The Isle of Man GSC's updated AML/CFT guidance (v1.4, November 2026) raises the bar on evidence. Operators are now expected to keep risk ratings live for every customer, apply baseline monitoring across their entire player base, and prove that their identity checks and B2B arrangements stand up to scrutiny.
The Code has always required your business risk assessment to "have regard to" the National Risk Assessment. v1.4 now says you should be able to show how the NRA actually shaped your risk assessments, monitoring and controls. Reading it isn't enough. You need to show what you did about it.
The stakes have gone up too. The 2026 Gambling NRA rates online gambling as medium-high risk, and new legislation lets the GSC hold senior individuals personally to account, not just the licence holder.
And it's not just the Isle of Man. In July the UK Gambling Commission warned that AI is testing customer due diligence controls, and that illegal sites expose operators to illicit funds through their B2B relationships. In September, FATF published its first major gambling risk report since its 2009 work on casinos. The direction of travel is the same everywhere.
What's actually new
These are the parts that are genuinely new since v1.3:
Show how the NRA shaped your controls: Not just that you read it.
Keep customer risk ratings live: They should move when behaviour or information changes.
Don't forget low-risk customers: Everyone gets baseline monitoring.
Mind the gaps in B2B arrangements: On hosted and shared platforms, no single party may see the whole customer, and AML duties become fragmented.
Check what "verified" really means: Use layered ID checks against fake and synthetic identities, and keep the evidence.
Add sanctions to internal reporting: Matches, attempted breaches and frozen assets all need a route.
Give your technology risk assessment its own document.
What this looks like day to day
Risk ratings that move. A rating set at sign-up and checked once a year is a snapshot. The GSC now wants something closer to live video, for every customer.
One view of each player. If AML, fraud and safer gambling alerts sit in different tools, one player can set off three alerts and nobody sees the full picture. FATF itself notes that signs of money laundering and problem gambling "may co-exist". As Endida's Sandeep Sroa put it in FATF has shown its hand on gaming and gambling: the risk is in the correlation. Joining up accounts, devices and payments turns ten alerts into one clear risk.
Evidence behind every tick. The NRA names fake, stolen and mule identities as core threats. A green tick from a supplier doesn't count for much if you can't see what's behind it.
Can an inspector follow the thread?
Earlier this year, William Bisson wrote about The Three Layer Framework: NRA, BRA and CRA. His point was simple: the three layers only work if they're built properly, linked together and kept up to date. v1.4 now expects exactly that.
A good test is whether an inspector can follow one risk all the way through:
The NRA names a threat, say mule accounts.
Your BRA explains how it affects your products, payments and partners, and what you've put in place.
Your customer risk ratings change when that threat shows up.
Your alerts and decisions prove the control is working.
If the thread snaps anywhere, so does your evidence.
Six questions to ask before your next board meeting
Which NRA findings changed our risk assessment, and where is that written down?
Do risk ratings update when behaviour changes, even for low-risk customers?
Can we see each player across all our own brands and products?
Where a B2B partner handles onboarding or payments, who is responsible for which checks, and how do we know they're done?
When our ID provider says "verified", can we see the proof?
What happens to a sanctions match, and who decides?
If the honest answer to any of these is "it depends who you ask", that's your starting point. We're always happy to compare notes.
Image by jorono on Pixabay