Source of Funds Checks in iGaming: Triggers & Proof

A source of funds (SoF) check asks a player to prove that the money they are gambling with came from a legitimate origin, while a source of wealth (SoW) check tests how their overall wealth was built. In iGaming, both are enhanced due diligence (EDD) steps layered on top of standard know your customer (KYC) and anti-money laundering (AML) onboarding. They are not run on every player; operators trigger them from risk signals, deposit velocity and cumulative thresholds, then pause payouts until the documents clear.

This guide explains when source of funds checks fire, what evidence to request, how to score it, and how to keep the process defensible to regulators such as the UK Gambling Commission (UKGC), the Malta Gaming Authority (MGA) and the Alcohol and Gaming Commission of Ontario (AGCO). It is written for operators and compliance teams; it is not legal advice, and thresholds vary by licence, so always confirm against your own regulator's current guidance.

Source of funds vs source of wealth: the compliance difference

The two terms are often used interchangeably, but regulators treat them as distinct. Source of funds looks at the specific pot of money entering the account right now. Source of wealth looks at the bigger picture of how a customer accumulated their assets over time. A player might show that a single deposit came from a salary payment (SoF) yet still need to explain how they can afford to stake far beyond that salary (SoW). Enhanced due diligence usually combines both, especially for high-value players and anyone flagged as a politically exposed person (PEP).

Getting this split right matters because an operator that collects a single payslip and calls it "source of wealth" has not actually met the enhanced standard. When you compare KYC and AML providers for iGaming operators, check whether their case management tooling separates SoF evidence from SoW evidence rather than lumping both into one document upload.

What triggers source of funds checks

Source of funds checks are activity-based, not universal. Running them on everyone destroys conversion; running them on no one breaches AML obligations. The art is a trigger matrix that fires EDD only when risk justifies the friction. Common triggers reported across UKGC-licensed and Ontario operators include:

• Cumulative deposit or loss thresholds — for example a rolling 12-month net deposit figure set by the operator's risk appetite.
• Single large transactions — a deposit or withdrawal above a set value (some EU operators reference a €2,000 occasional-transaction line from the AML directives; confirm your own figure).
• Velocity and pattern changes — a sudden jump in deposit frequency or stake size versus the player's own baseline.
• Risk flags — PEP or sanctions matches, adverse media, high-risk payment methods, or mismatched geolocation.
• Affordability overlap — in Great Britain, customer interaction and financial-vulnerability signals can escalate into an SoF request, so affordability and AML triggers increasingly share one workflow.

Document every trigger value in your AML policy and keep them consistent. Regulators penalise operators far more harshly for having no documented rationale than for choosing a threshold they can defend.

Documents to request and how to score them

Ask for the least intrusive evidence that genuinely proves the claim, then escalate only if it fails. The table below maps common wealth origins to acceptable documents and the checks a reviewer should apply.

Score each submission on three axes: authenticity (is the document genuine and unedited?), adequacy (does it cover the amount in play?) and consistency (does it match the KYC identity and declared occupation?). A payslip that clears identity but shows income far below the player's monthly losses is adequate as SoF yet raises an unresolved SoW question. Record the reviewer's reasoning in the case file, because an audit trail is what a UKGC or MGA examiner actually reads.

Building a defensible SoF/SoW workflow

A workable process has five stages: detect the trigger, pause the relevant transaction (usually the withdrawal, not the whole account where rules allow), request proportionate evidence, review against the three axes, and decide — approve, request more, or escalate to a suspicious activity report (SAR). Each stage needs timestamps and an owner.

• Communicate clearly. Tell the player exactly what is needed and why; vague requests drive complaints and abandonment.
• Set service levels. A review backlog that holds legitimate withdrawals for days is both a conversion problem and a complaints risk.
• Keep records for the retention period. Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) expects reporting entities to retain records for five years; UK and EU regimes use similar horizons.
• Separate the SAR decision. If evidence cannot explain the funds, the nominated officer — not the front-line reviewer — decides on a report to the Financial Transactions and Reports Analysis Centre (FINTRAC) or the relevant Financial Intelligence Unit, and the player must not be tipped off.

The Financial Action Task Force (FATF) sets the global standard that national regimes implement, so anchoring your policy language to FATF concepts keeps it portable across markets. For current obligations, read the guidance published by the UK Gambling Commission and your own licensing regulator before finalising thresholds.

How source of funds rules differ by market

There is no single global SoF rulebook. Operators holding several licences must run the strictest applicable standard per player, because a regulator judges your conduct against its own regime regardless of where the customer sits. The table below summarises how the leading iGaming jurisdictions frame the obligation; treat the detail as orientation and verify against the live regulator text.

Because the Financial Action Task Force underpins all of these, a policy written around FATF language travels well. Where a player touches two regimes — say a UK resident on a Malta-licensed brand — apply the higher bar and note the reasoning in the file.

Red flags, manual review and false positives

Automation can clear clean submissions in minutes, but source of wealth questions almost always need human judgement, so a manual-review queue is unavoidable. Keep that queue small and fast by tuning triggers, and watch for the patterns that genuinely indicate laundering rather than mere friction. High-signal red flags include deposits from third-party cards or accounts that do not match the verified identity, rapid deposit-then-withdraw with minimal play, reluctance or inability to evidence an income that supports the stakes, and documents that look edited or inconsistent across submissions.

• Third-party funding — money arriving from someone other than the account holder is a classic mismatch between KYC identity and source of funds.
• Structuring — many deposits just under a trigger value can indicate deliberate threshold avoidance.
• Document tampering — altered payslips or statements should fail authenticity and escalate, not simply be re-requested.
• False positives — legitimate players with lumpy income (freelancers, seasonal workers) will trip velocity rules; a good reviewer resolves these quickly rather than freezing funds indefinitely.

Measure the queue the way you would any operational funnel: auto-clear rate, median review time, over-request rate (evidence asked for but not needed), and complaint volume. A rising over-request rate usually means the triggers are too blunt, not that players are riskier. Feeding these metrics back into the trigger matrix is what turns a reactive, complaint-prone process into a controlled one that satisfies both the examiner and the finance team.

Responsible gambling and the affordability link

Source of funds work increasingly overlaps with responsible-gambling duties. A player who cannot evidence funds that match their losses may be gambling beyond their means, which is a harm signal as well as an AML signal. Treat the two lenses together: an SoF request that surfaces financial distress should route into customer-interaction and, where appropriate, self-exclusion pathways. Gambling must stay entertainment, not a source of income, and services are restricted to adults — 18+ in most markets and 19+ for online gaming in Ontario. Never frame checks as a route to guaranteed winnings, and never advise players on how to bypass verification.

Done well, source of funds and source of wealth checks protect three things at once: the operator's licence, the integrity of the payments system, and vulnerable players who might otherwise gamble money they cannot afford to lose. The goal is proportionate friction — fast and invisible for low-risk players, rigorous and well-documented for the minority who warrant a closer look. Build the trigger matrix, evidence rubric and SAR escalation into your onboarding stack from day one rather than bolting them on after a regulator asks, and revisit the thresholds each time your player mix, payment methods or licensing footprint changes.

18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.

Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.

← All articles