# KURAL Control Library — operator OP-GREENTUBE (Greentube Internet Entertainment Solutions GmbH) # generated: 2026-06-17T14:34:07.312Z # operator jurisdictions: mga, ukgc, adm, ro-onjn, sk-mfsr, dgoj, ggl, spi, nj-dge, mi-mgcb, pa-pgcb # scope: 34 controls (all enabled) - control_id: MGA.PPD.AGE.1 jurisdiction: mga title: Age verification before deposit / play requirement_text: "Licensee must verify a player is at least 18 years of age before allowing any deposit, wager, or withdrawal. Verification must complete within 30 days of registration; play must be suspended if verification fails. " category: kyc_identity severity: critical check_frequency: continuous source: "MGA Player Protection Directive (D3/2018), Section 4 — Age Verification" source_url: "" - control_id: MGA.PPD.SE.1 jurisdiction: mga title: "Self-exclusion: minimum 6 months, effective within 24 hours" requirement_text: "Licensees must offer a self-exclusion facility allowing players to set an exclusion of at least 6 months. The exclusion must take effect within 24 hours of request and must prevent any marketing communication during the exclusion period. " category: responsible_gambling severity: high check_frequency: continuous source: "MGA Player Protection Directive (D3/2018), Section 3 — Self-Exclusion" source_url: "" - control_id: MGA.PPD.DL.1 jurisdiction: mga title: Deposit limit offered before first deposit requirement_text: "Players must be offered the option to set a deposit limit (daily, weekly, monthly) before making their first deposit. Increases must take effect only after a 24-hour reflection period; decreases take effect immediately. " category: responsible_gambling severity: high check_frequency: continuous source: "MGA Player Protection Directive (D3/2018), Section 2 — Deposit Limits" source_url: "" - control_id: MGA.PPD.RG.SESSION.1 jurisdiction: mga title: Session reminder and net-position display requirement_text: "The licensee must display the player's net position (deposits minus withdrawals minus wagering result) and total session time, with automatic reminders at least every 60 minutes of active play. " category: responsible_gambling severity: medium check_frequency: hourly source: "MGA Player Protection Directive (D3/2018), Section 5 — Session Limits" source_url: "" - control_id: MGA.AML.SR.1 jurisdiction: mga title: Suspicious activity reporting to FIAU requirement_text: "The MLRO must file a Suspicious Transaction Report (STR) with the Financial Intelligence Analysis Unit (FIAU) without undue delay upon suspicion of money laundering or terrorist financing. " category: aml_ctf severity: critical check_frequency: weekly source: MGA Implementing Procedures (Part II) + FIAU AML/CFT Implementing Procedures source_url: "" - control_id: MGA.AML.CDD.1 jurisdiction: mga title: Enhanced Due Diligence for PEPs and high-risk customers requirement_text: "Enhanced Due Diligence (EDD) must be performed for politically exposed persons (PEPs), customers from high-risk third countries, and customers exceeding EUR 2,000 in aggregate transactions over 24 hours. " category: aml_ctf severity: high check_frequency: daily source: MGA + PMLFTR — Customer Due Diligence source_url: "" - control_id: MGA.GAME.RNG.1 jurisdiction: mga title: RNG certification freshness — under 3 years requirement_text: "All Random Number Generators in production must hold a valid certification from an MGA-recognised test lab (GLI, BMM, eCOGRA, iTech) issued within the last 36 months. " category: game_fairness_rng severity: high check_frequency: monthly source: MGA Gaming Authorisations Regulations + ISO/IEC 17025 testing source_url: "" - control_id: MGA.PPD.MARKETING.1 jurisdiction: mga title: No marketing to self-excluded or under-18 audiences requirement_text: "Commercial communications must not be directed at self-excluded players, minors, or vulnerable persons. Affiliate marketing channels must be monitored for compliance with the same standards. " category: marketing_advertising severity: high check_frequency: daily source: MGA Commercial Communications Regulations (S.L. 583.09) source_url: "" - control_id: MGA.OPS.STAFF.AML_TRAINING.1 jurisdiction: mga title: Annual AML training completion for relevant staff requirement_text: "All employees in customer-facing, payments, AML, and senior management roles must complete annual AML/CFT training, with records retained for at least 5 years. " category: licensing_personnel severity: medium check_frequency: monthly source: "MGA + FIAU Implementing Procedures, Chapter on Training" source_url: "" - control_id: MGA.PPD.INTERACTION.1 jurisdiction: mga title: Documented player interaction following markers of harm requirement_text: "When markers of harm are detected (chasing losses, deposit-velocity spikes, late-night session length), a documented player interaction must occur within 72 hours and be retained for at least 5 years. " category: responsible_gambling severity: high check_frequency: daily source: MGA Player Interaction Policy Guidelines (2021) source_url: "" - control_id: MGA.OPS.AUDIT.SYS.1 jurisdiction: mga title: Annual System Audit by approved auditor requirement_text: "A System Audit must be performed annually by an MGA-approved third-party auditor covering the technical infrastructure, key controls, and player funds segregation. The audit report must be filed within 90 days of fiscal year end. " category: operational_security severity: high check_frequency: annual source: MGA System Audit Regulation (S.L. 583.10) source_url: "" - control_id: MGA.OPS.PLAYER_FUNDS.1 jurisdiction: mga title: Player funds segregation from operational accounts requirement_text: "Player balances and pending withdrawals must be held in a designated segregated account, separate from operational and corporate funds, with monthly reconciliation evidence. " category: financial_limits severity: critical check_frequency: monthly source: MGA Player Protection — Player Funds source_url: "" - control_id: RO.ONJN.LICENCE.1 jurisdiction: ro-onjn title: Class I or Class II licence valid for product offered requirement_text: "Operators must hold an active ONJN licence covering the specific gambling activity offered to Romanian customers. Authorisation must be renewed before expiry. " category: licensing_personnel severity: critical check_frequency: monthly source: GEO 77/2009 + 2024 amendments — Licensing source_url: "" - control_id: RO.ONJN.SELF_EXCLUSION.1 jurisdiction: ro-onjn title: Self-exclusion register lookup requirement_text: "Operators must check players against the ONJN self-exclusion register at registration and block listed players. " category: responsible_gambling severity: high check_frequency: continuous source: ONJN Regulations — Self-exclusion source_url: "" - control_id: RO.ONJN.GUARANTEE.1 jurisdiction: ro-onjn title: Player fund guarantee deposited with state treasury requirement_text: "Operators must maintain a guarantee deposit (typically EUR 100,000-500,000 depending on class) with the Romanian state treasury, evidenced annually. " category: financial_limits severity: high check_frequency: annual source: GEO 77/2009 — Player fund guarantees source_url: "" - control_id: UKGC.LCCP.SR.3.4.1 jurisdiction: ukgc title: Customer interaction with players exhibiting markers of harm requirement_text: "Licensees must interact with customers in a way that minimises the risk of customers experiencing harms associated with gambling. Interactions must be based on indicators of harm including duration of session, frequency, deposits, losses, and time of day. Records of identification, interaction and outcome must be kept. " category: responsible_gambling severity: critical check_frequency: continuous source: LCCP Social Responsibility Code 3.4.1 — Customer Interaction source_url: "https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp" - control_id: UKGC.LCCP.SR.3.5.1 jurisdiction: ukgc title: GAMSTOP integration for national multi-operator self-exclusion requirement_text: "Licensees offering remote gambling to GB customers must be a participant in the national online self-exclusion scheme (GAMSTOP) and block registration and gambling activity for all customers listed on the GAMSTOP register, refreshed at least every 24 hours. " category: responsible_gambling severity: critical check_frequency: hourly source: LCCP Social Responsibility Code 3.5.1 — Self-Exclusion (GAMSTOP) source_url: "" - control_id: UKGC.LCCP.SR.3.5.3 jurisdiction: ukgc title: "Time-out facility (24h, 7d, 30d, 6w)" requirement_text: "Licensees must make available to customers a facility for taking positive action to restrict their gambling, including the option of a time-out for 24 hours, one week, one month, and up to 6 weeks. The time-out must be applied without delay. " category: responsible_gambling severity: high check_frequency: continuous source: LCCP Social Responsibility Code 3.5.3 — Time-out facility source_url: "" - control_id: UKGC.LCCP.SR.2.1 jurisdiction: ukgc title: "AML risk assessment + customer due diligence threshold (£/€2,000)" requirement_text: "Licensees must conduct a documented AML risk assessment and apply CDD when a customer deposits or wagers €/£2,000 or more in a single transaction or linked transactions, including source-of-funds evidence for high-risk customers. " category: aml_ctf severity: critical check_frequency: daily source: LCCP Social Responsibility Code 2.1 — Anti-Money-Laundering source_url: "" - control_id: UKGC.RTS.2A jurisdiction: ukgc title: "Customer-led deposit limits, applied without delay (decrease) / with reflection (increase)" requirement_text: "The system must allow customers to set deposit limits. Decreases must take effect immediately. Increases must include a reflection period (typically 24 hours) and reconfirmation by the customer. " category: financial_limits severity: high check_frequency: continuous source: UKGC Remote Technical Standards — RTS 2A (Financial limits) source_url: "" - control_id: UKGC.RTS.3 jurisdiction: ukgc title: Display net position and session time to player requirement_text: "The customer must be able to see their net position (deposits less withdrawals less wins/losses) and total session time at all times during a gambling session. " category: responsible_gambling severity: medium check_frequency: hourly source: UKGC Remote Technical Standards — RTS 3 (Display of net position and session info) source_url: "" - control_id: UKGC.RTS.7A jurisdiction: ukgc title: RNG certification and game-cycle integrity requirement_text: "Random Number Generators must be tested and certified by a UKGC-recognised test lab. Game cycles must complete fully and not be artificially extended. No game may have a stake-to-win cycle shorter than 2.5 seconds (slots). " category: game_fairness_rng severity: high check_frequency: monthly source: "UKGC Remote Technical Standards — RTS 7A (RNG, game fairness)" source_url: "" - control_id: UKGC.RTS.12 jurisdiction: ukgc title: "Game rules, RTP, and house edge disclosed to customer" requirement_text: "Customers must be able to access game rules, theoretical return-to-player (RTP) percentage, and any volatility information for every game before and during play. " category: technical_systems severity: medium check_frequency: weekly source: UKGC Remote Technical Standards — RTS 12 (Information to customer) source_url: "" - control_id: UKGC.RTS.14 jurisdiction: ukgc title: "Slot design: no autoplay, max 2.5s spin, no losses-disguised-as-wins" requirement_text: "Online slot games must not include autoplay, must have a minimum spin cycle of 2.5 seconds, must not feature sound or imagery on wins that are equal to or less than the stake (LDW), and must display total wagered, lost/won, and elapsed time when reaching session milestones. " category: responsible_gambling severity: high check_frequency: weekly source: UKGC Remote Technical Standards — RTS 14 (Responsible product design) source_url: "" - control_id: UKGC.LCCP.5.1.6 jurisdiction: ukgc title: "Marketing: bonus T&Cs clear, no misleading claims, affiliate oversight" requirement_text: "All marketing communications, including via affiliates, must be socially responsible. Bonus offers must clearly state wagering requirements, expiry, restricted games, and maximum withdrawable winnings. Licensees are responsible for breaches by their affiliates. " category: marketing_advertising severity: high check_frequency: weekly source: "LCCP 5.1.6 — Marketing rules, including affiliate oversight" source_url: "" - control_id: UKGC.LCCP.15 jurisdiction: ukgc title: Regulatory Returns filed on time (quarterly + annual) requirement_text: "Licensees must submit Regulatory Returns to the UKGC quarterly and annually via the eServices portal within the deadlines published by the Commission. Information must reconcile to underlying records. " category: reporting_returns severity: medium check_frequency: quarterly source: LCCP 15 — Regulatory Returns source_url: "" - control_id: UKGC.LCCP.AFFORDABILITY.1 jurisdiction: ukgc title: Financial vulnerability checks at £125 net loss / £500 high-spend thresholds requirement_text: "Licensees must perform light-touch financial vulnerability checks at £125 net loss in a 30-day period and frictionless financial risk assessments at £500 net loss thresholds, with referrals to enhanced affordability assessment as risk increases. " category: responsible_gambling severity: high check_frequency: daily source: UKGC Financial Risk Checks Policy (effective 2024 onward) source_url: "" - control_id: UKGC.LCCP.SCV.1 jurisdiction: ukgc title: Participate in Single Customer View (SCV) data-sharing pilot/scheme requirement_text: "Licensees designated by the Commission must contribute to and consume Single Customer View data via the approved data-sharing service, to identify cross-operator harm patterns. " category: responsible_gambling severity: high check_frequency: daily source: UKGC Single Customer View consultation outcome (2024) source_url: "" - control_id: UKGC.LCCP.SR.3.5.4 jurisdiction: ukgc title: "GAMSTOP sync — sync_status must be 'ok' on every check" requirement_text: "The licensee must be enrolled with GAMSTOP and must synchronise with the GAMSTOP register at least every 24 hours. Each sync attempt is logged; the most recent sync_status must be 'ok' before any registration or deposit is accepted. " category: responsible_gambling severity: critical check_frequency: hourly source: LCCP Social Responsibility Code 3.5 — National Online Self-Exclusion (GAMSTOP) source_url: "https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp" - control_id: UKGC.LCCP.SR.3.5.5 jurisdiction: ukgc title: Recent GAMSTOP exclusions must be blocked at next session requirement_text: "Players newly added to the GAMSTOP register must be blocked at their next session start. The block must occur regardless of which brand or platform within the licensee group they attempt to access. " category: responsible_gambling severity: critical check_frequency: continuous source: LCCP Social Responsibility Code 3.5 — Honouring fresh GAMSTOP exclusions source_url: "https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp" - control_id: SPORTSBOOK.LIMITS.UKGC.AC.1 jurisdiction: ukgc title: Affordability checks at £125 net-loss-per-month trigger requirement_text: "Sportsbook operators licensed by the UK Gambling Commission must apply light-touch financial vulnerability checks at £125 net loss per month and enhanced affordability checks at £1,000 in 24 hours / £2,000 in 90 days. " category: financial_limits severity: critical check_frequency: daily source: UKGC RTS Annex C — Affordability triggers for sports betting source_url: "https://www.gamblingcommission.gov.uk/" - control_id: SPORTSBOOK.MARKETING.UKGC.CAP.1 jurisdiction: ukgc title: No marketing of sports betting to under-25s on social platforms requirement_text: "Paid sports-betting marketing on social platforms (Meta, TikTok, X) must be targeted only at audiences where 95%+ are 25 or older, in line with CAP Code Section 16.3.12 and UKGC enforcement actions 2024. " category: marketing_advertising severity: high check_frequency: weekly source: UKGC + CAP Code 16 — Sportsbook marketing source_url: "" - control_id: SPORTSBOOK.RG.UKGC.SR.1 jurisdiction: ukgc title: In-play loss-chasing intervention prompts requirement_text: "During in-play sports markets, the operator must surface a soft intervention (loss summary, deposit limit reminder, \"are you sure\" prompt) when a player exceeds 5 net losses within a 60-minute window on the same event. " category: responsible_gambling severity: high check_frequency: continuous source: LCCP Social Responsibility 3.4 — In-play loss-chasing prompts source_url: "" - control_id: SPORTSBOOK.PAYMENT.CREDIT.UKGC.1 jurisdiction: ukgc title: Credit card deposits blocked requirement_text: "UKGC-licensed sportsbook operators must not accept credit card deposits (direct or via e-wallets that draw from credit). Acceptance of credit is a per-transaction breach. " category: financial_limits severity: critical check_frequency: continuous source: UKGC Credit Card Gambling Ban (Apr 2020) source_url: ""