Isle of Man GSC updates AML guidance for online and B2B gambling firms

The Isle of Man Gambling Supervision Commission (GSC) has introduced updated anti-money laundering guidance for gambling operators, placing greater emphasis on financial crime risks associated with online betting, business-to-business (B2B) relationships and wider corporate structures. Published on 10 November 2026, the revised guidance reflects developments identified in the jurisdiction’s 2025 and 2026 National Risk Assessments and provides greater clarity on the regulator’s expectations for licence holders.

The updated framework asks gambling businesses to examine whether their existing anti-money laundering, countering the financing of terrorism and countering proliferation financing (AML/CFT/CPF) arrangements adequately address the risks associated with their activities. Although the underlying legal requirements remain unchanged, the GSC expects operators to give the new guidance priority and consider whether improvements to their compliance arrangements are necessary.

The revision reflects the regulator's continued attention to the changing financial crime environment. In particular, it recognises that potential exposure does not arise exclusively from customer transactions. Business partners, technology suppliers, corporate ownership arrangements and payment networks can also introduce risks that require appropriate assessment.

Why the Isle of Man has updated its AML guidance

The latest changes follow a series of national risk assessments examining financial crime vulnerabilities across the Isle of Man. These assessments have provided the regulatory background for a more detailed examination of how money laundering, terrorist financing and proliferation financing risks can affect gambling operators and related businesses.

An important reference point is the Gambling Sector Money Laundering Risk Assessment published in February 2026. It represented the first dedicated assessment of money laundering risks across the island's gambling industry and considered both online and land-based operations alongside associated services.

The assessment classified the gambling sector's overall money laundering risk as medium-high. Online gambling was identified as a significant contributor to this exposure because of its international operating environment and the scale of financial transactions involved.

Remote customer onboarding, cross-border payments and the availability of different payment methods were among the vulnerabilities considered relevant to digital gambling businesses. The growing use of virtual assets also adds another dimension to the financial crime risks that operators may need to consider.

Land-based gambling establishments received a medium-low risk rating. Their predominantly domestic customer base and different operating characteristics contribute to a different risk profile compared with businesses serving international online markets.

These distinctions underline the importance of proportionate compliance arrangements. The GSC expects licence holders to consider the particular characteristics of their own businesses rather than relying on generic assessments that may not adequately reflect their actual exposure.

Greater attention to B2B relationships and ownership structures

One of the notable aspects of the updated AML guidance is its stronger emphasis on risks arising through wider business relationships. The regulatory approach recognises that gambling businesses operate within interconnected commercial networks involving software developers, platform providers, payment-related services and other technology partners.

The February 2026 assessment identified potential vulnerabilities within B2B software supply chains. These include cross-border invoicing arrangements, complex ownership structures and limited visibility over the individuals or organisations ultimately using supplied gaming products.

Such arrangements can make it more difficult for businesses to establish who benefits from commercial relationships and whether the transactions involved are consistent with their stated purposes.

The assessment also highlighted concerns involving organised crime groups, particularly those operating in East and Southeast Asia. These concerns relate to the potential exploitation of online gambling platforms and associated software supply chains for financial crime purposes.

The findings do not establish wrongdoing by individual software suppliers or operators. Instead, they identify broader risk patterns that businesses should consider when designing their financial crime prevention measures.

Under the revised framework, the GSC has clarified expectations around risk assessments involving business relationships, B2B arrangements and group structures. Operators are therefore expected to consider relevant commercial relationships as part of their wider compliance responsibilities.

Key areas covered by the revised regulatory framework

The November 2026 revision, identified as version 1.4 of the guidance, updates several areas of the existing supervisory framework. The document provides further clarification on how businesses should apply a risk-based approach when identifying and managing potential financial crime exposure.

Business Risk Assessments (BRAs), Customer Risk Assessments (CRAs) and Technology Risk Assessments (TRAs) remain important elements of this approach. The updated guidance explains the relevance of these assessments and their role in identifying vulnerabilities associated with different business activities, customers and technologies.

Customer verification and due diligence also receive attention. Operators are expected to maintain appropriate procedures for establishing customer identities, understanding relevant relationships and applying additional scrutiny where particular circumstances indicate elevated risk.

The framework covers several interconnected compliance areas, including:

• Customer due diligence: Appropriate identity verification and customer checks based on identified risk levels.
• Enhanced due diligence: Additional scrutiny where customers, ownership arrangements or transactions present higher potential exposure.
• Transaction monitoring: Procedures for identifying unusual activity and evaluating payment patterns.
• Technology risk assessments: Consideration of vulnerabilities arising from systems, products and technology arrangements.
• Financial sanctions: Measures designed to address relevant sanctions obligations and associated financial crime risks.
• Suspicious activity reporting: Appropriate internal procedures and external reporting arrangements.
• Staff training: Ensuring employees understand their responsibilities and can recognise relevant financial crime indicators.
• Compliance appointments: Maintaining appropriate oversight through designated personnel and management responsibilities.

The GSC has also updated references to relevant domestic and international guidance, financial crime typologies and regulatory resources. The document's diagrams and presentation have been refreshed to make the material easier to navigate.

These revisions are intended to provide licence holders with a clearer understanding of the supervisory standards against which their compliance arrangements may be considered.

Existing legal obligations remain unchanged

Despite the extent of the guidance revisions, the GSC has confirmed that the underlying legal requirements have not changed. The Gambling (Anti-Money Laundering and Countering the Financing of Terrorism) Code 2019 continues to provide the principal statutory framework for the relevant obligations.

This distinction is important for operators reviewing the latest publication. The updated document clarifies how the regulator interprets and communicates its expectations under the existing framework. It does not, by itself, introduce an amended version of the 2019 Code.

Licence holders should therefore distinguish between statutory requirements and the additional explanations provided through supervisory guidance.

Nevertheless, the regulator has made clear that reviewing the document should be treated as a priority. Businesses are expected to assess whether their existing policies, procedures and internal controls remain appropriate in light of the updated understanding of financial crime risks.

Where the review identifies areas requiring improvement, operators should implement appropriate changes as soon as practicable. Maintaining documented assessments and evidence of management oversight can also help demonstrate how identified risks have been considered and addressed.

Further guidance planned for software suppliers and other businesses

The GSC is also progressing work on additional AML/CFT guidance covering other parts of the gambling ecosystem. This includes software suppliers, businesses holding Online Gambling Regulation Act (OGRA) licences with network services permissions and firms involved in virtual assets and goods.

The planned updates are relevant because some businesses provide technology, products or services to gambling operators without maintaining direct relationships with end-users.

Their position within the wider supply chain does not necessarily remove their exposure to financial crime risks. Corporate relationships, payment arrangements and the nature of the services supplied may still require appropriate due diligence and ongoing oversight.

Further guidance should help clarify how relevant businesses can assess these relationships and establish proportionate safeguards. The GSC has also invited industry participants to suggest subjects where additional explanation would be useful.

Licence holders and other interested stakeholders can send feedback or recommendations to gscamlinspections@gov.im.

PF awareness improves across the gambling sector

Alongside the revised AML guidance, the GSC has published the results of its 2026 Proliferation Financing (PF) Operator Training and Awareness Survey.

The survey indicates that awareness of proliferation financing risks has improved across the gambling sector since the first exercise conducted in 2024. Its findings provide information about how operators have incorporated PF considerations into their compliance frameworks and staff training arrangements.

Among respondents who participated in both surveys, 94% reported taking action to strengthen their understanding of proliferation financing. The corresponding figure among first-time respondents was 85%.

The results also showed that 80% of repeat respondents reported improved awareness. The remaining 20% indicated that their awareness was already at a high level.

Training arrangements were generally established across the businesses that participated. Annual training programmes tailored to individual operators' risk profiles were identified as a common approach.

The regulator also indicated that combined training covering money laundering, terrorist financing and proliferation financing can remain appropriate, provided each subject receives sufficient attention.

However, these figures represent operators' own assessments rather than independent verification of the effectiveness of every compliance programme. The GSC intends to use the findings to guide future engagement and assess whether reported improvements translate into effective controls.

The survey therefore provides an indication of progress while highlighting the importance of maintaining practical oversight. Greater awareness must be supported by appropriate training, management involvement and procedures capable of identifying relevant risks.

Conclusion

The Isle of Man GSC's updated AML guidance represents an important development in the jurisdiction's approach to financial crime supervision. Its November 2026 revision reflects a wider understanding of how risks can emerge across online gambling operations, technology providers and interconnected B2B relationships.

For licensed businesses, the central message is that financial crime prevention should extend beyond customer identification and transaction monitoring. Operators also need to understand their commercial relationships, assess ownership structures and consider how technology and payment arrangements may affect their overall exposure.

The confirmation that the Gambling (Anti-Money Laundering and Countering the Financing of Terrorism) Code 2019 remains unchanged provides an important distinction between existing legal obligations and updated supervisory expectations. However, this does not reduce the importance of reviewing internal controls against the latest guidance.

The improvement in proliferation financing awareness is also encouraging, although the effectiveness of training and compliance arrangements must ultimately be demonstrated through practical implementation.

As the GSC develops further guidance for software suppliers, network services businesses and virtual asset-related activities, financial crime supervision is likely to involve increasingly detailed consideration of the wider gambling ecosystem. Operators that maintain current risk assessments, effective oversight and well-documented compliance procedures will be better positioned to respond to these expectations and support the Isle of Man's commitment to a well-regulated gambling industry.

FAQs

What has the Isle of Man GSC updated in November 2026?
The Gambling Supervision Commission published version 1.4 of its AML/CFT guidance for gambling operators on 10 November 2026. The revision clarifies expectations concerning financial crime risks, B2B relationships and compliance procedures.

Why has the Isle of Man revised its AML guidance?
The updated framework reflects the findings of the jurisdiction's 2025 and 2026 National Risk Assessments and responds to developments in financial crime threats affecting online gambling and associated businesses.

Does the updated guidance introduce new legal obligations?
No. The GSC has confirmed that the underlying requirements of the Gambling (Anti-Money Laundering and Countering the Financing of Terrorism) Code 2019 remain unchanged.

What money laundering risks affect online gambling operators?
Relevant vulnerabilities include high transaction volumes, remote onboarding, cross-border payments, varied payment methods and the use of virtual assets.

Why are B2B relationships included in the updated guidance?
B2B relationships can create financial crime exposure through complex ownership structures, international payment arrangements and limited visibility over the ultimate users of gaming products and services.

What are Business Risk Assessments?
Business Risk Assessments are documented evaluations through which operators identify and examine potential money laundering, terrorist financing and proliferation financing risks associated with their activities.

What does the guidance say about customer due diligence?
It reinforces the importance of appropriate identity verification, customer risk assessments and enhanced due diligence where higher-risk circumstances require additional scrutiny.

What did the 2026 proliferation financing survey reveal?
The survey found that 94% of repeat respondents and 85% of first-time respondents had taken action to strengthen their understanding of proliferation financing risks.

What additional guidance is the GSC preparing?
The regulator is progressing further guidance for software suppliers, OGRA licence holders with network services permissions and businesses dealing with virtual assets and goods.

What should Isle of Man gambling operators do next?
Operators should prioritise reviewing the updated guidance, assess whether their existing compliance arrangements remain adequate and implement any necessary improvements as soon as practicable.