Isle of Man Gambling Regulator Updates AML Guidance for Operators and B2B Relationships

According to the official GSC announcement, the revisions reflect changes in the risk environment identified through the 2025/2026 National Risk Assessments. Alongside updated financial crime typologies, the document explains how operators should assess risks across their businesses rather than considering individual customers in isolation.

The GSC said:

The underlying Code requirements remain unchanged.

This distinction matters for licence holders. The update is not a new law or a fresh licensing condition. Instead, it explains existing obligations and provides clearer insight into the regulator’s supervisory expectations.

The changes follow earlier Isle of Man updates to high-risk jurisdiction monitoring, including the jurisdiction’s revised FATF country lists.

One of the most relevant developments for the iGaming industry is the expanded discussion of commercial counterparties. Operators are expected to consider risks arising from B2B relationships, connected entities, group arrangements and beneficial ownership.

For businesses working with platform providers, payment partners or other intermediaries, this makes the quality of due diligence and risk documentation particularly important. Compliance reviews should consider who controls a business relationship and whether that relationship creates additional financial crime exposure.

The approach reflects wider regulatory concerns. The UK Gambling Commission recently raised the AML risk rating for gambling software businesses to medium, highlighting vulnerabilities in B2B due diligence and supply chains.

The revised guidance covers business, customer and technology risk assessments, alongside identity verification, customer due diligence (CDD) and enhanced due diligence (EDD).

It also addresses payment and transaction risks, terrorist and proliferation financing, financial sanctions, internal and external reporting, staff training and compliance appointments.

Technology assessments are particularly relevant as operators introduce new payment methods or software. Denmark’s gambling regulator has similarly emphasised the need to assess financial crime risks before deploying new technology, although its requirements apply under a separate national framework.

The GSC has asked operators to prioritise this guidance over its other recent publications, assess whether existing AML/CFT/CPF frameworks need adjustment and make any necessary updates as soon as practicable.

Further guidance is being developed for software suppliers, online gambling licence holders with network services permissions and virtual assets or goods. These documents are not part of the newly completed update.

For B2B operators and compliance teams, the immediate task is to identify any gaps between existing procedures and the clarified supervisory expectations, without treating the announcement as a change to the underlying law.