Source of Funds Red Flags: AML Escalation Triggers Under UKGC, MGA and KSA

None of the UKGC, the MGA or the KSA publishes a single figure that makes a source of funds check mandatory. UKGC enforcement penalises licensees whose own triggers were set too high, accepted unverified income or fired without escalation, while the MGA and KSA texts reviewed here set detection and evidence standards.

The bottom line for compliance teams is to escalate on mismatch between a customer’s verified profile and observed activity, not on deposit size alone. The tables below set out the numerical triggers that exist as of October 2026 and an escalation ladder built from the failures the UKGC has named.

What the three frameworks actually say

Licence condition 12.1.1 of the UKGC’s Licence Conditions and Codes of Practice (LCCP) requires a money laundering and terrorist financing risk assessment and controls that follow from it. The Commission’s public statements, which cite the LCCP requirements in effect at the time of each breach, quote the provision directly.

“Following completion of and having regard to the risk assessment, and any review of the assessment, licensees must ensure they have appropriate policies, procedures and controls to prevent money laundering and terrorist financing.”

LC 12.1.1 sets no deposit figure. The UKGC’s numeric triggers sit in the social responsibility code and the financial risk assessment programme announced on 7 July 2026. The MGA’s figures appear in its Compliance Audit Manual (MGA/G/001), the document its auditors use to test licensees under the Gaming Act (Cap. 583). The KSA’s figures come from the means test under its duty-of-care regime, which is separate from Wwft customer due diligence.

Numerical triggers by framework, as of October 2026

Regulator	Instrument	Trigger	Consequence
UKGC	LCCP LC 12.1.1	None fixed, set by the licensee’s risk assessment	Appropriate controls, SAR where suspicion arises
UKGC	Financial vulnerability checks (SRCP 3.4.4)	Net loss of £150 in 30 days, per SBC News	Light-touch check using public data
UKGC	Financial risk assessments, stage one	£5,000 net deposits in a rolling 24 hours (£2,500 for younger and other higher-risk customers)	Credit reference agency check
UKGC	Financial risk assessments, full operation	£1,000 in 24 hours or £3,000 in 90 days (25 and over); £750 in 24 hours or £2,000 in 90 days (under 25)	Credit reference agency check
MGA	Compliance Audit Manual MGA/G/001, 6.18.3	Cumulative deposits of €2,000, measured daily since the start of the relationship or over a rolling 180 days	System must flag the deposit
MGA	Compliance Audit Manual, 6.17.12	High risk profile player	Source of wealth and source of funds requested
KSA	Means test guidance (since October 2024, revised July 2026)	Monthly net deposit beyond €300 (ages 18 to 24) or €700 (older)	Income verification before a higher limit

The UKGC financial risk figures come from iGamingBusiness and SBC News reporting of the 7 July 2026 announcement. Pre-briefing coverage cited different bands (£125 in 30 days, £1,000 in 24 hours), so the final LCCP wording governs any system build. iGamingBusiness reported that a grace period would prevent enforcement action for failures in the early stages.

What triggers a source of funds check under UKGC rules?

The UKGC does not prescribe a source of funds trigger. LC 12.1.1 requires the licensee to set one through its risk assessment, and the Commission tests whether that setting works in practice. The financial risk assessment thresholds above are a separate customer-interaction measure, although the same customers will often trip both.

The QuinnBet statement of 20 August 2026 cites LC 12.1.1 paragraphs 2 and 3, Social Responsibility Code Provision (SRCP) 3.4.3 on remote customer interaction, and SRCP 3.4.4 paragraph 1 on financial vulnerability checks. The settlement was £609,104, including a disgorgement payment of £193,118. According to iGamingBusiness in August 2026, the review ran from March 2023 to August 2025 and found delayed Suspicious Activity Reports and inadequate source of funds assessments.

The Grosvenor Casinos statement of 7 October 2026 reached £5,012,261 across 51 casinos, after a targeted compliance assessment on 13 June 2025, and required a third-party audit. It cited LC 12.1.1 paragraphs 2 and 3 and SRCP 3.4.1. Trade press reports of the settlement record that customers using cryptoassets were classified as standard risk although internal policy required a higher category and immediate enhanced due diligence. They also record a returning customer who lost £200,000 across two visits with no photographic ID or proof of income on file.

The Commission’s 2026 money laundering and terrorist financing risk assessment, using data from 1 April 2023 to 31 October 2025, noted inadequately set AML thresholds and weak monitoring of linked or duplicate accounts, according to iGamingBusiness. SBC News reported that it raised the gambling software sector from low to medium risk, citing Evolution’s £4.75m settlement over outdated AML risk assessments and weak oversight of third parties.

Where enforcement practice diverges from the text

Income taken at face value is the clearest example. iGamingBusiness commentary in late August 2026 on the QuinnBet findings described a customer whose payslips showed about £2,000 a month and who deposited and lost £9,000 in four days. It described another who placed roughly 4,800 bets in a day and 7,000 the next without being flagged. In the older In Touch Games case, reported by SBC News, a customer’s statement that they earned £6,000 a month was accepted without evidence. SBC News also reported that the 32Red penalty turned on proof-of-funds triggers set too high and on customers continuing to play while checks were pending.

Three divergences follow from these cases. Documentary evidence on file does not discharge the duty if activity outruns it. A trigger that fires but allows play to continue is treated as a failed control. A written policy that is not applied is treated as no policy, as the Grosvenor misclassification of crypto users shows.

The Commission’s Director of Enforcement, John Pierce, said when announcing QuinnBet, as reported by iGamingBusiness: “We expect operators to ensure their safeguards are effective in practice to protect consumers and keep crime out of gambling.” Voluntary reporting and a prompt remediation plan counted as mitigation, while the Commission’s earlier public statements on similar failings counted as an aggravating factor. iGamingBusiness reported on 1 September 2026 that the Commission suspended BresBet and Bet St George pending licence review, and SBC News later reported that both surrendered their licences and ceased trading.

MGA and KSA: fixed numbers with different purposes

Does the MGA set a fixed threshold for source of funds?

The MGA’s fixed figure is a detection requirement, not a source of funds trigger in itself. As of October 2026, item 6.18.3 of the Compliance Audit Manual (MGA/G/001, version 1, which appears to date from August 2018) tells auditors to check that the licensee’s system can flag a deposit once accumulated deposits reach €2,000, measured daily since the start of the business relationship or over a rolling 180 days. Item 6.17.12 asks whether the licensee requests source of wealth and source of funds for high risk profile players, and item 6.17.11 covers PEP detection and enhanced due diligence. Item 6.18.4 samples at least 30 withdrawals to confirm funds went back to the funding account, unless that was not possible.

The manual is an audit instrument and predates later revisions of the Financial Intelligence Analysis Unit (FIAU) Implementing Procedures for the remote gaming sector. The binding obligations sit in the Gaming Act, the Player Protection Directive (Directive 2 of 2018), the Gaming Authorisations and Compliance Directive (Directive 3 of 2018) and the FIAU procedures. The MGA and FIAU split supervisory roles, and licensees should take Maltese legal advice on which text currently governs each step.

How does the KSA treat income evidence?

The KSA’s means test is a duty-of-care control, but it sets the strictest evidential standard of the three. Since October 2024, licensees must run a means test when a player wants to deposit beyond monthly limits of €300 net (ages 18 to 24) or €700 (older players). According to iGamingBusiness, guidance published in early July 2026 revised the February 2025 version after inspections of 20 licence holders found persistent shortcomings.

The revised guidance requires limits to rest only on structural, recurring income. It excludes savings, business assets, home equity, one-off payments, a partner’s income, loans and earmarked social benefits. It lists 13 bad practices, including accepting unverified self-declared income and inflating net income by using the highest payslip instead of an average. It recommends averaging recent payslips and documenting each limit calculation in the player record, and bonus restrictions must run for 30 days after a limit intervention.

Wwft duties sit alongside the means test. The KSA licensing framework requires customer due diligence, verification before the business relationship starts, and suspicious transaction reporting to the FIU, and reapplications from 1 January 2026 must include a Wwft risk analysis. The material reviewed sets no numerical Wwft reporting indicator, so any threshold you adopt for Dutch players is your own risk-assessment output and should be validated with Dutch counsel.

The counter-argument: fixed thresholds create their own red flags

Fixed triggers are easy to audit but show customers and criminals where the line sits. The FATF’s September 2026 report, Risks of Gaming and Gambling, drew on questionnaire responses from 80 jurisdictions. It names smurfing, meaning multiple small transactions to stay under detection thresholds, deposits from multiple third parties, moving money without gambling, and coordinated or automated betting. It identifies cash, e-wallets, mobile money and virtual assets as the payment methods most open to structuring. The Danish Gambling Authority confirmed the indicators are relevant to its licensees.

The UKGC argues from the other side. Tim Miller told the Ethical Gambling Forum that the proposed assessment thresholds “are not limits or caps on customer spend” and that the checks “will not even attempt to make an assessment of what each customer can afford to gamble”. The Commission’s own risk assessment lists badly set thresholds and weak linked-account monitoring as sector weaknesses, so a threshold-only design leaves two known gaps open.

The strongest argument against behavioural triggers is friction. The Betting and Gaming Council has said it is considering all options on the financial risk assessments, and a BGC YouGov survey found 65% of UK bettors would refuse to give personal financial documents. The UKGC’s answer is data quality: its pilot blog found that incomplete or inaccurate onboarding details stopped customers matching to credit reference agency records, and its pilot data showed 97% of customers over the threshold received a frictionless assessment.

What to change in your escalation workflow

The ladder below is analysis, not regulatory text. It combines the figures above with the UKGC failure patterns and the FATF indicators, and counsel should confirm it against the licence conditions that apply to your entity. Tier 1 examples are jurisdiction-specific, and the later tiers apply under all three regimes.

Suggested four-tier escalation ladder built from cited enforcement failures, as of October 2026

Tier	Trigger examples	Action	Anchor
1. Automated flag	MGA licensees: cumulative deposits of €2,000. UKGC licensees: net loss of £150 in 30 days. All: linked or duplicate account match	Alert logged, identity data re-matched	MGA/G/001 6.18.3, UKGC FVC, 2026 UKGC risk assessment
2. Source of funds request	Activity inconsistent with verified income, multiple third-party deposits, crypto or e-wallet funding	Statement checked against independent sources, play restricted while pending	QuinnBet, Grosvenor, 32Red, FATF
3. Enhanced due diligence	Verified income cannot explain losses (for example £2,000 monthly income against £9,000 lost in four days); PEP, high risk profile	Senior approval, source of wealth and funds evidence, documented rationale	MGA 6.17.11 and 6.17.12, LC 12.1.1
4. Report and exit	Suspicion unresolved, evidence not provided, structuring indicators	SAR or STR filed without delay, tipping-off controls, funds returned to the funding account where permitted	QuinnBet SAR delays, MGA 6.18.4

Replace any single deposit-size trigger with paired triggers that compare activity against verified income, and test them against the QuinnBet and Grosvenor fact patterns. Set a maximum time between a tier 1 flag and a human decision, and restrict play while a tier 2 request is open. Add an automatic override that stops a customer the policy defines as high risk from remaining in standard risk. Feed linked-account and duplicate-identity detection into tier 1, and review thresholds whenever the business risk assessment is reviewed.

For Dutch-facing products, keep the means test income file separate from the Wwft file and do not let self-declared income stand alone. For MGA licensees, map the €2,000 detection test to the FIAU Implementing Procedures that currently apply. For UKGC licensees, fix onboarding data quality before the financial risk assessment stages begin. Our UKGC and MGA licence cost comparison covers the cost of holding either licence.

This analysis rests on a reading of the UKGC’s QuinnBet and Grosvenor public statements, the MGA Compliance Audit Manual, the KSA’s means test guidance and the FATF report, with trade press cited only for dated reporting. It is not legal advice, and licensees should consult qualified counsel in each jurisdiction before changing thresholds or reporting procedures. Review the UKGC and MGA licence cost comparison for further context on compliance infrastructure investment.

Frequently asked questions

Does the UKGC require a source of funds check at a set deposit level?

No. LCCP licence condition 12.1.1 requires controls based on the licensee’s own risk assessment and sets no figure. As of October 2026, the financial risk assessment thresholds, such as £5,000 net deposits in 24 hours at stage one, are a separate programme.

What is the MGA’s €2,000 deposit figure?

It is an audit test in the MGA Compliance Audit Manual (MGA/G/001, 6.18.3) requiring that the licensee’s system can flag accumulated deposits of €2,000, measured daily since the start of the relationship or over a rolling 180 days. It is a detection requirement, not a fixed source of funds trigger.

Is the KSA means test a source of funds check?

It is a duty-of-care affordability control that applies when players seek to deposit beyond €300 or €700 a month, and it requires verified structural income. Wwft customer due diligence and FIU reporting are separate obligations.

What failures led to the largest recent UKGC source of funds settlements?

QuinnBet (£609,104, August 2026) involved delayed SARs and inadequate source of funds assessments. Grosvenor Casinos (£5,012,261, October 2026) involved crypto users classified as standard risk contrary to internal policy.

Key Resources