The iGaming Operator's Compliance Playbook: UKGC, MGA, and Curaçao

Licensing Comparison: UKGC vs MGA vs Curaçao

The three most common international iGaming licenses differ in cost, scope, enforcement posture, and market access. Operators must match their jurisdiction choice to their target player base, risk appetite, and operational capacity.

UK Gambling Commission (UKGC)

The UKGC license is the most rigorous — and the most valuable — regulatory credential in global iGaming. Operators must satisfy detailed Licence Conditions and Codes of Practice (LCCP), maintain UK-based compliance infrastructure, and demonstrate ongoing adherence through quarterly regulatory returns. The UKGC conducts regular audits and has revoked licenses from even large operators for failures in AML, safer gambling, or customer protection.

The UKGC license grants direct access to the UK market — the world's largest regulated online gambling market by gross gaming yield. It also carries the weight of the Economic Crime and Corporate Transparency Act 2023, which adds corporate criminal liability for failure to prevent fraud.

Malta Gaming Authority (MGA)

Malta's MGA license is the EU's most recognized iGaming credential. Operators licensed by the MGA can passport services across much of the European Economic Area (subject to each member state's national rules). The MGA framework is sophisticated — it distinguishes between B2C licenses (operator-to-player) and B2B licenses (for software providers and platform services) — and enforcement is active.

The MGA places strong emphasis on player protection, responsible gambling, and the integrity of gaming operations. The license is widely respected by payment processors, banks, and media partners — a factor that materially affects operator economics.

Curaçao

Curaçao's new 2024 licensing framework replaced the legacy "sub-license" model that had made the jurisdiction notorious for light oversight. Under the current framework, operators license directly with the Curaçao Gaming Control Board (GCB), comply with enhanced KYC and AML requirements, and submit to ongoing supervision.

Curaçao remains the most accessible international license — faster approval, lower capital requirements, broader acceptable payment methods — but the compliance obligations are no longer nominal. Operators treating Curaçao as a minimum-viable license should understand that enforcement has tightened and will continue to tighten.

KYC at Every Transaction Touchpoint

The common mistake in iGaming compliance is treating KYC as a one-time event at registration. In practice, effective operators verify (or re-verify) identity at three distinct touchpoints: registration, play, and withdrawal.

At Registration

Document capture, biometric matching, liveness detection, and age verification before any deposit. Operators should require full KYC at registration (not the deprecated "verify later" model where account creation is separated from identity verification). Age verification must be biometric or document-based — self-declaration does not satisfy UKGC or MGA standards.

Biometric deduplication at registration catches multi-accounting before a bonus is paid. This is the single highest-ROI control an operator can implement: bonus abuse costs 10–15% of promotional spend, and biometric dedup eliminates the most common vectors.

During Play

Session-level verification triggers when a player's activity deviates from their verified profile: sudden changes in deposit size, play duration, or game selection. Behavioral monitoring should produce risk signals that route to compliance for review, not automatic account restrictions (which create friction for legitimate high-rollers).

Responsible gambling checks integrate here: the LCCP requires operators to identify players showing signs of harm and intervene proportionately. Integration of identity, behavioral, and affordability signals produces the composite risk picture the UKGC expects.

At Withdrawal

Before the first withdrawal, operators must have completed full Source of Funds (SoF) verification for any account exceeding the threshold set by jurisdiction (typically £2,000 aggregate under UKGC; thresholds vary elsewhere). Withdrawals are the highest-risk transaction type from an AML perspective — they are where laundered funds leave the operator's custody.

Withdrawal-gated KYC prevents the "play-then-demand" pattern where fraudulent accounts deposit, win, and attempt to cash out to newly verified payment methods. Full verification before withdrawal closes this gap.

AML Obligations

Gambling is a designated "covered person" or "accountable institution" category in most regulated jurisdictions. Operators must implement the full AML program: customer due diligence at onboarding, ongoing transaction monitoring, suspicious activity reporting, sanctions screening, PEP screening, and record retention.

Under UK law, operators must file Suspicious Activity Reports (SARs) with the National Crime Agency for any transaction or pattern suggesting money laundering. Under Maltese law, reports flow to the Financial Intelligence Analysis Unit (FIAU). In all cases, the SAR filing standard is "knowledge or suspicion" — a deliberately low bar that creates significant filing volume at scale.

Pull quote

“The UKGC has revoked licenses for AML failures. It has also fined operators for insufficient SAR filings. The regulator expects volume — operators that file too few SARs are signaling inadequate monitoring.”

iGaming-Specific AML Red Flags

Responsible Gambling Integration

Responsible gambling is not a separate workflow — it is an identity-linked capability. GAMSTOP (UK) and its equivalents elsewhere require operators to check every new registration against a self-exclusion register and to maintain that check for the duration of the self-exclusion period. Operators that fail to enforce self-exclusion face UKGC fines.

The identity verification system must integrate with self-exclusion registries, affordability checks, and problem-gambling indicators. When a player self-excludes, the system must not only close the active account but also prevent re-registration under any name variation the same person might try. This requires biometric matching against self-excluded individuals — not just name-and-date-of-birth matching, which fails against common identity variations.

The UK "Failure to Prevent Fraud" Offense

Section 199 of the Economic Crime and Corporate Transparency Act 2023 creates corporate criminal liability for large organizations that fail to prevent fraud committed by associated persons. Most UKGC-licensed operators of meaningful scale qualify as "large organizations" under the Act.

The only defense is demonstrating "reasonable procedures" were in place. Identity verification that catches synthetic identities, prevents multi-accounting, detects deepfake-assisted fraud, and maintains continuous monitoring — with audit logs documenting system operation — is the evidentiary foundation of that defense.

The 90-Day Compliance Action Plan