KYC, AML and sanctions screening, built into the platform.
Compliance automation an operator configures, not a vendor an operator is tied to.
This page sets out how compliance works in Callisto: how identity checks are routed to whichever KYC provider a brand uses, how players are screened against the official sanctions lists whether or not an AML vendor is connected, how risk rules and player risk scoring are configured, and where each of those stops.
One service for identity verification, screening and risk management.
Compliance in Callisto is a dedicated service rather than a feature bolted onto player management. It routes identity checks, screens players, measures risk against rules an operator writes, and holds the queue of work that comes out of all three.
KYC automation and identity verification
Identity checks are started from the platform and routed to whichever provider that brand uses. Documents, verification levels and requirements are set per brand, reviewer queues live in the backoffice, and withdrawals stay gated until a player is verified. Whether a player is verified is stored once, in player management — never as a second copy that can disagree with the first.
AML screening and sanctions screening
Every player is screened against the official sanctions lists at registration, again whenever a list changes under them, and once more when they finish verification. An external AML provider can be connected per brand for what the public lists do not cover; the built-in screening runs either way.
Configurable risk engine and player risk scoring
Transaction thresholds, daily totals, deposit and withdrawal velocity and a 0–100 player risk score, each scoped to the platform, a customer or a single brand. Rules are switched on and off independently, and a payout can be judged at the moment a player requests it rather than after the money has moved.
Compliance cases and audit trails
An alert says a rule fired; a case is the work that firing creates. Cases carry a type, a priority and a status, every decision writes down who took it and when, and reopening a closed case is recorded like any other move. The log is append-only and shares a transaction with the status it describes.
Built-in screening against the official sanctions lists.
Sanctions screening is the one compliance control an operator should not have to buy separately. The four consolidated lists are published free, and Callisto downloads, indexes and screens against them itself.
The US Treasury’s Specially Designated Nationals list.
The European Union’s consolidated list of sanctioned parties.
The United Nations Security Council consolidated list.
The UK’s consolidated list of financial sanctions targets.
When a player is screened
At registration
The obligation attaches to the customer relationship, and most players never open a KYC session at all — so screening waits neither for a first deposit nor for verification.
Whenever a list moves
The lists are refreshed nightly and held with a checksum. A player cleared last month is re-screened when the list they were cleared against changes.
After verification completes
A verified identity is a better thing to screen than a self-declared one, and a connected AML vendor has no opinion to give until its own applicant exists.
What the record says a year later
Each list version is stored with its date, its size and its fingerprint, so “cleared against OFAC as of 18 August” is a fact the platform can still produce when a regulator asks. A screening runs in milliseconds against an in-memory index, because a player finishing registration is waiting on it.
What a match does — and does not do
A match opens a compliance case carrying the list, the version and the score, for a person to review. Nothing is blocked automatically: sanctions lists are full of common names published without dates of birth, and an automatic refusal on one is a real customer turned away by a machine that had no way of being sure.
A player whose identity could not be read is recorded as not screened, with the reason — never as clear. Reporting an unfinished check as a clean result is the failure that distinction exists to prevent.
Your vendor, your contract, per brand.
The KYC provider and the AML provider are configuration, not architecture. Each brand picks its own vendor and holds its own contract and credentials; the compliance workflow, the queues and the audit trail stay inside Callisto.
A provider is a row, not a rewrite
A brand’s provider is chosen by a code in configuration and resolved brand → platform → manual review. Adding a vendor is a class behind one interface plus a row — no route changes and nothing above that seam moves.
Credentials belong to the operator
API keys, secrets and verification levels are stored per brand, encrypted, and never returned by the API — it will say that a key exists, not what it is. The contract with the vendor is the operator’s, as is the invoice.
Vendor verdicts arrive over a signed webhook
A vendor reports its verdict to one public endpoint, and the border is the vendor’s signature over the raw body rather than a platform key — an outside company never receives a credential that opens internal services. Retries are recognised by an index, because a retry is ordinary rather than exceptional.
Nothing unresolvable is left without a path
An unconfigured brand, an unresolved brand and a configured code this build does not implement all fall back to manual review, which is what every brand does today. Configuration outlives code, and the alternative is a brand whose players cannot start a check at all.
Callisto is not tied to a single KYC or AML vendor, and this page names none: which company a brand uses is that operator’s decision. A vendor path we have written but not yet run against a live account is described as exactly that when you ask.
Rules you write, scores you can explain.
The risk engine reads the platform’s own payment and game events, measures them against the rules an operator has configured, and raises an alert when one is passed. What it never does is act on its own: it says what it saw.
A score an operator can argue with
The player risk score is additive and fully enumerated — rule firings in the last 30 days, KYC status, account age, money out against money in, transaction bursts, and whether a player is transacting despite a responsible-gaming exclusion. Every alert carries the breakdown that produced it, frozen as it stood when the rule fired.
It is not a model that learns, and the page does not call it AI. An operator has to be able to explain the number to a player, and a score nobody can account for is one the operator cannot defend.
Unknown is not zero
A signal that could not be read contributes nothing and is named in the alert. An unreachable player service does not quietly make a player look verified.
Scoped where the rule belongs
Every rule applies to the platform, to one customer or to a single brand, and is enabled independently of being edited — so a stricter market carries stricter rules without a second deployment.
A separate service, and separate on purpose.
Responsible gaming answers to a different set of regulators than AML does, so it is its own service rather than a corner of the compliance one. Player-set limits, cool-off, self-exclusion and reality checks are enforced at login, at deposit and at every bet — and defaults cascade per brand and player category.
See the responsible-gaming controlsWhat the platform does — and what it does not.
Compliance is the area where an overstated capability costs the most, so the boundaries are on the page rather than in a footnote — and each one is verifiable in the source you receive.
A sanctions match does not block a player
It opens a case for review. Automatic refusal on a name match is a decision a machine is not equipped to take.
PEP screening is not built in
None of the four official lists publishes politically exposed persons, and no free list does. PEP and enhanced AML checks come from a provider you connect; their hits land in the same case queue.
The gaming licence stays yours
Callisto is software, not a licence, and no software vendor can provide, sponsor or share one. What the platform gives you is the controls, gates and audit trails a regulator asks about.
No vendor is presented as proven that has not run live
Where a provider integration is written against a published reference but has not yet completed a live run, we say so before you plan around it rather than after.
Compliance questions.
What operators and their compliance officers ask once the platform itself is no longer the question.
The OFAC SDN list, the EU consolidated list, the UN Security Council consolidated list and the UK OFSI consolidated list. All four are published free by the issuing authority; Callisto downloads them nightly, holds each version with a checksum and screens against an in-memory index, so a screening completes in milliseconds and remains provable a year later. An external AML provider can be added per brand on top of that, but the four lists run whether or not one is connected.
Yes — that is the design. A brand’s identity provider is a configuration row, resolved brand first, then the platform default, then manual review. Its credentials and verification level belong to that brand and are stored encrypted. Adding a provider that is not implemented yet is a class behind one interface, and the source is yours, so your own engineers can add it without waiting for us.
No. It opens a compliance case carrying the list, the list version and the match score, for a person to decide. Sanctions lists carry common names published without dates of birth, so an automatic refusal turns real customers away on the strength of a coincidence. What the platform guarantees is that the match is recorded, surfaced and auditable — the decision stays with your compliance team.
No, and deliberately not. The score is additive and fully enumerated from six signals — recent rule firings, KYC status, account age, money out against money in, transaction bursts, and transacting despite a responsible-gaming exclusion — and every alert carries the breakdown that produced it. An operator has to be able to explain the number to a player and to a regulator, which a model that learns does not allow.
Not from the built-in screening, because no official sanctions list publishes politically exposed persons. PEP and enhanced AML screening come from a third-party provider configured for that brand, and their findings arrive in the same compliance case queue as everything else. We would rather name this boundary than let a page imply coverage that does not exist.
Three ways, and none of them is a certificate. Every state change — a verification, a screening, a rule firing, a case decision — is written down with who did it and when, in an append-only log. Each screening names the list version it ran against. And you hold the source, so your compliance team can verify how a control is enforced rather than take a vendor’s word for it. The licence, and the responsibility for the market you operate in, remain yours.
Walk through it with your compliance officer.
The fastest way to judge compliance software is to have the person who will answer to the regulator ask the questions. Tell us which markets you operate in and what your current setup leaves you carrying by hand.
We reply within a day, usually the same one.