Gambling And Money Laundering In Gibraltar: Current Controls

For Gibraltar gambling businesses, anti-money laundering work is an ongoing operational responsibility. This updated article replaces the old speculative examples with a high-level explanation of current official guidance and the practical questions a website or system project should address. Reviewed on 24 October 2026.

Start With The Current Risk Framework

The Gambling Division publishes the remote gambling AML Code and sector risk material. Its guidance covers money laundering, terrorist financing and proliferation financing. Operators should build their policies around the applicable law and official guidance, including their own assessment of customers, products, markets and payment arrangements.

Know The Customer And Review Changing Risk

The remote code addresses customer due diligence, enhanced checks where appropriate, source-of-funds enquiries and ongoing monitoring. A customer’s use of a regulated bank is not a substitute for the operator’s own checks. Risk decisions and supporting records need to be maintained by the responsible business.

Design Usable Review Processes

As a system-design consideration, define how authorised staff can review an alert, request information and record a decision. Separate an automated signal from a final judgement. The compliance team should specify the rules; the developer should make those requirements testable and preserve a clear record of the workflow.

Protect Documents And Restrict Access

Customer verification can involve sensitive information. Define staff permissions, secure submission routes and retention requirements before building upload forms. Avoid sending identity documents through ordinary enquiry forms. Test access controls with different staff roles and include document storage in the security and recovery review.

Assign Responsibility For Ongoing Changes

Nominate owners for policy updates, staff training and technical changes. If a product or payment method changes, revisit the assessment before release. OXO can help implement agreed website and application requirements, but the licensed business and its advisers remain responsible for interpreting and meeting the applicable obligations.