Isle of Man puts B2B under AML spotlight

• Isle of Man GSC publishes updated AML/CFT/CPF guidance for gambling operators on 10 November.
• Revised text expands on B2B arrangements, group structures and beneficial ownership risk.
• Updates to software supplier, network services and virtual assets guidance are in progress.

The Isle of Man Gambling Supervision Commission (GSC) has published updated anti-money laundering guidance for gambling operators. It has asked licence holders to review it ahead of its other recent publications.

The revised document, released on 10 November, puts B2B arrangements, group structures and beneficial ownership at the centre of the risk-based approach.

The February trigger

The update follows the 2025/2026 National Risk Assessments released earlier this year. The GSC said the guidance now reflects the threats, typologies and current risk environment set out in those documents.

The gambling sector assessment was published on 24 February 2026. It rated the industry overall as medium-high risk for money laundering. Online gambling got the same medium-high rating because of its large international customer base and transaction volumes.

Terrestrial gambling was rated medium-low. The GSC pointed to the sector’s smaller size, domestic profile and lower transaction volumes.

One of the core threats listed was criminal ownership and control of gambling businesses or B2B services through front companies and complex corporate structures. The assessment also identified exploitation by organised crime groups, including those from East and Southeast Asia.

AI, deepfakes and virtual assets were flagged as emerging threats. So were pre-packaged turnkey solutions, which the GSC said could let operations set up quickly and gain access to banking services with minimal experience.

Operators were told to consider the full NRA suite by 1 September 2026. They then need to update their business risk assessments as soon as practicable.

Follow the partners

The 10 November guidance gives operators more direction on applying the risk-based approach beyond their direct customers. It now covers risks that come through wider business relationships, B2B arrangements and group structures, as well as customer and beneficial ownership risks.

That matches the February finding on criminal control of B2B services. The GSC wants operators to look past the customer in front of them to the partners and owners behind a relationship.

Refreshed areas include business, customer and technology risk assessments, identity and verification, and customer and enhanced due diligence. Payments and transaction risks, terrorist financing and proliferation financing (TF/PF), and financial sanctions are also covered.

Internal and external reporting procedures, staff training and appointments round out the list. The GSC has also clarified its supervisory expectations, updated links to national and international guidance and typologies, and given the document a cosmetic overhaul with refreshed diagrams.

Code intact, bar raised

The GSC stressed that the underlying Code requirements remain unchanged. Those obligations sit in the Gambling (Anti-Money Laundering and Countering the Financing of Terrorism) Code 2019.

What has moved on is how operators are expected to meet them. Firms should work out what changes their AML/CFT/CPF frameworks need, then make those updates as soon as practicable after the review.

Individual accountability is also on the agenda. The island’s Gambling Legislation (Amendment) Bill completed its passage through Tynwald on 28 April 2026. It introduces a civil penalty regime that would allow penalties on controllers, key persons and senior managers where AML/CFT breaches involve their consent, connivance or negligence.

The GSC has already used its existing powers this year. On 6 February, it imposed a discretionary civil penalty of £200,000 on Shelgeyr Limited, net of a discount, after an AML inspection found contraventions of the 2019 Code.

Suppliers on deck

The GSC is progressing updates across its wider suite of AML/CFT guidance. The documents in the pipeline cover software suppliers, OGRA licence holders with network services permissions, and businesses dealing in virtual assets and goods.

The network services guidance was first published in October 2025 as version 1.0. It sets out how AML/CFT obligations apply to OGRA licence holders with those permissions.

The virtual assets work comes as other offshore regulators tighten their crypto controls. Curaçao has published a crypto guideline for B2C licensees, with minimum controls on how digital assets are accepted, held and processed.

Operators are encouraged to help shape the drafts. Suggestions and feedback can go to [email protected], and operators can arrange a drop-in session at the GSC’s Douglas offices.

Sanctions by stealth

The GSC published its 2026 PF survey on the same day. It found that 94 per cent of repeat respondents and 85 per cent of first-time respondents had taken action to strengthen their understanding since the first survey in 2024.

Among repeat respondents, 80 per cent reported improved awareness. The remaining 20 per cent said awareness was already high. Training is broadly established, generally annual and tailored to operators’ risks.

The GSC noted that the findings are operators’ self-assessments. It will use them to inform outreach and to test whether reported understanding shows up as effective controls. It added that boards should ensure adequate resources and close any knowledge or control gaps.

The regulator also reminded operators that PF activity may pass through third countries to hide links to sanctioned states, entities or end users. Its PF NRA considers China, Pakistan and Russia as possible states of PF concern.

The ML NRA highlights sanctions evasion and circumvention through Türkiye, Azerbaijan, Georgia and Kazakhstan. It also points to wider illicit-finance routing risks involving the UAE and Hong Kong.

Operators should watch for unusual geographic connections, payment routes or corporate structures with no clear commercial rationale. The GSC has promised more practical PF examples for online B2C, B2B and terrestrial operators.

The MONEYVAL backdrop

The timing matters. The Isle of Man completed its written effectiveness submission to MONEYVAL in June. That put it ahead of an onsite assessment the GSC said would take place in the autumn.

Other regulators are also pushing scrutiny further down the supply chain. The Dutch regulator has extended enforcement to B2B suppliers providing games to unlicensed operators. Ireland’s first national AML strategy sets out tighter oversight of gambling operators.

For Isle of Man licensees, the immediate job is mapping. Group entities, B2B partners and beneficial owners need to be inside risk assessments, with controls that match the risks identified.

Software suppliers and network services licensees face the next round once their own guidance is finalised. Engaging early with the GSC’s drafts gives them a chance to shape the rules before they arrive.