4 min read
A licensed gaming operator needs a compliance programme that works every day, not just a policy document written for the application. This guide covers the three core parts: know-your-customer (KYC) and anti-money laundering (AML) controls, reporting, and internal controls.
KYC: knowing who your players are
Every player should be identified and verified before they can deposit or withdraw. A typical KYC flow collects the player’s name, date of birth and address, checks a valid government ID, and confirms the person is of legal age. Higher-risk players, such as those making large transactions or politically exposed persons, need enhanced checks. Your system should record when and how each player was verified.
| Risk level | Examples | Checks |
|---|---|---|
| Standard | Typical recreational player | ID, age, address, sanctions screening as required |
| Higher | Large or unusual transactions | Enhanced due diligence, source of funds |
| Politically exposed persons | Public officials and close associates | Enhanced checks and senior approval |
AML: spotting and reporting suspicious activity
Casinos, including internet-based casinos, are covered persons under the Philippine Anti-Money Laundering Act, supervised by the Anti-Money Laundering Council (AMLC). In practice this means:
- Monitoring transactions for unusual patterns, such as deposits followed by withdrawals with little play
- Filing covered and suspicious transaction reports as required
- Keeping transaction and identity records for the required period
- Training staff to recognise and escalate red flags
Reporting to the regulator
Operators are expected to provide regular reports to PAGCOR and other authorities. The easiest way to meet this is to design your platform so reports come directly from reliable transaction data instead of being assembled by hand in spreadsheets.
Reconcile reports against payment provider statements, keep a record of every submission and fix discrepancies at the source, not in the report.
Internal controls
- Clear roles: separate duties so no single person can approve and process the same payout.
- Access control: staff only see the data and functions they need.
- Audit logs: record every admin action, especially changes to player accounts and balances.
- Regular reviews: test your controls periodically and fix weaknesses.
Strong control
Two people approve large payouts; balance changes require a reason and are logged.
Weak control
Shared admin logins; balances edited directly in the database without a record.
Appoint a responsible officer
Name a compliance officer who owns the programme, keeps policies up to date and reports to management. Without clear ownership, even good policies are not followed.
Frequently asked questions
Are online casinos covered by AML law in the Philippines?
Yes. Internet-based casinos are covered persons under the Anti-Money Laundering Act, supervised by the AMLC.
When should KYC happen?
Before a player can deposit or withdraw. Higher-risk players need enhanced checks.
Why avoid spreadsheet reporting?
Manual reports are error-prone and hard to audit. Reports generated from transaction data are more reliable and easier to defend.
This article is general information, not legal advice. Gaming rules in the Philippines change, so always confirm current requirements directly with PAGCOR and a qualified Philippine lawyer before you apply or launch.
