Notifications
Clear all
Topic starter
10/07/2026 4:16 pm
TL;DR: US gaming operators face a compliance model split between federal BSA obligations and state-by-state gaming rules, while regulators are increasingly punishing weak identity checks, anonymous funding, and poor source-of-funds controls according to AU10TIX. For IAM and fraud teams, the practical problem is not onboarding speed but proving that identity, payment, and geolocation controls can hold across every jurisdiction and channel.
NHIMG editorial — based on content published by AU10TIX: AML/KYC compliance for US gaming operators
By the numbers:
- State regulators eliminated 45 offshore gambling operators in Michigan for illegally offering online casino games and sports wagering.
Questions worth separating out
Q: How should gaming operators implement KYC across multiple states?
A: They should build a jurisdiction-aware control model that applies the right age, geolocation, identity, and funding rules at each step of the customer journey.
Q: Why do gaming operators need both identity verification and geolocation controls?
A: Identity verification proves who is trying to play, while geolocation proves whether that person is allowed to play in that jurisdiction.
Q: What do gaming teams get wrong about AML and KYC automation?
A: They often automate only the first sign-up screen and leave funding, exclusion, and ongoing monitoring to manual review.
Practitioner guidance
- Map identity controls to each regulatory boundary Create a control matrix that ties federal BSA obligations, state gaming rules, age thresholds, exclusion checks, and geolocation rules to each product flow and jurisdiction.
- Automate document, biometric, and liveness verification Replace manual first-line review with automated document authentication, selfie matching, and liveness testing so fake IDs and synthetic accounts are blocked before account activation.
- Enforce continuous geolocation and funding checks Treat the player’s location and funding source as dynamic policy inputs that can change after login.
What's in the full article
AU10TIX's full article covers the operational detail this post intentionally leaves for the source:
- State-by-state compliance breakdowns for New Jersey, Nevada, Pennsylvania, Michigan, New York, Illinois, Colorado, and Connecticut
- Channel-specific verification workflows for retail versus online and mobile gaming environments
- Detailed examples of document authentication, liveness testing, database verification, and geolocation controls
- Operational differences between federal AML reporting and state gaming enforcement requirements
👉 Read AU10TIX's analysis of AML and KYC requirements for US gaming operators →
Gaming KYC and AML controls: what compliance teams need now?
Explore further
10/07/2026 4:18 pm
Gaming KYC is an identity lifecycle discipline, not a point-in-time onboarding task. The article makes clear that regulators care about registration, funding, ongoing monitoring, and offboarding through self-exclusion and account restrictions. That is the same lifecycle pattern identity teams already manage in IAM and IGA, but here the consequences attach to regulated wagering and financial reporting. Operators that still treat KYC as a front-door check are leaving the rest of the identity journey under-governed.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when gaming compliance fails?
A: Accountability now sits with both the operator and the named compliance owner, especially where states require licensed or personally liable officers. Teams should define decision ownership, evidence retention, and escalation paths before regulators ask for them, because compliance gaps are judged against both policy and governance.
👉 Read our full editorial: Gaming KYC and AML controls are tightening across US states
