Compliance & Licensing Glossary

What it means

Anti-Money Laundering covers everything an operator does to detect and block criminal funds: identity checks at onboarding, transaction monitoring, source-of-funds requests, suspicious activity reports to the regulator, and staff training. It sits on top of KYC — KYC establishes who the player is, AML watches what that player then does with their money.

Why it matters for operators

AML failures produce the largest fines in the industry, and they attach to the licence, not just the balance sheet. Regulators like the UKGC and MGA expect a risk-based programme: thresholds that trigger enhanced due diligence, monitoring tuned to deposit patterns, and an appointed money laundering reporting officer. "We didn't know" is not a defence — the obligation is to have systems that would have known.

Example

A player deposits just under the reporting threshold several times a week across two payment methods, wagers minimally and withdraws to a third method. Volume alone looks unremarkable; the pattern is classic layering, and a working AML programme flags it for review before the withdrawal clears.

What it means

Bonus abuse covers behaviour that takes promotional value in ways an operator didn't intend and its terms don't permit. The clearest cases break a stated rule: multi-accounting to claim a welcome offer repeatedly, false registration data, automated play, or hedged arbitrage positions held across linked accounts. The murkier cases don't break anything — a player who picks the lowest-volatility permitted game, bets minimum qualifying stakes and withdraws the moment the requirement clears has simply read the terms more carefully than the person who wrote them.

That distinction matters more than it sounds. If a behaviour irritates you but breaches no term, the problem is promotion design, not fraud.

Why it matters for operators

Abuse hits twice. The direct cost is the bonus itself, concentrated in welcome offers where money is unconditioned by any prior relationship. The second-order cost is worse: if a meaningful share of your new depositors are the same handful of people, your FTD counts, retention curves and LTV models are all wrong, and every acquisition decision built on them inherits the error.

Regulation has raised the stakes. The UK capped wagering requirements at 10x from January 2026 and banned mixed-product bonuses, retiring the informal defence of making offers too hard to clear. More promotional value now converts into withdrawable funds — for genuine players and abusers alike — so detection has to do the work terms used to.

The other edge is compliance. Voiding a withdrawal on weak evidence is, from the player's side, indistinguishable from refusing to pay, and every regulated market treats withheld winnings as a consumer-protection matter. Single-signal confiscation is what generates complaints.

Example

A player registers three accounts using variations of the same identity, claims the welcome offer on each, and hedges outcomes between two of them. Device and payment-instrument signals link the cluster; the operator recovers the bonus and derived profit and closes the accounts, citing the specific term breached rather than a general abuse clause.

What it means

Channelisation measures how much of the total gambling in a jurisdiction flows through licensed channels. A regime at 90% channelisation has captured nearly all play; one at 50% has half its activity happening outside the licensed system, beyond the reach of player protection, tax collection and responsible gambling controls. It's usually estimated rather than measured directly, since the denominator includes activity nobody reports.

Why it matters for operators

Channelisation is the argument that decides whether taxes and restrictions keep tightening. Regulators raising duty or imposing deposit limits face a trade-off: each turn of the screw increases revenue per licensed player while pushing some players toward unlicensed sites offering better odds and fewer checks. Operators cite falling channelisation when lobbying against increases, and regulators watch it because a licensed market that players leave has failed at its actual purpose. For market-entry planning, a market with weak channelisation means the licensed competitive set understates who you're really competing with.

Example

The Netherlands raised its gambling tax three years running — 30.5%, then 34.2%, then 37.8% from January 2026 — and the regulator publicly warned about the channelisation effect. Licensed operators facing a higher tax and stricter play limits compete against unlicensed sites carrying neither, so a rate rise that looks like more revenue per euro can produce fewer euros overall.

What it means

Enhanced Due Diligence is what happens when standard KYC isn't enough. High deposit volumes, politically exposed persons, high-risk jurisdictions, or behaviour flagged by AML monitoring all trigger a deeper pass: source of funds and source of wealth evidence, bank statements or payslips, and a documented review before the account keeps playing.

Why it matters for operators

Where you set EDD thresholds is a direct trade-off between compliance and revenue. Set them too high and the regulator finds unchecked high-risk accounts; set them too low and you're asking mid-value players for payslips, which is where many of them leave for a competitor. Regulators increasingly prescribe the floor — UK financial risk checks are effectively mandated EDD at defined loss levels — so the operator's real decision is how smooth the evidence-collection flow is.

Example

A player's monthly deposits jump from 200 to 8,000. The account is automatically restricted from further deposits until they upload proof of funds; a compliance analyst clears it within hours if the documents check out. Slow, manual handling of that same review is how operators lose their best customers.

What it means

Geofencing enforces a geographic boundary in software: the platform verifies where the player physically is and allows or blocks play accordingly. Serious implementations fuse multiple signals — IP address, Wi-Fi triangulation, GPS, cell-tower data, device integrity checks — because any single signal is spoofable. It's worth separating from geo-blocking, which is usually a crude IP-based deny list: geo-blocking keeps a region out, while geofencing proves a player is inside a permitted one. Regulated US markets demand the latter, typically through certified geolocation providers whose job is confirming presence to state-line precision.

Why it matters for operators

Location enforcement is a licence condition, not a UX feature. US states and Ontario require certified geolocation before a bet is accepted, precise enough to hold at state and provincial borders; European regimes require operators to confine service to their licensed territory. Weak geofencing is how an operator ends up demonstrably serving a market it isn't licensed for — and unlike most compliance failures, this one leaves a perfect audit trail of timestamped bets attached to locations.

The adversary keeps improving. VPNs are table stakes; residential proxies, GPS spoofing apps and rooted or emulated devices are the current front, which is why modern stacks pair location signals with device fingerprinting and integrity attestation, and why location gets rechecked during sessions rather than only at login. There's a tension to manage deliberately: checks aggressive enough to stop spoofers will sometimes fail honest players on flaky connections near a border, and how the product handles that failure — silent bet rejection versus a clear recheck prompt — shows up directly in support tickets and churn.

Example

A player sits near a state border and their location confidence drops mid-session. A compliant stack degrades gracefully: in-flight bets settle, new bets pause, and the player gets a recheck prompt with a clear explanation. A sloppy one either lets the next bet through — a reportable violation — or dumps the session with no explanation and creates a support escalation instead.

What it means

A grey market is a jurisdiction with no local licensing regime for online gambling but no effective prohibition either — operators serve players there under an offshore licence, tolerated rather than authorized. It sits between white markets (locally licensed and regulated) and black markets (explicitly illegal, actively enforced). The label is fluid: Brazil was grey for years before its 2024-25 licensing regime, Kenya moved from loosely licensed to tightly regulated, and markets like New York for iGaming remain grey-adjacent while legislation stalls.

Why it matters for operators

Grey revenue is real revenue with an expiry date. Payment processors price the risk into fees, banks can freeze flows, and when a market regulates, past grey activity often surfaces in licence applications — several European regulators ask directly about it. The strategic question isn't whether grey markets are worth serving; for many operators they fund growth. It's whether you can convert when the door opens: local licensing usually favours operators with clean books, local payment rails and an exit-ready AML posture. Regulation waves in Latin America, Africa and the US mean the grey share of global GGR shrinks every year.

Example

An operator builds a strong position in an unregulated market under a Curacao licence. When the country announces a local regime with a cooling-off clause for former offshore operators, the operator's two years of grey revenue become a liability in the application — while a competitor that geo-blocked the market eighteen months earlier sails through licensing.

What it means

Know Your Customer is the set of checks an operator runs to confirm who a player is: identity and age verification, address checks, and — for higher-risk players — source-of-funds documentation. It underpins anti-money-laundering compliance and fraud prevention.

Why it matters for operators

KYC is a legal requirement in regulated markets and a practical defence against chargebacks and bonus abuse. The hard part is balance: too much friction at signup kills conversion, too little invites fraud and regulatory penalties. Risk-based KYC — light at signup, deeper at withdrawal or thresholds — is the common compromise.

Example

Many operators allow play after light verification but require full KYC before the first withdrawal, balancing conversion against compliance.

What it means

Multi-accounting is a single person running more than one account on the same operator, typically with variations on identity data, different payment instruments and — for anyone competent — different devices and connections. It's the volume engine behind most bonus abuse: one determined individual with a supply of SIM cards and e-wallets can consume the acquisition budget of a small market. Organised versions run at farm scale, dozens or hundreds of accounts across several operators, often with rented identity documents and scripted play.

Why it matters for operators

Detection depends on correlating signal families rather than trusting any single one. Device fingerprinting catches the careless and misses genuine device farms. Network signals have weakened sharply now that residential proxy pools resell real consumer IP addresses at scale, so a clean IP proves little. Identity signals — document similarity, fuzzy name and date-of-birth matching, payment instrument reuse — are where a KYC stack earns its keep beyond regulatory box-ticking. Behavioural signals are hardest to fake and slowest to fire, which makes them a second line rather than a gate.

Every one of those has a false-positive mode attached, and each false positive is a real customer being accused. Shared household devices, office connections and carrier-level NAT all produce innocent links. That's why serious operators score rather than switch, and why pausing a withdrawal, closing an account and confiscating winnings should sit at three different evidence bars.

Example

Nineteen accounts share a device fingerprint across cleared cookies and incognito sessions, register within a four-hour window from the same network segment, and each claim the welcome offer. The device link alone is suggestive; combined with reused payment instruments it becomes actionable.

What it means

Responsible gambling, often shortened to RG, covers everything an operator does to reduce gambling-related harm: deposit and loss limits, time-outs, reality checks, age and identity verification, self-exclusion, and proactive intervention when behaviour looks risky. In regulated markets it's a licence condition, not a goodwill gesture.

Why it matters for operators

Regulators increasingly expect operators to spot and act on markers of harm, not just offer tools players have to find themselves. Weak RG draws fines, licence reviews, and reputational damage; strong RG is part of the compliance maturity that lets you operate in the markets worth being in. It ties directly into KYC and the data your PAM holds on each player.

Example

A player whose deposits spike sharply and who starts chasing losses at 3am should trigger an RG flag — a reality check, a limit prompt, or a manual review — rather than be left alone because they're profitable.

What it means

A supplier licence (or B2B licence) is a regulator's direct grip on the vendors behind an operator: the platform, the game aggregator, the studios, and in some regimes payment, hosting and testing providers. Instead of policing the supply chain only through operator licence conditions, the jurisdiction licenses or registers the suppliers themselves. Mature markets already work this way — the UK licenses gambling software suppliers, Malta issues B2B Critical Gaming Supply licences, US states run supplier and vendor licensing, and Brazil ties market access to labs and suppliers on recognised lists.

The direction of travel is unmistakable. Curaçao — historically the definition of light-touch — brings its LOK supplier regime into full effect on 24 December 2026: Curaçao-based suppliers need a CGA licence, foreign suppliers must register, and Article 5.16(4) bars licence holders from obtaining critical services from unregistered suppliers. The CGA has urged domestic suppliers to apply by 1 September 2026 and expects registration for foreign suppliers to open around October 2026.

Why it matters for operators

Your vendor's regulatory status is your compliance exposure. When a supplier regime takes effect, an operator can be fully licensed and still in breach because a vendor in the stack isn't. That turns procurement into a compliance function: contracts need warranties on licence status, obligations to notify on lapse or refusal, and exit rights that can actually be exercised — swapping a turnkey platform mid-flight is a project measured in quarters, not weeks.

It also reshapes vendor selection. A supplier already licensed in several strict regimes has survived probity checks, source-of-funds scrutiny and technical audits; one that has only ever sold into grey markets may not clear the bar at all, and its roadmap for doing so is a question worth asking before signing, not after.

Example

An operator's aggregator misses the Curaçao registration deadline. Nothing breaks technically — games keep spinning — but from that day every game round routed through the unregistered aggregator is a licence-condition problem for the operator, discoverable in the next audit and attributable to a contract the operator chose to keep.

What it means

A turnover tax (also called a stake tax or handle tax) applies to every unit wagered, regardless of whether the player wins or loses. This differs fundamentally from a GGR tax, which applies only to what the operator keeps after paying winnings. Because players recycle the same money many times over a session, stakes vastly exceed revenue — so a turnover tax with a low headline rate can cost far more than a GGR tax with a high one.

Why it matters for operators

Converting a turnover tax into comparable terms takes one division: the tax rate divided by your hold percentage. A 5.3% stake tax against a 4% hold equals 133% of gross gaming revenue, which is a structurally impossible business. Against an 8% hold it equals 66%. This is why operators in stake-taxed markets cut RTP rather than absorb the levy, and why product mix shifts toward higher-hold verticals. Any market-entry model that compares headline rates across differently-based taxes will reach the wrong conclusion.

Example

Germany taxes virtual slots and online poker at 5.3% of stakes. At an international 96% RTP the tax would exceed the entire gross margin, so German slots typically run at 92-94% RTP instead — raising hold to 6-8% and bringing the effective burden down to roughly 66-88% of GGR. The operator nominally pays; the player funds it through a worse-paying game.