Part II, which applies to gaming operators, requires subject persons to identify family members and close associates of PEPs and to apply enhanced due diligence to those relationships. The FIAU has repeatedly referenced PEP misclassification as a sector-wide weakness in its published inspection findings.

The FINTRAC Casino-Specific Threshold

Casinos regulated under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) face a transaction-level trigger that other reporting entities do not. Under the FINTRAC account-based guidance for casinos, effective 1 June 2021, casinos must take reasonable measures to make a PEP or HIO (head of an international organisation) determination not only at account opening and during periodic monitoring, but also at the transaction level when they receive cash or an amount of virtual currency equivalent to CAD 100,000 or more. This transaction-level obligation for casinos is distinct from the international electronic funds transfer threshold that applies to financial entities.

After making a PEP or HIO determination, a Canadian casino must also take reasonable measures to establish the source of funds and source of wealth for any foreign PEP, HIO, family member of a foreign PEP or HIO, or close associate of a foreign PEP or HIO, and for any domestic PEP where the relationship has been assessed as high-risk. The obligation to establish source of wealth, meaning the origin of the person’s total assets, is in addition to source of funds for a specific transaction. FINTRAC’s guidance draws a clear conceptual line between these two exercises.

FINTRAC’s enforcement record for casinos includes the CAD 212,025 penalty issued to the Atlantic Lottery Corporation for failures that included inadequate suspicious transaction reporting and risk assessment documentation. While that penalty did not arise specifically from PEP failures, it illustrates FINTRAC’s willingness to use its administrative penalties regime against gaming entities that maintain demonstrably inadequate compliance programmes.

UK MLR 2017: Regulation 35 in Detail

Regulation 35 of SI 2017/692 imposes four specific obligations on relevant persons who determine that a customer or beneficial owner is a PEP, or a family member or known close associate of a PEP. Casinos holding a casino operating licence under section 65(2)(a) of the Gambling Act 2005 are explicitly defined as relevant persons for the purposes of the MLR 2017 under Regulation 14.

The casino must have in place appropriate risk-management systems and procedures to determine PEP status and manage the enhanced risks. Once a PEP determination is made, the casino must obtain senior management approval before establishing, or for an existing customer before continuing, the business relationship. The casino must take adequate measures to establish the source of wealth and source of funds involved in the business relationship or occasional transactions. And the casino must conduct enhanced ongoing monitoring of the business relationship.

Regulation 35(1) states: “A relevant person must have in place appropriate risk-management systems and procedures to determine whether a customer or the beneficial owner of a customer is, (a) a politically exposed person (a ‘PEP’); or (b) a family member or a known close associate of a PEP, and to manage the enhanced risks arising from the relevant person’s business relationship or transactions with such a customer.” (The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, SI 2017/692, Regulation 35(1))

The requirement for senior management approval is categorical, not discretionary. It applies to every PEP relationship, not only those assessed as posing the highest risk. Casinos that operate tiered PEP protocols, applying senior management approval only to foreign PEPs or only above certain financial thresholds, are misconfigured against UK requirements unless their risk assessment demonstrably justifies that approach and the Gambling Commission accepts it during inspection.

Regulation 33 of the same instrument establishes the overarching obligation to apply enhanced customer due diligence and enhanced ongoing monitoring where a PEP determination has been made. Regulation 33(1)(d) makes EDD mandatory in any case where the relevant person has determined a customer is a PEP, a family member of a PEP, or a known close associate of a PEP, and that obligation cannot be risk-stratified away through a firm’s internal policies.

The real-world implications of these requirements became visible in the UK gambling context through the 2024 General Election betting scandal. Craig Williams, then a Member of Parliament for Montgomeryshire and Parliamentary Private Secretary to the Prime Minister, was flagged by a gambling operator as a politically exposed person when he placed a £100 bet on the General Election date. His account was subject to enhanced due diligence precisely because his position as an MP made him a PEP under the MLR 2017 framework. He pleaded guilty on 29 June 2026 to cheating contrary to section 42(1)(a) of the Gambling Act 2005. The case illustrates both that PEP screening systems were functioning in at least one operator’s environment and that political exposure creates integrity risk beyond the money laundering dimension that AML frameworks are designed to address.

Does UK MLR 2017 Require Senior Management Approval for Every PEP?

Yes. Regulation 35 of SI 2017/692 requires senior management approval before establishing a business relationship with any identified PEP, or before continuing an existing relationship once PEP status is determined. There is no statutory threshold below which the approval requirement falls away. A casino operating a tiered protocol that reserves senior management sign-off for foreign PEPs only, or for accounts above a defined spend level, is non-compliant with the MLR 2017 unless it can demonstrate that its risk assessment provides a defensible basis for that approach and the Gambling Commission has accepted it.

The EU Framework and MGA Licensees

MGA licensees operating under the Gaming Act (Cap. 583) are subject to the Prevention of Money Laundering Act (PMLA) and the Prevention of Money Laundering and Funding of Terrorism Regulations, which transpose the Fourth and Fifth AMLDs into Maltese law. The FIAU, which exercises AML supervisory authority over gaming operators in parallel with the MGA, has published Implementing Procedures Part II specifically for gaming operators. Those procedures require gaming operators to identify PEPs, their family members, and close associates using a risk-based approach, apply EDD, and obtain senior management approval before entering into business relationships with identified PEPs.

The EU harmonisation objective under the AMLDs aimed to ensure consistent PEP treatment across member states, but national transpositions retain variation in how “prominent public function” is interpreted and how strictly the lookback period after leaving office is applied. An operator with an MGA licence serving players across multiple EU member states may need to apply the stricter transposing measure of the member state where the player is located, depending on how that state’s law characterises the operator’s activities. Operators should obtain jurisdiction-specific legal advice before assuming the Malta transposition governs in all scenarios.

The EU’s approach to the PEP lookback period is instructive. Both 4AMLD and 5AMLD recognised that a person who has left a prominent public function should not be subject to PEP measures indefinitely, but the period during which elevated risk persists requires a risk-based determination, not simply the passage of a fixed number of years. FINTRAC takes a five-year fixed lookback for domestic PEPs. UK MLR 2017 adopts a risk-based approach: Regulation 35(5) provides that if a person ceases to be a PEP, casinos must continue to apply EDD for a risk-based period, taking into account the continuing risk posed by that person. Industry practice typically applies 12 to 24 months of continued elevated monitoring following departure from office, but the length must be documented and defensible in inspection.

Comparative Framework Overview

Requirement	FINTRAC (Canada)	UK MLR 2017	EU AMLD / MGA
Domestic vs foreign distinction	Yes, different obligations for each category	No, same EDD obligations apply regardless	No, harmonised definition applies universally
Account opening determination	Mandatory for all account types	Required as part of CDD / EDD triggers	Required as part of CDD / EDD triggers
Transaction-level threshold (casinos)	CAD 100,000 cash or VC equivalent	Not separately prescribed, risk-based	Not separately prescribed, risk-based
Senior management approval	Required for foreign PEPs, required when domestic PEP assessed as high-risk	Required for all PEPs (no threshold)	Required for all PEPs (4AMLD / 5AMLD basis)
Source of wealth required	Foreign PEPs and high-risk domestic PEPs	All PEPs, “adequate measures” to establish	All PEPs, mandatory under FIAU guidance
PEP lookback after leaving office	5 years (fixed) for domestic PEPs	Risk-based, no fixed statutory period	Risk-based, no fixed statutory period
Close associate screening	Mandatory for foreign PEPs, applies to domestic when high-risk	Mandatory, known close associates	Mandatory, known close associates

Source of Wealth Verification: The Operational Challenge

Source of wealth verification is the obligation that compliance teams most frequently find difficult to operationalise. It requires demonstrating that a PEP’s total accumulated assets are explicable by a legitimate economic history, and it goes considerably beyond checking that a deposit was made from a named bank account.

FINTRAC’s guidance explains that establishing source of wealth means understanding how the person accumulated the wealth they have, which may include salary, business profits, inheritance, investment returns, or property sales. For a casino, this typically means requesting and reviewing documentary evidence such as employment records, business ownership documentation, tax returns, or professionally prepared net worth statements, and reconciling those against the player’s gaming behaviour and deposit patterns.

Under UK MLR 2017, the obligation is to take “adequate measures” to establish source of wealth and source of funds in a PEP relationship. The Gambling Commission’s money laundering risk assessment for 2026, published on 30 July 2026, identified source of funds and source of wealth failures as persistent themes in casino casework. Operators that rely on self-declaration without corroborating documentation are unlikely to satisfy the “adequate measures” standard during supervisory inspection, particularly for high-spending PEP accounts.

Compliance teams should consider three tiers of evidence for PEP source of wealth. Primary evidence covers audited accounts, professional valuation of assets, and formal employment contracts with salary. Secondary evidence draws on publicly available information such as company filings, property registers, or official salary scales for the office held. Corroborating internal data covers deposit patterns, withdrawal history, and consistency with declared occupation. The weighting of these tiers should reflect the assessed risk of the relationship. A PEP from a low-corruption-risk jurisdiction holding a modest public salary may require less intensive verification than a senior executive of a state-owned enterprise from a jurisdiction with a FATF high-risk designation.

How Does PEP Screening Work Across the Life of a Customer Relationship?

PEP obligations do not arise only at onboarding. Every framework requires ongoing monitoring capable of detecting a change in PEP status during the life of a customer relationship.

Under FINTRAC’s account-based guidance, casinos must conduct periodic monitoring of existing account holders and take reasonable measures to determine PEP status during that process. FINTRAC also introduces a “detect a fact” obligation: if at any point during the business relationship a casino detects information indicating a customer may be a PEP, it must treat that as a trigger for a fresh determination and, if confirmed, apply the required EDD measures. This covers situations where a customer’s political status changes after onboarding, for example an account holder who is elected to a provincial legislature mid-relationship.

UK MLR 2017 Regulation 35’s requirement for enhanced ongoing monitoring applies for the duration of the business relationship with a PEP. This includes ongoing scrutiny of transactions, periodic review of the business relationship, and updating due diligence information when the casino becomes aware of a change in the customer’s political status. Regulated gambling operators commonly integrate PEP screening into their transaction monitoring rules so that an account identified as PEP-linked is automatically subjected to higher-alert thresholds and more frequent relationship reviews.

For MGA licensees, the FIAU’s Implementing Procedures Part II require ongoing monitoring of PEP relationships commensurate with the risk presented. The FIAU has signalled in its thematic reviews that it expects operators to demonstrate active monitoring, not passive screening at onboarding followed by no subsequent action. An account that was screened as PEP-positive at onboarding three years ago but has not been reviewed since is likely to be treated as a compliance failure during inspection regardless of whether the original onboarding was handled correctly.

The FinCEN Dimension for US-Facing Operations

Operators and suppliers with US market exposure face a distinct framework. Under the Bank Secrecy Act and the regulations administered by the Financial Crimes Enforcement Network (FinCEN), casinos regulated under the BSA (31 CFR Part 1021) are required to maintain anti-money laundering programmes and file Currency Transaction Reports and Suspicious Activity Reports. FinCEN’s approach to politically connected persons in the casino context does not use the same “PEP” label or enumerated-position structure as FINTRAC or the EU AMLDs. The concept of heightened risk for politically connected persons is addressed through the risk-based AML programme requirement, which obliges casinos to identify and apply appropriate controls to customers who present elevated money laundering risk, including persons with political exposure.

State gaming regulators in New Jersey (Division of Gaming Enforcement), Pennsylvania (Gaming Control Board), and Michigan (Gaming Control Board) impose their own AML programme standards that overlap with the federal BSA requirements. Compliance officers operating in US-licensed markets should treat PEP risk identification and corresponding EDD as an implicit requirement of a compliant BSA AML programme, even where the term “PEP” does not appear in the applicable state or federal regulation by name. Counsel familiar with both BSA obligations and applicable state gaming regulations should be engaged to confirm the current position for each relevant state licence.

Building a Cross-Jurisdiction PEP Programme

An operator holding licences across multiple jurisdictions cannot deploy a single PEP protocol without resolving the jurisdictional conflicts identified above. A programme designed around UK MLR 2017 will over-screen against FINTRAC’s domestic PEP standard, which may create operational friction, but that over-inclusion is preferable to under-compliance. A programme designed around FINTRAC’s domestic/foreign binary will be insufficiently rigorous for UK regulatory inspection if it treats domestic PEPs differently from foreign PEPs in the application of senior management approval or source of wealth requirements.

Compliance programmes that work across all three frameworks should adopt the strictest applicable standard as the baseline for all PEP relationships: universal senior management approval regardless of PEP nationality, source of wealth verification for all identified PEPs, not only foreign PEPs, close associate screening for all PEP relationships, not limited to the foreign PEP category, and a risk-based lookback period after departure from office that is documented and defensible, with a minimum of 12 months applied universally and extended based on risk factors.

The vendor landscape for PEP screening databases has expanded considerably, but database coverage alone does not satisfy any of the three frameworks. FINTRAC’s “reasonable measures” standard, UK MLR 2017’s “appropriate risk-management systems,” and the FIAU’s risk-based approach all contemplate that an operator uses database screening as a starting point, not an endpoint. A PEP who is not listed in a commercial database because their position is recent, their jurisdiction is poorly covered, or their name has been transliterated differently is still a PEP for regulatory purposes. Screening programmes should incorporate adverse media monitoring, open-source intelligence checks on high-value accounts, and a documented escalation path when results are inconclusive.

For a detailed breakdown of how UKGC and MGA licence obligations interact with AML supervisory frameworks, see the UKGC vs MGA licence comparison. For further context on how AML and KYC obligations fit within the broader iGaming compliance framework across jurisdictions, the AML and Financial Compliance hub covers transaction monitoring, source of funds, FIAU, FINTRAC, and suspicious activity requirements. Compliance officers evaluating how these obligations interact with Canadian licensing requirements will find the comparative analysis in AGCO vs AGLC: Key Differences in Ontario and Alberta Internet Gaming Regulation directly relevant to their Canada programme design.

Key Resources

FINTRAC, Politically exposed persons and heads of international organizations guidance (general guidance, applicable to all reporting entities): fintrac-canafe.gc.ca/guidance-directives/client-clientele/pep/pep-eng

FINTRAC, Politically exposed persons and heads of international organizations guidance for account-based reporting entity sectors (casinos), effective 1 June 2021: fintrac-canafe.gc.ca/guidance-directives/client-clientele/pep/pep-acct-eng

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), Regulation 35 (EDD: politically exposed persons): legislation.gov.uk/uksi/2017/692/regulation/35

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), Part 3 Chapter 2 (enhanced customer due diligence, including Regulation 33): legislation.gov.uk/uksi/2017/692/part/3/chapter/2

Gambling Commission, Anti-money laundering hub (including casino-specific responsibilities and the 2026 money laundering risk assessment, published 30 July 2026): gamblingcommission.gov.uk/licensees-and-businesses/aml