KYC Screening: PEP, Sanctions & Adverse Media

KYC screening is the check of a player's identity against sanctions lists, politically exposed person (PEP) databases and adverse media, done at registration and repeated whenever the lists or the player's risk changes. For an iGaming operator it decides who you may accept, who needs enhanced due diligence and whose funds you must freeze or report.

Identity verification proves a player is who they say they are. KYC screening asks a different question: is this verified person someone you are not allowed to serve, or someone who needs closer scrutiny? In Canada that obligation sits under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), supervised by FINTRAC, and elsewhere under standards shaped by the Financial Action Task Force (FATF). This guide covers the three screening types, the list sources that matter, how often to screen and how to handle alerts without drowning your compliance team.

The three parts of KYC screening

Most operators buy all three as one feed from a screening vendor. Our KYC provider shortlist compares vendors that bundle identity verification with screening, and the pricing differences between them.

Sanctions screening: list sources that matter

Sanctions lists are published by governments and change without warning, sometimes several times a week. The lists you screen against should follow where you are licensed and where your players, payment partners and banks sit.

Matching quality

Names come in many spellings and scripts, so vendors use fuzzy matching. Set it too loose and your team spends its day clearing "Mohammed Ali" hits; too tight and you miss a transliterated name. Good practice is to match on name plus at least one secondary identifier, such as date of birth or nationality, and to document the threshold you chose and why.

PEP screening: who counts and what you must do

A politically exposed person is someone entrusted with a prominent public function, such as a head of state, minister, senior judge, ambassador or senior military officer, plus their family members and close associates. Canada distinguishes three groups, and FINTRAC's PEP and HIO guidance for account-based reporting entities, which includes casinos, sets out the obligations.

• Foreign PEPs are automatically high risk. You must take reasonable measures to establish source of funds (and, as good practice, source of wealth), get senior management approval to keep the account and apply enhanced ongoing monitoring.
• Domestic PEPs and heads of international organisations (HIOs) trigger those measures only where your risk assessment finds a high risk.
• Timing: determinations are required at account opening, during periodic monitoring, when you detect a fact suggesting PEP status and on large transactions such as casino disbursements of $100,000 or more. The required follow-up steps must be completed within 30 days.
• Records of determinations must be kept, generally for at least five years.

A PEP match is not a reason to refuse a player. Blanket de-risking of PEPs is discouraged by regulators; the point is proportionate scrutiny.

Adverse media screening

Adverse media fills the gap between "not sanctioned" and "clean". It picks up allegations of fraud, bribery, money laundering, organised crime or sports corruption before any list does. Vendors such as LSEG World-Check, Dow Jones Risk & Compliance, LexisNexis Risk Solutions and ComplyAdvantage classify news by risk category so you can filter out noise such as a player simply sharing a name with a news subject.

• Use credible sources only; unverified social media posts should not drive a decision alone.
• Weight recency and severity: a 12-year-old minor fine is not the same as a current fraud charge.
• Pay special attention to match-fixing and sports betting corruption stories if you offer sportsbook.

How often to run KYC screening

Screening once at registration is not enough. Lists change and players' circumstances change. A practical schedule for an online casino looks like this; the triggers in bold are regulatory in Canada, the rest reflect common industry practice.

Rescreening costs money per check. Our breakdown of KYC cost per check shows how batch rescreening is usually priced compared with onboarding checks.

Handling screening alerts

An alert is a possible match, not a finding. Most alerts are false positives, and your process has to clear them quickly without clearing the real one.

1. Triage (level 1): compare the alert to the player's verified data: full name, date of birth, nationality, photo. Discount obvious mismatches and record why.
2. Investigation (level 2): for anything unresolved, pull the full list entry or article, check aliases, and request information from the player if needed.
3. Decision: true sanctions match means stop, freeze funds and report as required; a PEP match goes to EDD and senior approval; adverse media feeds the risk rating.
4. Reporting: in Canada, suspicious activity goes to FINTRAC as a suspicious transaction report, and property of a listed person may need a listed person or entity property report plus disclosure to the RCMP and CSIS. Take legal advice on sanctions matches.
5. Record: keep the alert, evidence, decision and approver. Auditors test the reasoning, not just the outcome.

Keeping false positives under control

• Tune matching thresholds with data, not by guesswork, and re-test after any change.
• Whitelist confirmed false positives so the same player does not alert daily, but re-review the whitelist when the list entry changes.
• Set service levels: for example, clear level 1 alerts within one business day and block withdrawals, not deposits, while a sanctions alert is open.
• If volume outgrows your team, consider KYC managed services for level 1 review while keeping decisions in-house.

Building an AML screening programme for iGaming

Good AML screening in iGaming is less about the vendor and more about the written programme around it. Regulators and auditors look for five documented elements:

Seeded-name testing

The simplest way to prove screening works is to run test profiles built from real list entries (with variations in spelling, word order and date format) through your onboarding flow in a test environment. If a transliterated name of a designated person passes without an alert, your matching is too tight. Record the results; FINTRAC examiners and AGCO auditors both value evidence over policy statements.

Screening and player experience

Most players never notice screening, because it runs in the background during sign-up. Friction only appears when an alert fires. Hold the account in a pending state rather than rejecting it, tell the player you are completing standard checks, and resolve false positives quickly. A long silent block on a legitimate player is a complaint risk and a responsible gambling concern if they keep trying to deposit elsewhere.

PEP screening in practice: a worked example

Suppose a new Ontario player's registration returns a PEP screening hit: the name and date of birth match a sitting member of a foreign parliament. The operator confirms the match against the player's verified ID, which makes the player a foreign PEP and therefore high risk. Within the required window the compliance team asks for source of funds (for example, salary statements or a property sale), a senior manager approves or declines keeping the account, and enhanced monitoring rules are applied, such as lower thresholds for withdrawal review. The account is not refused simply because of PEP status. If the player refuses to provide source-of-funds information, the operator can decline to continue the relationship and consider whether a suspicious transaction report is warranted.

Regulator expectations in Canada's main markets

In Ontario, operators registered with the Alcohol and Gaming Commission of Ontario (AGCO) and contracted with iGaming Ontario must meet the Registrar's Standards for Internet Gaming, which include robust player identity and AML controls, on top of their FINTRAC obligations. Quebec's Loto-Québec runs its own programme for Espacejeux. Operators licensed in the UK by the UK Gambling Commission face similar expectations under the Money Laundering Regulations. Whatever the market, regulators ask the same thing: show a documented, risk-based screening programme that is actually followed.

This guide is general information as at September 2026, not legal advice. Sanctions regimes change quickly; confirm current obligations with counsel and your regulator. Online gambling is for adults only (19+ in Ontario, 18+ in Quebec), and operators must support responsible gambling tools for every player.

18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.

Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.

← All articles