What does CDD involve for iGaming operators?
CDD is not optional. It is a mandatory compliance requirement for all regulated businesses — including iGaming operators, corporate service providers, and financial institutions. At its core, it means knowing who you are doing business with before you start, and continuing to monitor that relationship over time.
Standard CDD requires verifying the legal identity of clients using official documents, understanding the nature and purpose of the business relationship, assessing the client's risk level based on factors such as country of residence, business activity, and transaction size, and updating the file whenever the risk profile changes. For most clients, this is a straightforward process. For higher-risk clients — Politically Exposed Persons (PEPs), those with complex ownership structures, or those from higher-risk jurisdictions — Enhanced Due Diligence (EDD) applies. EDD involves deeper background checks, additional documentation, and more frequent ongoing monitoring.
Failing to conduct proper CDD is one of the most common reasons regulators take enforcement action against licensed operators. The CGA, MGA, and KSA all require documented, risk-based CDD procedures. Those procedures must be operational, not just written down. Regulators audit how CDD is applied in practice, not just what the policy says.
We conduct and manage Client Due Diligence (CDD) for iGaming operators and corporate service clients across all our jurisdictions.
