AMLR Solutions 
AMLR Consultation
EUDI Wallet
Onboarding
Ongoing Monitoring
FRAML
KYC
KYB
KYI
Age Assurance
Workforce IAM
Candidate Verification
Account Takeover
Bonus/ Promotion Abuse
Chargeback Fraud
Deepfake
Document Fraud
Fraud Networks
Impersonation Fraud
Money Mule Activity
Multi-Accounting
Party Fraud
Regulatory & Compliance Risks
Synthetic Identity Fraud
Adult Content
Banking
Crypto
Fintech
Forex
Compliance
Fraud prevention
Trust & safety
Global expansion
Compliance Officers
Developers
Fraud Analysts
Product Managers
Journey Builder 
Global Trust Platform
Customer Profiles
Vendor Comparison
IDV Case Management
AML Case Management
Regulatory Reporting
Agentic Rule Builder 
AI Compliance Co-Pilot 
Fraud Analytics
Fraud Hub 
OCR
Shufti AI
Bank Account Verification 
Biometric Duplication
Database Checks
Document Intelligence
Government ID
Mobile Driver's License
NFC
Selfie Liveness
Brand Personalisation
Deployment Options
Identity Methods
IDV Modes
Multi-tenancy
On-Premise IDV
Secure Capture
Shufti MCP
UAE Commercial Gaming Compliance Requirements
A Player Due Diligence and financial crime prevention guide for iGaming operators.
What the General Commercial Gaming Regulatory Authority (GCGRA) expects from an iGaming operator entering the UAE, from Player Due Diligence to Enhanced Due Diligence.
Schedule a DemoHow commercial gaming is regulated in the UAE
The General Commercial Gaming Regulatory Authority (GCGRA) holds exclusive federal jurisdiction over commercial gaming in the United Arab Emirates, and it sets the AML/CFT standards, supervises compliance with them and investigates breaches within that same remit. A 2024 Ministerial Resolution brought Internet Gaming Operators, Land-Based Gaming Facilities Operators, Sports Wagering Operators and Lottery Operators within the definition of DNFBPs under Federal Decree Law No. 20 of 2018, so AML obligations reach an operator through its GCGRA licence. The GCGRA and NAMLCFTC Commercial Gaming Policy Paper released in 2025 sets out the four federal instruments a licensee answers to and the supervision that begins before it commences operations.
Federal Law No. 7 of 2014
Combatting Terrorism Offences
Federal Decree Law No. 20 of 2018
Anti-money laundering and combating the financing of terrorism, as amended
Cabinet Decision No. 10 of 2019
Implementing regulation of Federal Decree Law No. 20 of 2018
Cabinet Decision No. 74 of 2020
Terrorist lists and the implementation of UN Security Council resolutions
The ten GCGRA AML requirement areas
The Commercial Gaming Policy Paper sets out the AML/CFT framework across ten requirement areas. Four run inside the player journey, and the rest sit at board and infrastructure level.
Institutional controls
Player journey
Detection and reporting
Evidence and systems
Player Due Diligence and UAE gaming KYC requirements
Player Due Diligence in the UAE rests on four obligations that build on one another, and the point at which they apply is the Player Account.
Once linked deposits and withdrawals cumulatively exceed this figure, the activity must run through a Player Account and Player Due Diligence applies to it. The GCGRA and NAMLCFTC Commercial Gaming Policy Paper sets the threshold against FATF Recommendation 22 and the linked-transaction test it defines for casinos, internet casinos included.
When Enhanced Due Diligence and PEP screening apply
Enhanced Due Diligence applies automatically where a player is a politically exposed person or has been rated high risk, and it adds further measures on top of ordinary Player Due Diligence rather than replacing it. The decision path below is the one the GCGRA and NAMLCFTC Commercial Gaming Policy Paper works through, from application to ongoing monitoring.
Beyond those two triggers, the policy paper recommends Enhanced Due Diligence for high-value customers paired with source of funds and source of wealth checks for gaming operators, for third-party payments above a defined threshold, and for players and transactions connected to higher-risk jurisdictions.
A vendor assessment checklist for UAE gaming compliance
The checklist converts the obligations in the GCGRA and NAMLCFTC Commercial Gaming Policy Paper into questions to put to any verification partner during evaluation, so the assessment stays grounded in the regulatory requirements rather than in product features. Work down the list and tick each requirement a vendor can evidence.
Document verification
Can it authenticate identity documents, the Emirates ID included, across the full range of nationalities you onboard, not only a narrow Western set?
OCR extraction and form pre-fill
Does it use OCR to extract identity data from the document and pre-fill the onboarding form, so a player does not re-enter details the document already contains?
Non-documentary (eIDV) verification
Does it offer non-documentary verification through UAE Pass and authoritative government sources, available to any player rather than only as a fallback?
Biometric liveness
Can it confirm a live person and detect deepfake and presentation attacks at the point of capture?
AML screening
Does it screen everyone onboarded against sanctions, PEP, watchlist and adverse-media data, with match thresholds you can tune?
Source-of-funds evidence
Can it collect and review source-of-funds and source-of-wealth documents inside the Enhanced Due Diligence flow, and leave an audit-ready record?
Ongoing monitoring
Does screening keep running after onboarding and re-check an account when its holder’s status changes?
Risk-rating support
Does it provide structured, current data your risk-rating model can query, rather than static documents in a file?
Multi-Accounting and Bonus Abuse Prevention
Can it link identities and devices across accounts to catch multi-accounting and bonus or promotion abuse before a payout?
Record keeping
Does every decision leave an evidence pack you can retrieve and produce to the GCGRA across the five-year retention window?
Data residency and deployment
Can it be deployed to meet UAE data-residency expectations, whether cloud, local cloud, on-premises or hybrid?
Speed
Does identity verification complete at the pace a live gaming product needs, so that neither document capture nor the overall verification process is where sign-ups are lost?
How Shufti supports AML compliance for iGaming in the UAE
This guide closes with a vendor assessment checklist that converts the obligations in the GCGRA and NAMLCFTC Commercial Gaming Policy Paper into questions to put to any verification partner. Shufti’s platform answers them from a single API.
Document verification across nationalities
Government-issued IDs from 240+ countries and territories, with forensic checks on security features, the machine-readable zone and, where present, the NFC chip.
OCR extraction and onboarding form pre-fill
OCR trained natively on 150+ languages including Arabic extracts the document data and pre-fills the onboarding form, so a player retypes nothing.
Docless verification flows
A first-class onboarding path run through eIDV across 30+ national eID schemes including UAE Pass verification, plus authoritative government databases, in under three seconds.
Biometric liveness
Confirms a live person and detects deepfake and presentation attacks at the point of capture, with iBeta Level 3 conformance.
Sanctions and PEP screening
OFAC, the EU consolidated list, UK HMT and UN sanctions, UAE Local Terrorists List, 1,200+ PEP databases and adverse media in 80+ languages, with tunable thresholds and screening that continues after onboarding.
Source of funds evidence
Financial evidence collected and reviewed inside the Enhanced Due Diligence flow, with configurable MLRO-backed review and an audit-ready record.
Multi-Accounting and Bonus Abuse Prevention
Identities and devices are linked across accounts through device fingerprinting and shared-device signals, before a bonus is paid.
UAE data residency and deployment
Shufti can be deployed to meet UAE data-residency expectations across cloud, local cloud, on-premises and hybrid.
Player Due Diligence, evidenced end to end
Tell us which checks your UAE player journey needs and the volume you expect, and our team will shape the demo around it.
Schedule a Demo
Certifications
Independently audited and certified for enterprise-grade security and data protection.
Frequently asked questions
The GCGRA holds exclusive federal jurisdiction over commercial gaming and supervises AML/CFT compliance within the same remit, so an operator answers to one authority for both its conduct and its financial crime controls.
The General Commercial Gaming Regulatory Authority is the UAE federal regulator for commercial gaming. It has issued the country’s first Gaming Operator licences, brought the UAE Lottery under real-time oversight and established the means to investigate breaches and act against unlicensed operators.
Yes. Gaming operators are DNFBPs under Federal Decree Law No. 20 of 2018, and Player Due Diligence applies to a Player Account once linked deposits and withdrawals cumulatively exceed AED 11,000.
Automatically where a player is a politically exposed person or has been rated high risk. The policy paper also recommends it for high-value customers, third-party payments above a defined threshold, and players connected to higher-risk jurisdictions.
Commercial gaming in the UAE is permitted only under a GCGRA licence, and the authority acts against unlicensed operators. For a licensed operator, the AML/CFT and Player Due Diligence obligations described on this page apply from the point of licensing.
Form submitted successfully!
Thank you for your interest — your report is loading now.
Player Due Diligence, evidenced end to end
Get the full guide to the GCGRA and NAMLCFTC Commercial Gaming Policy Paper requirements, or start with a short conversation about the player mix your own onboarding has to cover.
