Updated October 2026

This guide is for general information and is not legal advice. Confirm your plan with your own gaming counsel before you launch.

Short answer: A white-label provider typically runs the technical layer: identity checks at sign-up, fraud and bonus-abuse screening, and player tools such as limits and self-exclusion. The operator still owns its anti-money laundering (AML) program, its responsible gambling policy and its reporting duties under local law. Ask every provider to put that split in writing, market by market, before you sign.

Why do KYC, AML and responsible gambling get mixed up on white-label deals?

Sales pages often bundle all three under one word, “compliance”. In practice they are three different jobs with three different owners. KYC is the process of confirming who a player is. AML is a program of controls that looks for suspicious money movement. Responsible gambling is a set of policies and player tools that protect people from harm.

A provider can automate much of the first and supply tools for the third. The second is a legal program, and regulators expect a named operator to stand behind it. If a proposal says “compliance included” without naming which of the three it means, ask for a line-by-line list.

How is KYC handled for online players in the United States?

For casinos covered by the Bank Secrecy Act, the baseline rule asks for a customer’s name, permanent address and Social Security number, with verification by examining a document. In October 2021, FinCEN granted limited relief for online gaming. Under FinCEN ruling FIN-2021-R001, issued October 19, 2021, a casino may use suitable non-documentary methods to verify online customers, judged on risk.

The ruling adds a condition that matters for platform choice: the casino’s AML program has to describe when it uses documentary methods, non-documentary methods, or both. That means your verification vendor settings are not a purely technical choice. They need to match what your written program says.

Whether a particular business counts as a casino under that framework depends on its facts and its model, so confirm it with counsel. Real-money operators are also licensed state by state, and each state sets its own identity and location requirements.

What does an AML program have to include?

The federal rule for casinos, 31 CFR 1021.210, says each compliance program must provide for several elements. Four of them shape how you work with a platform vendor:

• A system of internal controls to assure ongoing compliance.
• Internal or external independent testing, with scope and frequency that match the money laundering and terrorist financing risk of your products.
• Training of personnel, including how to identify unusual or suspicious transactions.
• An individual or individuals responsible for day-to-day compliance.

None of these can be bought as a switch inside a platform. A provider can give you transaction logs, flags and reports that feed your controls and your tests. The program itself, the people and the sign-off belong to the operator. For a wider look at licensing questions, see our article on whether a provider covers licensing.

What responsible gambling controls do regulators expect?

The American Gaming Association (AGA) publishes a responsible gaming regulations guide. In its 2025 edition, every one of the commercial gaming jurisdictions it covers requires operators to run self-exclusion programs, and 28 of them require operators to prepare and submit a responsible gaming plan for approval. A majority have a central self-exclusion register shared across venues and platforms.

The AGA also publishes a Responsible Gaming Code of Conduct for its members, updated September 2025. For websites and apps it describes two technical controls: age affirmation that requires a full date of birth before access to any page where gaming happens, and geolocation to restrict play to people inside a legal jurisdiction. It also expects a responsible gaming message and a link to help resources on pages that advertise gaming.

These lists show what a regulator may ask to see. They are not a checklist for every state, and rules for sweepstakes products differ from rules for licensed real-money products.

Who does what: provider or operator?

This table shows the usual split on a white-label launch, with a column for how we handle each area.

Area	What a provider typically runs	What the operator typically keeps	How we handle it at Maincard
Player identity checks (KYC)	Collects and verifies identity data at sign-up and before deposits and withdrawals	Sets the verification rules for its markets and signs off on risk thresholds	We run players’ KYC behind your brand, so you do not build or integrate a verification stack yourself.
Fraud and bonus abuse	Screens for duplicate accounts, payment fraud and bonus abuse	Reviews flagged cases against its own policy	We run anti-fraud and anti-bonus-abuse checks as part of the platform.
AML program	Supplies transaction data and tooling the operator can use	Owns the written program, internal controls, training and reporting where the law requires them	We offer optional support through licensed third parties for compliance audits and regulatory filings.
Responsible gambling	Provides the player-facing tools the platform is configured with	Writes the policy, files any plan its regulator requires, and handles exclusion requests	On a demo we walk through which controls are set up for your target market.
Age and location controls	Applies the age gate and any location check the market calls for	Confirms with its regulator which standards apply	We help you understand licensing terms for the markets you plan to enter.
Support and records	Answers player queries and keeps platform logs	Keeps its own compliance records and audit trail	Our team provides 24/7 customer support behind your brand.

What should you ask a provider before you sign?

• Which identity checks run at sign-up, at first deposit and at first withdrawal, and can you change the thresholds?
• Does the contract name who owns AML monitoring and reporting, and what data do you receive to run your own program?
• Which responsible gambling tools are live for your target market: deposit limits, time-outs, self-exclusion, reality checks?
• How does the platform support an integration with any state or central self-exclusion register your regulator requires?
• What audit trail and logs can you export for an independent test or a regulator request?
• What is the support model for player disputes, and is it available around the clock?
• Which parts does the provider cover through third parties, and who contracts with them?

Get the answers in writing. A verbal “we cover compliance” is not something you can hand to a regulator or to your own counsel. Cost questions belong in the same conversation; our white-label casino cost guide lists what to price.

How does Maincard help with KYC, AML and responsible gambling?

Most founders do not want to assemble identity vendors, fraud tools and support staff before their first player signs up. At Maincard we run the operating layer behind your brand: players’ KYC, anti-fraud, anti-bonus-abuse checks, fiat and crypto payment integrations and 24/7 customer support. You launch on a white-label platform without building those pieces yourself.

On licensing, operators can launch under our Anjouan gaming license instead of applying for their own, and our licensing covers many countries across different regions. We help clients understand licensing terms, and we offer optional support through licensed third parties for compliance audits, regulatory filings and country-specific legal vetting. Operators follow the local laws of the markets they target.

On a demo, ask us which verification steps and responsible gambling controls apply to your target market, and how we split the work. Start at maincard.io.

FAQ

Does a white-label provider handle KYC for me?

Many do, but it depends on the provider and the contract. At Maincard we run players’ KYC behind your brand, along with anti-fraud and anti-bonus-abuse checks. You still set the verification rules for your markets and keep them consistent with your written AML program.

Who is responsible for AML on a white-label casino?

The operator is normally the party a regulator holds to account for the AML program. Where the federal casino rule applies, that program needs internal controls, independent testing, training and responsible staff. A provider supplies data and tools. We also offer optional support through licensed third parties for compliance audits and regulatory filings.

Does a provider’s license cover my compliance duties?

It depends on the provider. With Maincard, operators can launch under our Anjouan gaming license instead of applying for their own, and our licensing covers many countries across different regions. For the US, we provide a sweepstakes framework supported by a legal opinion. Each US state licenses real-money casino and sportsbook operators itself, and the operator applies for that license.

What responsible gambling tools should a platform support?

Regulators commonly expect self-exclusion, and the AGA’s 2025 guide found that every commercial gaming jurisdiction it covers requires it. Age affirmation, geolocation where play is restricted to a legal area, and a visible link to help resources are also described in the AGA code. Ask your provider which of these are live for your target market.

How is a player’s identity verified online in the US?

For casinos covered by the Bank Secrecy Act, FinCEN’s October 2021 ruling allows suitable non-documentary methods for online customers, judged on risk. The casino’s AML program must describe when it uses documentary methods, non-documentary methods or both. Your counsel can confirm what your state and product require.