AML and KYC Requirements in iGaming Affiliate Marketing: A Tracking Perspective

Two iGaming affiliates send the same traffic to two operators. One reports a 30% registration-to-FTD rate, the other 55%. Is the second source better? Often, it isn’t. The difference is when each operator checks who the player is.

Know-your-customer (KYC) and anti-money laundering (AML) rules decide when an operator must verify a player’s age, identity and, sometimes, source of funds. For affiliates, that timing reshapes the funnel: where players drop out, when an FTD becomes final and which conversions can later be reversed. This article looks at KYC and AML in iGaming from a tracking perspective: what the main regulators require, how verification timing changes your numbers and which events to track so your data, and your commission, hold up.

This article explains general requirements for marketers. It isn’t legal advice; operators and affiliates should confirm their obligations with a compliance professional in each market.

KYC and AML in iGaming, Briefly

KYC is the process of confirming who a customer is: their age, name, address and date of birth, usually checked against documents or databases. AML is the broader framework of checks that prevent gambling from being used to launder money, from screening players against sanctions and politically exposed persons (PEP) lists to asking where large deposits come from.

Together, they form the core of iGaming compliance. Both obligations sit with the licensed iGaming operator, not the affiliate. But because operators pay affiliates per first deposit or as a share of revenue, how and when they run these checks flows straight into affiliate earnings and data.

When KYC Happens: Three Timing Models

Regulators don’t all ask for verification at the same point. That single difference changes how a funnel looks in your tracker.

Verify Before Play: Great Britain

In Great Britain, the Gambling Commission requires operators to verify a customer’s age before they can deposit, and to verify name, address and date of birth before the customer is permitted to gamble. Operators also can’t ask for information at withdrawal that they could reasonably have requested earlier.

For affiliates, that means friction early in the funnel. Some registrations never reach a first deposit because players abandon the checks. In exchange, the FTDs that do happen come from verified players and are rarely reversed later.

Verify at a Deposit Threshold: Malta

Under Malta’s AML framework, operators licensed by the MGA must carry out full customer due diligence when a player’s deposits reach €2,000, calculated over a rolling 180 days or over the customer’s lifetime, or at the first withdrawal, and the FIAU has penalized operators that didn’t complete those checks within 30 days of the threshold.

Here, first deposits happen quickly, and the registration-to-FTD rate looks healthy. The risk moves later: a player who deposits heavily and then fails due diligence can have their account closed, and depending on the deal, the affiliate commission linked to that player may be withheld.

Verify at Withdrawal

Under some other licenses and operator policies, full verification is triggered mainly when a player asks to withdraw. This produces the fastest FTDs and the smoothest early funnel, but also the most surprises later, such as chargebacks, closed accounts and revenue that disappears from RevShare reports.

Regulation is moving one way. Many markets keep tightening verification, and in the EU, a single AML rulebook for gambling and other obliged sectors is due to apply from 2027. Expect more checks earlier in the funnel, not fewer. Our overviews of iGaming regulation in the EU and iGaming advertising in Brazil cover two markets in more detail.

What KYC Timing Does to Your Numbers

The same traffic can look very different depending on where the checks sit. A few effects to expect:

• Registration-to-FTD rate. Lower when verification comes before the first deposit, higher when it comes later. Comparing this rate across operators with different KYC timing is misleading.
• Qualified FTDs. Many CPA deals pay only for qualified first deposits, such as those that passed verification and met a minimum deposit or wagering requirement. The FTD count you see in your tracker can be higher than the qualified count the operator pays for.
• Delayed adjustments. Where verification happens late, FTDs and RevShare earnings can be corrected weeks after the fact, after your campaign decisions are made.
• Source quality. Traffic sources with a high share of players who fail KYC, or never complete it, look good at the top of the funnel and bad on the invoice.

This is why judging iGaming traffic on FTDs alone is risky. Our guide to shifting from FTDs to lifetime value explains the longer view, and the affiliate marketing KPIs article covers registration-to-FTD rate and cost per FTD.

Which Events to Track by Postback

The fix is to track the funnel at the same points the operator does, so your data reflects what you’ll actually be paid for. Ask your operator or affiliate program which events they can send by postback, and set up a separate conversion type for each:

In Voluum, each of these becomes a custom conversion type, reported in its own column. The postback carries the type in the et parameter and, for repeat events, a unique transaction ID in txid, because Voluum counts the same click ID and transaction ID only once. Our guide to tracking first-time deposits walks through the setup, and the iGaming tracking setup guide shows the full funnel.

With separate columns, you can build a report by traffic source that shows registrations, KYC approvals, FTDs and qualified FTDs side by side. A source where approvals lag far behind registrations is a source to question before you scale it, and automated rules can flag it for you.

Keep Personal Data Out of Your Postbacks

Tracking KYC events doesn’t mean tracking KYC data. A postback should carry the click ID, the event type, a transaction ID and, if needed, the payout. It should never carry names, document numbers, addresses, dates of birth or selfies. Those belong with the operator’s verification provider, under the operator’s data protection obligations.

If you need to match players across systems, ask the operator for an internal player ID rather than anything that identifies a person. This keeps your tracker useful for optimization without turning it into a store of sensitive personal data.

Audit Trails: Being Able to Show Your Work

When an operator withholds commission on players who failed KYC, or questions the quality of a traffic source, the conversation goes better with records. Keep a clear link between each click, the conversion events it produced and the transaction IDs the operator sent. With click-level data, you can show exactly which campaigns, placements and GEOs the disputed players came from.

Operators keep their own audit trails, too. Regulators such as the UKGC hold operators responsible for marketing carried out on their behalf, so expect your affiliate program to ask about your traffic sources and creatives, and to review them. Compliance on the advertising side, including platform rules like Google’s 2026 gambling ad policy, is part of the same picture.

Finally, use the data proactively. Player segmentation by traffic source, combined with KYC approval rates, tells you which partners bring players who stay, verify and deposit again.

Track the Funnel the Way Operators Pay for It

Voluum tracks each iGaming conversion type separately, from registration and KYC approval to FTDs and redeposits, and ties every one of them to the click, traffic source and GEO that produced it. See how Voluum works.

Frequently Asked Questions

What is KYC in iGaming?

KYC, or know your customer, is the process online gambling operators use to confirm a player’s identity, including age, name, address and date of birth. Depending on the market and the player’s activity, it can also include sanctions and PEP screening and checks on the source of funds.

When do online casinos have to verify players?

It depends on the regulator. In Great Britain, age must be verified before a player can deposit and identity before they can gamble. Under Malta’s AML rules, full due diligence is required when deposits reach €2,000 over 180 days or at the first withdrawal. Other markets set their own rules.

Do iGaming affiliates have AML or KYC obligations?

In most markets, the legal KYC and AML obligations sit with the licensed operator, not the affiliate. However, operators are usually responsible for marketing done on their behalf, so they review affiliates’ traffic and creatives, and some markets require affiliates to register. Confirm the rules for each market with a compliance professional.

How does KYC affect affiliate commissions?

KYC determines which players count. Many CPA deals pay only for qualified FTDs from verified players, and where verification happens after the first deposit, operators may withhold commission on players who later fail checks. Late verification can also lower RevShare earnings when accounts are closed.

Which conversion events should iGaming affiliates track?

Track registrations, KYC approvals where the operator can send them, first-time deposits, qualified FTDs and redeposits as separate conversion types. This shows where each traffic source loses players and lets you compare your numbers with what the operator actually pays for.