Mwali Gaming Licence AML Requirements Explained 2026

Mwali gaming licence AML requirements are the anti-money laundering and counter-terrorist financing controls the Mwali International Services Authority (MISA) expects a licensee to run. They cover a written AML policy, a Money Laundering Reporting Officer, customer due diligence, transaction monitoring, sanctions screening, and record-keeping. This guide works through each control and the points where a file most often stalls in review. It also flags the items you should confirm with MISA in writing rather than assume. For the full licence overview, start with our Mwali gaming licence pillar.

What Mwali gaming licence AML requirements cover

Mwali gaming licence AML requirements run across six areas: policy, people, customers, transactions, screening, and records. MISA reviews your controls before it grants the authorisation, then checks them again through its compliance and audit function once the licence is live. Because the licence renews every year, the gap between reviews stays short.

The controls are not a filing exercise. They shape how you onboard players, how you clear withdrawals, and how you flag risk day to day. So a policy that reads well but does not match your live platform tends to fail at the first audit.

Most operators treat AML as a document to attach at application. In practice it is an operating function you staff and run for as long as you hold the licence. The sections below set out each requirement and the standard behind it. They also flag what MISA has not published, so you know what to pin down before launch.

Legal basis for Mwali gaming licence AML requirements

MISA regulates gambling for the Autonomous Island of Mwali, but its AML rules do not sit on their own. Federal Comorian anti-money laundering and counter-terrorist financing law applies to companies registered on Mwali, on top of the conditions MISA sets at licensing. So an applicant builds an AML policy against both layers rather than the island framework alone.

Above both sits the international benchmark. MISA expects your controls to match the FATF Recommendations, because banks and payment providers assess your file against the same standard. Comoros also sits in the region covered by the Eastern and Southern Africa Anti-Money Laundering Group, a FATF-style regional body, and it has been through a FATF mutual evaluation. That means the expectations on a Mwali licensee track international practice rather than a light local rulebook.

MISA also runs fit-and-proper due diligence on every director, shareholder, and ultimate beneficial owner, and it screens each person against sanctions and PEP lists. You can confirm the regulator and its forms on the official Mwali International Services Authority site. For how MISA reviews and refuses a file more broadly, see our guide to how MISA supervises licensees.

Your written AML policy and business risk assessment

Every Mwali licensee needs a written AML and CFT policy, and MISA reviews it as part of the gaming file. The policy must cover customer identification, source of funds, transaction monitoring, suspicious activity reporting, record retention, and staff training. A generic template that names no payment methods, markets, or thresholds reads as untested, so build it around your actual operation.

Underneath the policy sits a business risk assessment. This is the document that justifies your thresholds and your controls. It maps your player markets, your products, and your payment rails to a money-laundering risk rating, then sets the checks that follow. First you assess the risk, then you set the control. That order is what an auditor looks for.

Where you have no in-house capacity to draft and maintain these documents, our gaming licensing compliance team prepares them and keeps them current. Keep the policy and the risk assessment as living files, because MISA can ask to see both during a compliance review.

The Money Laundering Reporting Officer and compliance function

A Money Laundering Reporting Officer is mandatory for a Mwali licence. The MLRO owns the AML function. They set the thresholds, review internal alerts, decide when to file a suspicious activity report, and act as the contact point for the regulator. This is a named role, not a title you spread across a team.

The initial submission to MISA is usually light. Operators typically supply the officer’s name and contact details rather than a full CV or certification. Even so, the role carries real weight after licensing, so appoint someone who can actually run it. Many operators use an outsourced compliance officer, because MISA does not publish a requirement for the MLRO to reside on Mwali.

Two points are worth confirming in writing. First, whether MISA expects the MLRO to hold a formal AML qualification such as ACAMS or ICA. Second, whether it runs any registration or background check on the officer before launch. Neither is published, so ask rather than assume. Where you need the function supplied and kept active, our MLRO and compliance officer provision covers it.

KYC under Mwali gaming licence AML requirements

Know-your-customer checks sit at the front of your AML controls, and the Mwali gaming licence KYC requirements follow standard international practice. You verify a player’s identity with government ID and proof of address. Operators commonly run that check before the first payout and once a player’s cumulative deposits pass USD 10,000.

That threshold is a common market figure rather than a number MISA publishes as a hard rule. So you set your own trigger in the policy and justify it against your risk assessment. Enhanced due diligence applies to higher-risk cases: large deposits, unusual patterns, or a player who turns out to be politically exposed. In those cases you ask for source of funds, and for source of wealth where the amounts warrant it.

Get one point confirmed before launch. MISA has not published fixed monetary thresholds that trigger CDD or a source-of-funds request, so agree acceptable levels with the regulator and record them. A documented, risk-based approach is what an audit rewards, and it is also what payment providers ask to see during onboarding. For the wider document and eligibility set that sits alongside these checks, see our page on Mwali gaming licence requirements.

Transaction monitoring and suspicious activity reporting

You must monitor player transactions and report suspicious activity. Monitoring means a system that flags risk patterns. Examples include rapid deposit and withdrawal with little play, structured deposits below a threshold, or funds that do not match a player’s profile. The MLRO reviews the alerts and decides which ones escalate.

When an alert becomes a genuine suspicion, the MLRO files a suspicious activity report with the relevant financial intelligence authority. Here MISA leaves detail open. It does not publish whether reports go to a dedicated Mwali unit or to a central Comoros Union financial intelligence unit. It also sets no fixed filing deadline such as 24 hours or three business days. So confirm the reporting route and the timeframe with MISA in writing at licensing, and record both in your policy.

Keep the monitoring evidence. MISA can ask for transaction logs and the alerts your system raised during a compliance review. So the point of monitoring is to show the work, not just to run software in the background.

Sanctions and PEP screening at onboarding

Sanctions and politically exposed person screening is part of every Mwali licensee’s AML controls. You screen players against sanctions lists and PEP databases, and you geo-block Comoros residents and sanctioned jurisdictions as a licence condition. MISA already screens your owners and directors at pre-approval, and it expects you to screen players on the same basis.

One open question is timing. MISA does not state whether screening must run in real time at registration or only before a deposit or withdrawal. Real-time screening at registration is the stronger position, and it is what most payment partners expect. So default to screening at sign-up and confirm the minimum with the regulator.

MISA also publishes no approved list of KYC or screening vendors. That means you may use an established provider or an in-house engine, as long as the control works and you can evidence it. Whatever you choose, document how a PEP match escalates to enhanced due diligence. Also set a screening frequency that rescreens the book against updated lists, rather than at sign-up alone.

AML controls for crypto deposits

Crypto payments sit inside the same Mwali licence, so the AML rules apply to them in full. Crypto changes how you meet the rules, not whether you meet them. Funds arrive without an intermediary bank running its own checks, so your controls carry more of the load.

Screen deposit wallets with blockchain analytics before you credit funds, and treat unhosted wallet transfers as higher risk. Where you process virtual assets, the FATF Travel Rule applies to transfers above USD 1,000, which means collecting and passing originator and beneficiary information. Ask MISA whether it enforces the Travel Rule directly and whether it expects crypto KYC at a lower threshold than fiat. The common USD 10,000 practice was written with card and bank deposits in mind.

Set crypto source-of-funds triggers in your policy and justify them. For how digital assets sit inside the licence more broadly, see our guide to the Mwali crypto casino licence. Confirm your wallet-screening approach with the regulator rather than assume analytics alone is enough.

Record-keeping, retention and independent AML audits

You keep KYC files, transaction records, and monitoring alerts available for MISA to inspect on request. The FATF Recommendations set a minimum retention period of five years after a transaction or the end of a business relationship. Mwali has not published its own figure, so treat five years as the floor and confirm the exact period with MISA.

Retention also interacts with data protection. If you serve players in markets covered by the EU GDPR, a player can ask you to delete their data. Your AML obligation still requires you to keep it. In most cases the AML retention duty takes priority for the records the law requires, but confirm how you reconcile the two in your privacy policy.

MISA runs a compliance and audit function alongside a separate AML supervision unit, and it reviews the material a licensee submits. So an internal self-assessment by the MLRO is unlikely to be enough on its own. Confirm whether MISA requires an independent external AML audit, and which standard it applies at renewal. Ask early, because the risk-based template it evaluates against is not published.

Where Mwali gaming licence AML requirements trip operators up

AML files stall for a short list of reasons, and most are avoidable with preparation. The pattern repeats across offshore applications.

1. A generic AML manual. Templates that name no markets, payment methods, or thresholds read as untested and draw questions.
2. A source-of-wealth trail that stops at a bank balance. MISA wants a documented trail showing how the wealth was built and how the funds reached the company.
3. An MLRO in name only. Appointing someone who does not run the function leaves alerts unreviewed and reports unfiled.
4. No business risk assessment. Thresholds set with no risk rating behind them are hard to justify at an audit.
5. A plan that does not geo-block the Comoros. The licence does not permit local play, so a platform that cannot block Comorian players fails a core condition.

Renewals fail for a narrower set of reasons: lapsed monitoring, records that cannot be produced on request, and a missed audit. Because the licence is annual, a lapse surfaces quickly. Building the corporate base early helps too, which is where our gaming company incorporation service sets the structure up front. For the fees attached to each stage, see the full Mwali licence cost breakdown.

What the licence and its AML rules do not cover

Meeting your Mwali gaming licence AML requirements keeps you compliant with MISA. It does not make you compliant everywhere you take bets. The licence has clear territorial limits, and you plan around them from launch.

• The European Union, United Kingdom, United States, and Australia run their own regimes and require a local licence.
• You geo-block residents of the Comoros, including Mwali itself, as a condition of the licence.
• Advertising and bonus rules come from the national regulator of each market you promote in, not from MISA.

Within those limits, the licence opens markets across Latin America, Africa, parts of Asia, and Eastern Europe under a single authorisation. Most single-jurisdiction offshore licences follow the same pattern, as covered in our Tuvalu gaming licence guide. Knowing the scope sets your geo-blocking rules and your market map before you build.

Frequently asked questions

What AML requirements apply to a Mwali gaming licence?

A Mwali licensee must hold a written AML and CFT policy and appoint a Money Laundering Reporting Officer. It must also run KYC, transaction monitoring, sanctions screening, and record-keeping. MISA expects these controls to match the FATF Recommendations, on top of federal Comorian AML law. It reviews them at application and again through its compliance and audit function.

Does a Mwali licence require a Money Laundering Reporting Officer?

Yes. The MLRO is a mandatory appointment and owns the AML function, from setting thresholds to filing suspicious activity reports. You usually submit just the officer’s name and contact details to MISA. MISA does not publish a residency rule, so the person can be an outsourced compliance officer based outside Mwali.

When must a Mwali licensee verify a player?

Operators commonly verify identity before the first payout and once a player’s cumulative deposits pass USD 10,000. That figure reflects standard market practice rather than a threshold MISA publishes. Set your own risk-based triggers in the policy and confirm they are acceptable with the regulator.

How do the AML rules apply to crypto deposits?

The same AML obligations cover crypto and fiat, but crypto shifts more of the load onto your controls. Screen deposit wallets with blockchain analytics and treat unhosted wallets as higher risk. Apply the FATF Travel Rule to virtual asset transfers above USD 1,000. Confirm with MISA whether it expects a lower KYC threshold for crypto than for card and bank deposits.

Who receives suspicious activity reports from a Mwali operator?

The MLRO files reports with the relevant financial intelligence authority. MISA has not published whether reports go to a dedicated Mwali unit or a central Comoros Union financial intelligence unit, nor a fixed filing deadline. Agree the reporting route and the timeframe with MISA in writing at licensing, and record both in your policy.

How long must a Mwali licensee keep AML records?

The FATF minimum is five years after a transaction or the end of a business relationship, and Mwali has not published a longer period. Keep KYC files, transaction logs, and monitoring records available for MISA to inspect. Confirm the exact retention period MISA expects before you finalise your policy.

Does a Mwali licence require an independent AML audit?

MISA runs a compliance and audit function and reviews the material a licensee submits, so an internal review by the MLRO alone may not be sufficient. Whether MISA requires a formal independent external audit, and the standard it applies at renewal, is not published. Confirm both with the regulator so your file matches what it checks.

Can a small operator outsource its AML function?

Yes. Many operators appoint an external MLRO and use a compliance provider to draft the policy and run monitoring. The function still has to be real and active, because MISA reviews it at renewal and during audits. Outsourcing the role does not remove the obligation to evidence the controls.

Several Mwali gaming licence AML requirements sit outside published guidance. These include the CDD and source-of-funds thresholds, the suspicious activity reporting route and deadline, the retention period, and the audit standard. Confirm each one with MISA in writing at licensing rather than after a breach. DD Consultus handles Mwali applications, MLRO appointments, and ongoing AML compliance. To review your file, call +356 99408536 or email contact@licencegaming.com.