Tuvalu Gaming Licence AML Requirements: 2026 Guide

Tuvalu gaming licence AML requirements are the anti-money laundering and counter-terrorist financing controls the Tuvalu Gaming Authority requires a licensee to run. They cover a written AML policy, a Money Laundering Reporting Officer, customer due diligence, transaction monitoring, sanctions screening, and record-keeping. This guide breaks down each control and the point where files most often stall in review. It also flags the items you should confirm with the regulator in writing rather than assume. For the full licence overview, read our Tuvalu gaming licence pillar.

What Tuvalu gaming licence AML requirements cover

Tuvalu gaming licence AML requirements run across six areas: policy, people, customers, transactions, screening, and records. The TGA reviews your controls at pre-approval and checks them again through inspections and annual audits. Because the licence renews every year, there is no long gap between reviews.

The controls are not a filing exercise. They drive how you onboard players, how you clear withdrawals, and how you flag risk day to day. So a policy that reads well but does not match your live platform fails on the first inspection.

Most operators treat AML as a document to attach at application. In practice it is an operating function you staff and run. The sections below set out each requirement and the standard it draws on. They also flag what the TGA has not published, so you know what to pin down before launch.

The legal basis: the Online Gaming Act 2023 and FATF standards

The Tuvalu Online Gaming Act 2023 created the TGA and gave it power to supervise anti-money laundering and counter-terrorist financing compliance. Its standard is clear: the TGA expects your controls to match the FATF Recommendations. That matters because banks and payment providers assess your file against the same benchmark.

Tuvalu sits in the region covered by the Asia/Pacific Group on Money Laundering, a FATF-style regional body. So the AML expectations placed on a Tuvalu licensee track international practice rather than a light local rulebook. The TGA also runs a fit and proper check on every beneficial owner and director. It screens each person against sanctions and politically exposed person lists.

You can confirm the regulator and its register on the Tuvalu Gaming Authority website. For the authority’s wider supervisory powers, including inspections and enforcement, see our guide to the TGA and its enforcement tools.

Your written AML policy and business risk assessment

Every Tuvalu licensee needs a written AML and CFT policy, and the TGA reviews it at application. The policy must cover customer identification, source of funds, transaction monitoring, suspicious activity reporting, record retention, and staff training. A generic template that names no payment methods, markets, or thresholds reads as untested, so build it around your actual operation.

Underneath the policy sits a business risk assessment. This is the document that justifies your thresholds and your controls. It maps your player markets, your products, and your payment rails to a money-laundering risk rating, then sets the checks that follow. First you assess the risk, then you set the control. That order is what an auditor looks for.

Where you have no in-house capacity to draft and maintain these documents, our gaming licensing compliance team prepares them and keeps them current. Keep the policy and the risk assessment as living files, because the TGA can ask to see both at any inspection.

The Money Laundering Reporting Officer and compliance function

A Money Laundering Reporting Officer is mandatory for a Tuvalu licence. The MLRO owns the AML function. They set the thresholds, review internal alerts, decide when to file a suspicious activity report, and act as the contact point for the regulator. This is a named role, not a job title you share across a team.

The initial submission to the TGA is light. Operators typically supply the officer’s name, email, and phone number rather than a full CV or certification. Even so, the role carries real weight after licensing, so appoint someone who can actually run it. Many operators use an outsourced compliance officer, because the person does not have to reside in Tuvalu.

Two points are worth confirming in writing with the TGA. First, whether it runs post-licensing background checks on the MLRO. Second, whether it expects a formal AML qualification such as ACAMS or ICA. Neither is published, so ask rather than assume. Where you need the function supplied and kept active, our MLRO and compliance officer provision covers it.

KYC and customer due diligence for Tuvalu licensees

Know-your-customer checks sit at the front of your AML controls, and the Tuvalu gaming licence KYC requirements follow standard international practice. You verify a player’s identity with government ID and proof of address. Operators commonly run that check before the first payout and once a player’s cumulative deposits pass USD 10,000.

That threshold is a common market figure rather than a number the TGA publishes as a hard rule. So you set your own trigger in the policy and justify it against your risk assessment. Enhanced due diligence applies to higher-risk cases: large deposits, unusual patterns, or a player who turns out to be politically exposed. In those cases you ask for source of funds, and for source of wealth where the amounts warrant it.

Get one point confirmed before launch. The TGA has not published fixed thresholds that trigger source-of-funds requests, so agree acceptable levels with the regulator and record them. A documented, risk-based approach is what an inspection rewards, and it is also what payment providers ask to see during onboarding.

Transaction monitoring under Tuvalu gaming licence AML requirements

You must monitor player transactions and report suspicious activity. Monitoring means a system that flags risk patterns. Examples include rapid deposit and withdrawal with little play, structured deposits below a threshold, or funds that do not match a player’s profile. The MLRO reviews the alerts and decides which ones escalate.

When an alert becomes a genuine suspicion, the MLRO files a suspicious activity report with the relevant financial intelligence authority. Here the TGA leaves detail open. It does not publish which financial intelligence unit receives the report, nor a fixed filing deadline such as 24 hours or three business days. So confirm the reporting route and the timeframe with the TGA in writing at licensing, and record both in your policy.

Keep the monitoring evidence. The TGA can ask for transaction logs and the alerts your system raised. So the point of monitoring is to show the work, not just to run software in the background.

Sanctions and PEP screening at onboarding

Sanctions and politically exposed person screening is part of every Tuvalu licensee’s AML controls. You screen players against sanctions lists and PEP databases, and you geo-block sanctioned and FATF-listed jurisdictions as a licence condition. The TGA already screens your owners and directors at pre-approval, and it expects you to screen players on the same basis.

One open question is timing. The TGA does not state whether screening must run in real time at registration or only before a deposit or withdrawal. Real-time screening at registration is the stronger position, and it is what most payment partners expect. So default to screening at sign-up and confirm the minimum with the regulator.

The TGA also publishes no approved list of KYC or screening vendors. That means you may use an established provider or an in-house engine, as long as the control works and you can evidence it. Whatever you choose, document how a PEP match escalates to enhanced due diligence.

Tuvalu gaming licence AML requirements for crypto deposits

Crypto payments sit inside the same Tuvalu licence, so the AML rules apply to them in full. Crypto changes how you meet the rules, not whether you meet them. Funds arrive without an intermediary bank running its own checks, so your controls carry more of the load.

Screen deposit wallets with blockchain analytics before you credit funds, and treat unhosted wallet transfers as higher risk. Where you process virtual assets, the FATF Travel Rule applies to transfers above USD 1,000, which means collecting and passing originator and beneficiary information. Ask the TGA whether it expects crypto KYC at a lower threshold than fiat. The common USD 10,000 practice was written with card and bank deposits in mind.

Set crypto source-of-funds triggers in your policy and justify them. For how digital assets sit inside the licence more broadly, see our guide to the Tuvalu licence for crypto casinos. Confirm your wallet-screening approach with the regulator rather than assume analytics alone is enough.

Record-keeping, retention and independent AML audits

You keep KYC files, transaction records, and monitoring alerts available for the TGA to inspect on request. The FATF Recommendations set a minimum retention period of five years after a transaction or the end of a business relationship. Tuvalu has not published its own figure, so treat five years as the floor and confirm the exact period with the TGA.

Retention also interacts with data protection. If you serve players in markets covered by the EU GDPR, a player can ask you to delete their data. Your AML obligation still requires you to keep it. The AML retention duty generally takes priority for the records the law requires, but confirm how you reconcile the two in your privacy policy.

The TGA requires regular independent compliance audits by approved third-party auditors. So an internal self-assessment by the MLRO is not enough on its own. Confirm the audit standard the TGA applies at renewal, because the risk-based template it evaluates against is not published.

Where Tuvalu gaming licence AML requirements trip operators up

AML files stall for a short list of reasons, and most are avoidable with preparation. The pattern repeats across offshore applications.

1. A generic AML manual. Templates that name no markets, payment methods, or thresholds read as untested and draw questions.
2. A source-of-wealth trail that stops at a bank balance. The TGA wants a documented trail showing how the wealth was built and how the funds reached the company.
3. An MLRO in name only. Appointing someone who does not run the function leaves alerts unreviewed and reports unfiled.
4. No business risk assessment. Thresholds set with no risk rating behind them are hard to justify at an inspection.
5. Undisclosed background findings. Prior regulatory action or a refused licence damages the file far more when the TGA finds it than when you disclose it.

Renewals fail for a narrower set of reasons: lapsed monitoring, records that cannot be produced on request, and a missed independent audit. Because the licence is annual, a lapse surfaces quickly. Ongoing support exists mainly to stop those from happening. Building the corporate base early helps too, which is where our gaming company incorporation service sets the structure up front.

What the licence and its AML rules do not cover

Meeting your Tuvalu gaming licence AML requirements keeps you compliant with the TGA. It does not make you compliant everywhere you take bets. The licence has clear territorial limits, and you plan around them from launch.

• The United States, United Kingdom, European Union, and Australia run their own regimes and require a local licence.
• You geo-block sanctioned and FATF-listed jurisdictions as a condition of the Tuvalu licence.
• Advertising and bonus rules come from the national regulator of each market you promote in, not from the TGA.

Within those limits, the licence opens markets across Latin America, Africa, parts of Asia, and Eastern Europe. For the documents and general eligibility that sit alongside the AML controls, see our page on Tuvalu gaming licence requirements. Knowing the scope sets your geo-blocking rules and your market map before you build.

Frequently asked questions

What AML requirements apply to a Tuvalu gaming licence?

A Tuvalu licensee must hold a written AML and CFT policy and appoint a Money Laundering Reporting Officer. It must also run KYC, transaction monitoring, sanctions screening, and record-keeping. The TGA expects these controls to match the FATF Recommendations. It reviews them at application and again through inspections and annual audits.

Does a Tuvalu licence require a Money Laundering Reporting Officer?

Yes. The MLRO is a mandatory appointment and owns the AML function, from setting thresholds to filing suspicious activity reports. You usually submit just the officer’s name and contact details to the TGA. The person can be an outsourced compliance officer and does not have to reside in Tuvalu.

When must a Tuvalu licensee verify a player?

Operators commonly verify identity before the first payout and once a player’s cumulative deposits pass USD 10,000. That figure reflects standard market practice rather than a threshold the TGA publishes. Set your own risk-based triggers in the policy and confirm they are acceptable with the regulator.

How do the AML rules apply to crypto deposits?

The same AML obligations cover crypto and fiat, but crypto shifts more of the load onto your controls. Screen deposit wallets with blockchain analytics and treat unhosted wallets as higher risk. Apply the FATF Travel Rule to virtual asset transfers above USD 1,000. Confirm with the TGA whether it expects a lower KYC threshold for crypto than for card and bank deposits.

Who receives suspicious activity reports from a Tuvalu operator?

The MLRO files reports with the relevant financial intelligence authority. The TGA has not published which financial intelligence unit receives them or a fixed filing deadline. Agree the reporting route and the timeframe with the TGA in writing at licensing, and record both in your policy.

How long must a Tuvalu licensee keep AML records?

The FATF minimum is five years after a transaction or the end of a business relationship, and Tuvalu has not published a longer period. Keep KYC files, transaction logs, and monitoring records available for TGA inspection. Confirm the exact retention period the TGA expects before you finalise your policy.

Does a Tuvalu licence require an independent AML audit?

The TGA requires regular independent compliance audits by approved third-party auditors, so an internal review by the MLRO alone is not sufficient. The audit standard and the risk-based template the TGA applies at renewal are not published. Confirm both with the regulator so your file matches what the auditor checks.

Can a small operator outsource its AML function?

Yes. Many operators appoint an external MLRO and use a compliance provider to draft the policy and run monitoring. The function still has to be real and active, because the TGA reviews it at inspection and renewal. Outsourcing the role does not remove the obligation to evidence the controls.

Several Tuvalu gaming licence AML requirements sit outside published guidance. These include source-of-funds thresholds, the suspicious activity reporting route and deadline, the retention period, and the audit standard. Confirm each one with the TGA in writing at licensing rather than after a breach. DD Consultus handles Tuvalu applications, MLRO appointments, and ongoing AML compliance. To review your file, call +356 99408536 or email contact@licencegaming.com.