Controls Library
189 controls across 33 jurisdictions.
🇦🇷AR-CABA3 controls
Argentina — Ciudad Autónoma de Buenos Aires · LOTBA
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| AR.CABA.LOTBA.LICENCE.1 | LOTBA operating licence for CABA | licensing personnel | critical | monthly |
| AR.CABA.LOTBA.GEO.1 | Player physically in CABA at wager time | technical systems | high | continuous |
| AR.CABA.LOTBA.AGE.1 | Minimum age 18, ID verification | kyc identity | critical | continuous |
🇦🇷AR-MENDOZA2 controls
Argentina — Mendoza · Instituto Provincial de Juegos y Casinos
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| AR.MENDOZA.IPJYC.LICENCE.1 | Mendoza IPJyC operating licence | licensing personnel | critical | monthly |
| AR.MENDOZA.IPJYC.GEO.1 | Player physically in Mendoza province | technical systems | high | continuous |
🇦🇷AR-PBA3 controls
Argentina — Buenos Aires Province · IPLyC PBA
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| AR.PBA.IPLYC.LICENCE.1 | IPLyC operating licence active for online games of chance | licensing personnel | critical | monthly |
| AR.PBA.IPLYC.GEO.1 | Player physically in PBA province at wager time | technical systems | high | continuous |
| AR.PBA.IPLYC.RG.1 | Player limits + self-exclusion accessible at registration | responsible gambling | high | continuous |
🇦🇺AU-NT4 controls
Australia — Northern Territory · NT Racing Commission
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| AU.NT.LICENCE.1 | NTRC sports/racing wagering licence active | licensing personnel | critical | monthly |
| AU.NT.BETSTOP.1 | BetStop national self-exclusion register integration | responsible gambling | critical | continuous |
| AU.NT.CREDIT_BAN.1 | Credit card ban for online wagering | financial limits | critical | continuous |
| AU.NT.RG.CHECK.1 | Monthly activity statement to player | responsible gambling | medium | monthly |
🇧🇷BR-SPA9 controls
Brazil · Secretaria de Prêmios e Apostas (SPA)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| BR.SPA.LICENCE.1 | Federal SPA authorisation for fixed-odds betting and online games | licensing personnel | critical | monthly |
| BR.SPA.CPF_KYC.1 | CPF verification + biometric/facial match (3DS / liveness) | kyc identity | critical | continuous |
| BR.SPA.SE.1 | Self-exclusion register (national, cross-operator) lookup | responsible gambling | critical | continuous |
| BR.SPA.PIX.PAYMENT.1 | Player-owned account: Pix/transfer must come from CPF-matched account | aml ctf | high | continuous |
| BR.SPA.NO_CREDIT.1 | Credit card payments prohibited for wagering | financial limits | high | continuous |
| BR.SPA.BONUS.1 | Bonuses with wagering requirements clearly disclosed | marketing advertising | medium | weekly |
| BR.SPA.REPORTING.1 | SIGAP transaction reporting in real time | reporting returns | high | continuous |
| BR.SPA.RG.LIMITS.1 | Player-set deposit and time limits | responsible gambling | high | continuous |
| BR.SPA.AML.COAF.1 | Suspicious activity reporting to COAF/UIF | aml ctf | critical | weekly |
🇨🇦CA-ON-AGCO7 controls
Canada — Ontario · Alcohol and Gaming Commission of Ontario (AGCO)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| CA.ON.AGCO.STD.1.19 | Self-exclusion across iGO operators (centralised mechanism) | responsible gambling | critical | continuous |
| CA.ON.AGCO.STD.2.GAME.1 | Game certification by AGCO-recognised lab | game fairness rng | high | monthly |
| CA.ON.AGCO.STD.3.RG.1 | Mandatory deposit-limit prompt, time-out, reality check | responsible gambling | high | continuous |
| CA.ON.AGCO.STD.4.AML.1 | FINTRAC reporting (LCTR, STR, EFT) | aml ctf | critical | daily |
| CA.ON.AGCO.IGO.REPORTING.1 | iGO operating reporting (Player liability, GGR, taxes) | reporting returns | high | monthly |
| CA.ON.AGCO.STD.6.MARKETING.1 | No use of athletes as endorsers (active or retired <5y) | marketing advertising | high | weekly |
| CA.ON.AGCO.STD.LOCATION.1 | Player physically in Ontario at wager time | technical systems | critical | continuous |
🇨🇱CL-SCJ2 controls
Chile · Subsecretaría de Casinos de Juego
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| CL.SCJ.FORTHCOMING.LICENCE.1 | SCJ online operating licence (forthcoming) | licensing personnel | low | quarterly |
| CL.SCJ.FORTHCOMING.AGE.1 | Minimum age 18, RUT verification (anticipated) | kyc identity | high | continuous |
🇨🇴CO-COLJUEGOS4 controls
Colombia · Coljuegos
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| CO.COLJUEGOS.LICENCE.1 | Coljuegos operating contract for online games of chance | licensing personnel | critical | monthly |
| CO.COLJUEGOS.CCDA.1 | Centro de Cómputo y Datos (CCDA) real-time transaction reporting | reporting returns | high | continuous |
| CO.COLJUEGOS.SE.1 | Self-exclusion programme and lookup | responsible gambling | high | continuous |
| CO.COLJUEGOS.PSP.1 | Use only Coljuegos-authorised payment providers | financial limits | high | weekly |
🇨🇼CURACAO-CGB3 controls
Curaçao · Curaçao Gaming Board (CGB)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| CW.CGA.LICENCE.1 | Direct CGA B2C licence (replaces master-licence model) | licensing personnel | critical | monthly |
| CW.CGA.AML.1 | Suspicious transaction reporting to MOT Curaçao | aml ctf | critical | weekly |
| CW.CGA.RG.BASIC.1 | Self-exclusion facility and limits available to player | responsible gambling | high | continuous |
🇩🇪DE-GLUSTV9 controls
Germany · GlüStV (Glücksspielstaatsvertrag)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| DE.GLUSTV.LIMIT.1 | EUR 1,000 monthly cross-operator deposit cap enforced via Limitdatei | financial limits | critical | continuous |
| DE.GLUSTV.OASIS.1 | OASIS national self-exclusion register check before every session | responsible gambling | critical | continuous |
| DE.GLUSTV.PANIC.1 | Panic button: 24-hour immediate exclusion | responsible gambling | high | continuous |
| DE.GLUSTV.SLOT.1 | Slot constraints: max EUR 1 stake, 5s spin minimum, no autoplay/jackpots | game fairness rng | high | weekly |
| DE.GLUSTV.LIVE.1 | No live casino or table games under virtual slot licence | licensing personnel | critical | daily |
| DE.GLUSTV.SESSION.1 | Session limits: maximum 1 hour, mandatory 5 minute break | responsible gambling | medium | continuous |
| DE.GLUSTV.MARKETING.1 | No marketing 6am-9pm on TV/radio/internet for slot/poker | marketing advertising | high | daily |
| DE.GLUSTV.SAFER_GAMBLING.1 | Mandatory display of self-test and helpline before deposit | responsible gambling | medium | daily |
| DE.GLUSTV.AGE.1 | Age verification (18+) before account activation | kyc identity | critical | continuous |
🇩🇰DK-SPILLEMYNDIGHEDEN5 controls
Denmark · Spillemyndigheden
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| DK.SPM.ROFUS.1 | ROFUS self-exclusion lookup at registration and login | responsible gambling | critical | continuous |
| DK.SPM.MITID.1 | MitID identification for Danish players | kyc identity | high | continuous |
| DK.SPM.LIMIT.1 | Mandatory deposit limit (daily/weekly/monthly) before play | responsible gambling | high | continuous |
| DK.SPM.GAME_REPORT.1 | Daily reporting to SAFE system | reporting returns | medium | daily |
| DK.SPM.SHARED_PLAYER_ACCT.1 | Single player account per operator brand | kyc identity | medium | weekly |
🇪🇸ES-DGOJ7 controls
Spain · Dirección General de Ordenación del Juego (DGOJ)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| ES.DGOJ.ICS.1 | Internal Control System (ICS) certified annually | operational security | high | annual |
| ES.DGOJ.RGIAJ.1 | RGIAJ general self-exclusion register lookup | responsible gambling | critical | continuous |
| ES.DGOJ.ADV.1 | No bonuses to new customers; advertising window 01:00-05:00 | marketing advertising | high | daily |
| ES.DGOJ.LIMIT.1 | Default deposit limits: EUR 600 daily, 1,500 weekly, 3,000 monthly | financial limits | high | continuous |
| ES.DGOJ.CMS.1 | Real-time transaction reporting to DGOJ Monitoring System | reporting returns | high | continuous |
| ES.DGOJ.AGE.1 | DNI/NIE verification before deposit | kyc identity | critical | continuous |
| ES.DGOJ.RG.SUPERVISION.1 | Active player intervention based on risk indicators (60 markers) | responsible gambling | high | daily |
🌍GLOBAL26 controls
Cross-jurisdiction · Baseline applies across all licences
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| IDENTITY.ENTRA.MFA.ADMIN | All admin role assignments must have MFA registered | operational security | critical | daily |
| IDENTITY.ENTRA.CA.LEGACY_AUTH | Legacy authentication must be blocked by Conditional Access | operational security | high | daily |
| IDENTITY.ENTRA.SIGNIN.RISK | High-risk sign-in events must be remediated within 24h | operational security | high | hourly |
| SOC2.CC1.ORG | Defined org structure, code of conduct, and accountability roles | operational security | medium | quarterly |
| SOC2.CC2.COMMS | Security policy distributed and acknowledged by every staff member | operational security | medium | monthly |
| SOC2.CC3.RISK | Quarterly risk-register review with documented mitigations | operational security | medium | quarterly |
| SOC2.CC4.MON | Continuous monitoring via our own platform — pass-rate ≥ 95% | operational security | high | daily |
| SOC2.CC5.SEPDUTIES | Production deploy segregation: code review required on main | operational security | high | weekly |
| SOC2.CC6.IAM | MFA on 100% of admin accounts; quarterly access review | operational security | critical | daily |
| SOC2.CC7.OPS | Incident response: every Sev-1 has documented timeline + post-mortem within 7d | operational security | high | weekly |
| SOC2.CC8.CHANGE | Every prod release has reviewed PR + passing CI | operational security | high | weekly |
| SOC2.CC9.VENDOR | Quarterly subprocessor risk review with tier classification | operational security | medium | quarterly |
| SOC2.A1.UPTIME | Public status page uptime ≥ 99.5% rolling 30 days | operational security | high | daily |
| SOC2.C1.RETENTION | Operator data deleted within 30 days of contract termination | data protection | critical | monthly |
| SPORTSBOOK.INTEGRITY.IBIA.1 | Suspicious-betting alert pipeline to integrity monitor | technical systems | critical | daily |
| SPORTSBOOK.INTEGRITY.INSIDER.1 | Block bets from athletes, officials, and team staff on their own sport | technical systems | critical | continuous |
| SPORTSBOOK.AML.STRUCTURING.1 | Detection of structured deposits to evade KYC thresholds | aml ctf | high | daily |
| SPORTSBOOK.SETTLEMENT.LATENCY.1 | Market settlement within 24h of event conclusion | technical systems | medium | daily |
| SPORTSBOOK.INTEGRITY.LATE.MOVEMENT.1 | Late odds-movement anomaly detection on minor markets | technical systems | high | continuous |
| SPORTSBOOK.RG.LIMITS.1 | Player-set deposit limit enforcement on sports wallets | responsible gambling | high | daily |
| SPORTSBOOK.LICENSING.ATHLETE.1 | League-data sourcing for officially-licensed leagues | licensing personnel | high | monthly |
| SPORTSBOOK.VOID.MARKET.1 | Documented market-void rules with audit trail | complaints dispute | medium | weekly |
| SPORTSBOOK.KYC.SOURCE.OF.WEALTH.1 | Source-of-wealth check at £/€/$ 10k lifetime deposit | kyc identity | high | daily |
| SPORTSBOOK.DATA.ARCHIVE.1 | Bet record retention for 5 years | data protection | medium | quarterly |
| SPORTSBOOK.RG.VOLUNTARY.EXCLUSION.1 | Daily refresh against multi-operator self-exclusion registries | responsible gambling | critical | daily |
| SPORTSBOOK.INTEGRITY.STAFF.WAGER.1 | Staff and contractor wagering prohibition | licensing personnel | medium | quarterly |
🇬🇷GR-HGC3 controls
Greece · Hellenic Gaming Commission
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| GR.HGC.LICENCE.1 | Type 1 (casino) or Type 2 (betting) licence active | licensing personnel | critical | monthly |
| GR.HGC.SELF_EXCLUSION.1 | HGC self-exclusion register lookup before play | responsible gambling | high | continuous |
| GR.HGC.REPORTING.1 | Daily/monthly reporting to HGC | reporting returns | medium | daily |
🇮🇹IT-ADM4 controls
Italy · Agenzia delle Dogane e dei Monopoli (ADM)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| IT.ADM.NO_ADS.1 | No gambling advertising or sponsorship (Decreto Dignità) | marketing advertising | critical | weekly |
| IT.ADM.SPID.1 | SPID or strong identification before play | kyc identity | high | continuous |
| IT.ADM.RUA.1 | RUA national self-exclusion register check | responsible gambling | critical | continuous |
| IT.ADM.PREU.1 | Real-time transmission to ADM technical centre (SOGEI) | reporting returns | high | continuous |
🇯🇵JP-FORTHCOMING1 controls
Japan · Forthcoming framework
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| JP.CRC.STUB.LICENCE.1 | Casino Regulatory Commission licence (placeholder) | licensing personnel | low | annual |
🇰🇷KR-FORTHCOMING1 controls
South Korea · Forthcoming framework
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| KR.NGCC.STUB.RESTRICTED.1 | Online gambling is generally prohibited for Korean residents | licensing personnel | low | annual |
🇲🇹MGA12 controls
Malta · Malta Gaming Authority
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| MGA.PPD.AGE.1 | Age verification before deposit / play | kyc identity | critical | continuous |
| MGA.PPD.SE.1 | Self-exclusion: minimum 6 months, effective within 24 hours | responsible gambling | high | continuous |
| MGA.PPD.DL.1 | Deposit limit offered before first deposit | responsible gambling | high | continuous |
| MGA.PPD.RG.SESSION.1 | Session reminder and net-position display | responsible gambling | medium | hourly |
| MGA.AML.SR.1 | Suspicious activity reporting to FIAU | aml ctf | critical | weekly |
| MGA.AML.CDD.1 | Enhanced Due Diligence for PEPs and high-risk customers | aml ctf | high | daily |
| MGA.GAME.RNG.1 | RNG certification freshness — under 3 years | game fairness rng | high | monthly |
| MGA.PPD.MARKETING.1 | No marketing to self-excluded or under-18 audiences | marketing advertising | high | daily |
| MGA.OPS.STAFF.AML_TRAINING.1 | Annual AML training completion for relevant staff | licensing personnel | medium | monthly |
| MGA.PPD.INTERACTION.1 | Documented player interaction following markers of harm | responsible gambling | high | daily |
| MGA.OPS.AUDIT.SYS.1 | Annual System Audit by approved auditor | operational security | high | annual |
| MGA.OPS.PLAYER_FUNDS.1 | Player funds segregation from operational accounts | financial limits | critical | monthly |
🇲🇽MX-SEGOB3 controls
Mexico · SEGOB
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| MX.SEGOB.PERMIT.1 | Operation under valid SEGOB permit (permisionario) | licensing personnel | critical | monthly |
| MX.SEGOB.AML.UIF.1 | Vulnerable activity reporting to UIF (SAT) | aml ctf | critical | monthly |
| MX.SEGOB.AGE.1 | Minimum age 18, INE/IFE ID verification | kyc identity | critical | continuous |
🇳🇱NL-KSA5 controls
Netherlands · Kansspelautoriteit (KSA)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| NL.KSA.CRUKS.1 | Cruks national exclusion register check at login | responsible gambling | critical | continuous |
| NL.KSA.NO_UNTARGETED_ADS.1 | Ban on untargeted advertising (TV, radio, public spaces) | marketing advertising | critical | weekly |
| NL.KSA.RG_DUTY.1 | Documented player intervention at risk thresholds | responsible gambling | high | hourly |
| NL.KSA.AGE.18_24_LIMIT.1 | Stricter limits for 18-24 age band | responsible gambling | high | daily |
| NL.KSA.CDB.1 | Real-time transmission of gaming data to CDB | reporting returns | high | continuous |
🇵🇪PE-MINCETUR5 controls
Peru · MINCETUR (Ley 31557)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| PE.MINCETUR.LICENCE.1 | MINCETUR online operating authorisation | licensing personnel | critical | monthly |
| PE.MINCETUR.TAX.1 | ISC tax (12% on GGR) remittance | reporting returns | high | monthly |
| PE.MINCETUR.AGE.1 | Minimum age 18, DNI verification | kyc identity | critical | continuous |
| PE.MINCETUR.RG.SE.1 | Self-exclusion register lookup | responsible gambling | high | continuous |
| PE.MINCETUR.SBS.AML.1 | Suspicious transaction reporting to UIF-Perú | aml ctf | critical | weekly |
🇵🇭PH-PAGCOR6 controls
Philippines · PAGCOR
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| PH.PAGCOR.LICENCE.1 | Valid PAGCOR licence (PIGO/IGL) for product offered | licensing personnel | critical | monthly |
| PH.PAGCOR.AML.1 | Casino threshold reporting (CTR) to AMLC at PHP 5M | aml ctf | critical | daily |
| PH.PAGCOR.KYC.1 | Government-issued ID verification at registration | kyc identity | high | continuous |
| PH.PAGCOR.RG.1 | Self-exclusion programme participation | responsible gambling | high | continuous |
| PH.PAGCOR.SEGREGATION.1 | Player funds segregated and reconciled monthly | financial limits | high | monthly |
| PH.PAGCOR.GEO.1 | PIGO operators: confine play to authorised Philippine territory | technical systems | high | continuous |
🇷🇴RO-ONJN3 controls
Romania · Oficiul Național pentru Jocuri de Noroc (ONJN)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| RO.ONJN.LICENCE.1 | Class I or Class II licence valid for product offered | licensing personnel | critical | monthly |
| RO.ONJN.SELF_EXCLUSION.1 | Self-exclusion register lookup | responsible gambling | high | continuous |
| RO.ONJN.GUARANTEE.1 | Player fund guarantee deposited with state treasury | financial limits | high | annual |
🇸🇪SE-SGA7 controls
Sweden · Spelinspektionen (SGA)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| SE.SGA.SPELPAUS.1 | Spelpaus.se lookup before every gambling session | responsible gambling | critical | continuous |
| SE.SGA.LIMIT.1 | Mandatory deposit AND loss AND time limit set before play | responsible gambling | high | continuous |
| SE.SGA.BONUS.1 | Bonuses limited to one welcome bonus per player per operator | marketing advertising | high | daily |
| SE.SGA.MARKETING.MODERATION.1 | Marketing must be moderate (måttfullhetskrav) | marketing advertising | high | weekly |
| SE.SGA.BANKID.1 | BankID identification at registration and high-risk events | kyc identity | high | continuous |
| SE.SGA.RG.CONTACT.1 | Operator care duty: contact at-risk players | responsible gambling | high | daily |
| SPORTSBOOK.RG.SE.SGA.1 | Spelpaus.se self-exclusion check at every bet placement | responsible gambling | critical | continuous |
🇸🇬SG-GRA4 controls
Singapore · Gambling Regulatory Authority
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| SG.GRA.LICENCE.1 | Class 1/Class 2 GRA licence active | licensing personnel | critical | monthly |
| SG.GRA.SELF_EXCLUSION.1 | National Council on Problem Gambling (NCPG) self-exclusion lookup | responsible gambling | critical | continuous |
| SG.GRA.SINGPASS.1 | Singpass (NRIC) identification at registration | kyc identity | high | continuous |
| SG.GRA.AML.STR.1 | Suspicious Transaction Report to STRO | aml ctf | critical | weekly |
🇬🇧UKGC19 controls
United Kingdom · UK Gambling Commission
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| UKGC.LCCP.SR.3.4.1 | Customer interaction with players exhibiting markers of harm | responsible gambling | critical | continuous |
| UKGC.LCCP.SR.3.5.1 | GAMSTOP integration for national multi-operator self-exclusion | responsible gambling | critical | hourly |
| UKGC.LCCP.SR.3.5.3 | Time-out facility (24h, 7d, 30d, 6w) | responsible gambling | high | continuous |
| UKGC.LCCP.SR.2.1 | AML risk assessment + customer due diligence threshold (£/€2,000) | aml ctf | critical | daily |
| UKGC.RTS.2A | Customer-led deposit limits, applied without delay (decrease) / with reflection (increase) | financial limits | high | continuous |
| UKGC.RTS.3 | Display net position and session time to player | responsible gambling | medium | hourly |
| UKGC.RTS.7A | RNG certification and game-cycle integrity | game fairness rng | high | monthly |
| UKGC.RTS.12 | Game rules, RTP, and house edge disclosed to customer | technical systems | medium | weekly |
| UKGC.RTS.14 | Slot design: no autoplay, max 2.5s spin, no losses-disguised-as-wins | responsible gambling | high | weekly |
| UKGC.LCCP.5.1.6 | Marketing: bonus T&Cs clear, no misleading claims, affiliate oversight | marketing advertising | high | weekly |
| UKGC.LCCP.15 | Regulatory Returns filed on time (quarterly + annual) | reporting returns | medium | quarterly |
| UKGC.LCCP.AFFORDABILITY.1 | Financial vulnerability checks at £125 net loss / £500 high-spend thresholds | responsible gambling | high | daily |
| UKGC.LCCP.SCV.1 | Participate in Single Customer View (SCV) data-sharing pilot/scheme | responsible gambling | high | daily |
| UKGC.LCCP.SR.3.5.4 | GAMSTOP sync — sync_status must be 'ok' on every check | responsible gambling | critical | hourly |
| UKGC.LCCP.SR.3.5.5 | Recent GAMSTOP exclusions must be blocked at next session | responsible gambling | critical | continuous |
| SPORTSBOOK.LIMITS.UKGC.AC.1 | Affordability checks at £125 net-loss-per-month trigger | financial limits | critical | daily |
| SPORTSBOOK.MARKETING.UKGC.CAP.1 | No marketing of sports betting to under-25s on social platforms | marketing advertising | high | weekly |
| SPORTSBOOK.RG.UKGC.SR.1 | In-play loss-chasing intervention prompts | responsible gambling | high | continuous |
| SPORTSBOOK.PAYMENT.CREDIT.UKGC.1 | Credit card deposits blocked | financial limits | critical | continuous |
🇺🇸US-IL-IGB4 controls
USA — Illinois · Illinois Gaming Board (IGB)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| US.IL.IGB.SPORTS.GEO.1 | Mobile sports wager: player physically in IL | technical systems | critical | continuous |
| US.IL.IGB.SPORTS.AGE.1 | Minimum age 21 for sports wagering | kyc identity | critical | continuous |
| US.IL.IGB.SE.1 | IGB self-exclusion list enforcement | responsible gambling | critical | continuous |
| US.IL.IGB.CASINO.FORTHCOMING.1 | Online casino licensing (forthcoming — placeholder) | licensing personnel | low | quarterly |
🇺🇸US-MI-MGCB4 controls
USA — Michigan · Michigan Gaming Control Board (MGCB)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| US.MI.MGCB.GEO.1 | Player physically located in Michigan during wager | technical systems | critical | continuous |
| US.MI.MGCB.AGE.1 | Minimum age 21 for internet gaming | kyc identity | critical | continuous |
| US.MI.MGCB.SE.1 | MGCB responsible gaming database integration | responsible gambling | critical | continuous |
| US.MI.MGCB.TAX.1 | iGaming tax (20-28% tiered) + sports betting tax (8.4%) | reporting returns | high | monthly |
🇺🇸US-NJ-DGE9 controls
USA — New Jersey · Division of Gaming Enforcement (DGE)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| US.NJ.DGE.GEO.1 | Player must be physically located in New Jersey at time of wager | technical systems | critical | continuous |
| US.NJ.DGE.AGE.1 | Minimum age 21 for casino/sports wagering | kyc identity | critical | continuous |
| US.NJ.DGE.SELF_EXCLUSION.1 | New Jersey Self-Exclusion List enforcement | responsible gambling | critical | continuous |
| US.NJ.DGE.RG.LIMITS.1 | Player-set deposit, spend, and time limits available | responsible gambling | high | continuous |
| US.NJ.DGE.AML.SAR.1 | Suspicious Activity Report (SAR) filing for casinos | aml ctf | critical | weekly |
| US.NJ.DGE.REPORTING.1 | Daily wagering and revenue reporting to DGE | reporting returns | high | daily |
| US.NJ.DGE.SERVER.LOCATION.1 | Gaming servers physically located in Atlantic City casino premises | technical systems | critical | monthly |
| SPORTSBOOK.GEO.STATE.1 | State-line geofencing for sports betting placement | technical systems | critical | continuous |
| SPORTSBOOK.MARKETING.NJ.DGE.1 | No college sports prop bets on individual student-athletes | technical systems | high | daily |
🇺🇸US-NV-NGCB3 controls
USA — Nevada · Nevada Gaming Control Board (NGCB)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| US.NV.NGCB.GEO.1 | Mobile/interactive wagering: player in Nevada | technical systems | critical | continuous |
| US.NV.NGCB.LICENSE.1 | Non-restricted gaming licence + interactive endorsement | licensing personnel | critical | monthly |
| US.NV.NGCB.AGE.1 | Minimum age 21 | kyc identity | critical | continuous |
🇺🇸US-NY-NYSGC4 controls
USA — New York · New York State Gaming Commission (NYSGC)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| US.NY.NYSGC.SPORTS.GEO.1 | Mobile sports wager: player physically in NY at wager time | technical systems | critical | continuous |
| US.NY.NYSGC.SPORTS.AGE.1 | Minimum age 21 for mobile sports wagering | kyc identity | critical | continuous |
| US.NY.NYSGC.SPORTS.SE.1 | NYSGC self-exclusion list enforcement | responsible gambling | critical | continuous |
| US.NY.NYSGC.CASINO.FORTHCOMING.1 | Online casino licensing (forthcoming — placeholder) | licensing personnel | low | quarterly |
🇺🇸US-PA-PGCB5 controls
USA — Pennsylvania · Pennsylvania Gaming Control Board (PGCB)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| US.PA.PGCB.GEO.1 | Player physically located in Pennsylvania at wager time | technical systems | critical | continuous |
| US.PA.PGCB.AGE.1 | Minimum age 21 | kyc identity | critical | continuous |
| US.PA.PGCB.SE.1 | PGCB Self-Exclusion List enforcement | responsible gambling | critical | continuous |
| US.PA.PGCB.TAX.1 | iGaming tax remittance (54% slots, 16% tables, 36% sports) | reporting returns | high | monthly |
| SPORTSBOOK.GEO.STATE.2 | Pennsylvania geofencing for sports betting | technical systems | critical | continuous |
🇿🇦ZA-NGB3 controls
South Africa · National Gambling Board (NGB)
| ID | Title | Category | Severity | Cadence |
|---|---|---|---|---|
| ZA.NGB.LICENCE.1 | Provincial gambling board licence (sports/horse racing) | licensing personnel | critical | monthly |
| ZA.NGB.FICA.1 | Suspicious transaction reporting to FIC | aml ctf | critical | weekly |
| ZA.NGB.SE.1 | National Register of Excluded Persons (NREP) lookup | responsible gambling | high | continuous |