AML/CFT technical standard – From joint development to certification
For several years, CIBELAE’s Technical Commission on the Prevention of Money Laundering and Terrorist Financing (AML/CFT) has been engaged in a collaborative effort aimed at strengthening prevention systems and fostering a genuine culture of integrity within Ibero-American lottery and gaming organizations.
Throughout this journey, CIBELAE has developed documents, guidelines, recommendations, and best-practice manuals, creating forums for exchange that allowed it to share experiences, identify common challenges, and learn from the diverse realities and maturity levels of its member organizations. A link to the documents is provided here: https://cibelae.net/comision-de-prevencion-de-lavado-de-activos/
However, this work led CIBELAE to consider a new challenge.
How could all that shared knowledge be embodied in a concrete, practical tool capable of fostering genuine institutional commitment to preventing money laundering and the financing of terrorism?
This need gave rise to the project to develop a certifiable standard known as CIBELAE’s “Technical Standard for the Prevention of Money Laundering and Terrorist Financing Applied to the Games of Chance Sector.” https://cibelae.net/estandar-tecnico-en-prevencion-de-lavado-de-activos/
The project
Creating the Standard represented taking a further step.
It meant moving beyond recommendations and best practices to the development of a common technical framework – specifically designed for our sector and adaptable to the diverse regulatory and operational realities of organizations across Ibero-America – while remaining aligned with the common framework of international recommendations and guidelines.
The Standard does not seek to replace the regulations of individual jurisdictions. On the contrary, it aims to complement and strengthen them by providing a common reference point that enables each organization to assess its prevention system, identify opportunities for improvement, and progressively advance toward higher levels of maturity.
CIBELAE’s objective
From the outset, it was clear that the goal could not simply be to create a new technical document, rather to develop a tool that could be put into practice.
A tool that would help organizations review their processes, strengthen their controls, identify gaps, and build internal capabilities, thereby fostering increasingly robust, risk-based, and proactive management.
The understanding was that the prevention of money laundering and terrorist financing should not be viewed merely as a compliance obligation.
It must be an integral part of our organizations' management, governance, and culture.
A progressive model: advancing through levels
A key aspect of CIBELAE’s AML/CFT Technical Standard is that it was conceived based on a logic of continuous evolution and improvement.
The organizations within the sector operate under diverse realities, structures, regulatory frameworks, and levels of maturity. Consequently, the Standard proposes a progressive pathway – structured into distinct certification levels – that enables gradual advancement in strengthening the prevention system.
Each level represents a new stage of development and maturity, introducing higher requirements and deepening the organization's capacity to identify, assess, manage, and mitigate its AML/CFT risks.
This structure ensures that certification is not viewed as an isolated event, but rather as part of a journey of ongoing evolution.
Level 1: The first step on a path of continuous improvement
Level 1 Certification holds special significance as it marks the formal starting point of this journey.
Its objective is to verify that the organization possesses the fundamental elements of an AML/CFT (Anti-Money Laundering/Countering the Financing of Terrorism) prevention system, and that these elements are not merely defined on paper but are actively integrated into the organization's management and operations.
Level 1 encourages organizations to conduct an initial, comprehensive review of their prevention system – examining policies and procedures, responsibilities, controls, training, documentation, and other components outlined in the Standard.
This exercise offers value that extends beyond simply obtaining a certification.
It enables organizations to organize and review their systems, identify strengths, and recognize gaps, thereby establishing a concrete foundation for further development – and, above all, demonstrating the leadership's commitment to this area.
Achieving this initial level signifies taking a verifiable first step and committing to continued evolution toward higher levels of maturity.
Level 2 deepens the implementation of the Standard by strengthening risk-based management, controls, procedures, monitoring, and the ability to demonstrate effective application. It goes beyond merely committing to a prevention system; it requires evidence that the system works and is managed consistently.
Level 3 represents the highest level of maturity and integration for the AML/CFT system. It entails advanced management characterized by effectiveness measurement, continuous improvement, innovation, and a preventive culture that is fully integrated into the organization.
From Standard to Certification
To ensure this commitment is recognized, the Standard includes a certification process that evaluates the degree of compliance with the requirements corresponding to the requested level.
The interested organization initiates the process and submits the information and documentation necessary to demonstrate the implementation of the various elements outlined in the Standard.
This is followed by an analysis and evaluation of the submitted evidence, making it possible to determine not only the formal existence of policies, procedures, and controls but also the extent of their implementation within the organization.
This point is fundamental: certification is not simply declaring compliance; it is the ability to demonstrate it.
Evidence transforms institutional commitment into something concrete, verifiable, and capable of improvement.
The Certification Committee
The CIBELAE Certification Committee plays a central role in this process.
Its involvement provides an institutional mechanism for analysis and evaluation designed to ensure the consistency, transparency, and rigor of the certification process.
Based on the relevant documentation, evidence, and evaluations, the Committee assesses compliance with the requirements established for the requested level and makes the appropriate decision regarding certification.
Thus, certification is not merely a form of recognition, but the outcome of a structured evaluation process backed institutionally by CIBELAE.
The Certification Committee also helps uphold one of the model's core values: that all organizations be evaluated against common criteria, regardless of the specific characteristics of each jurisdiction.
From creation to implementation
Once the Standard was developed, what was arguably the most important stage began: its implementation.
Implementation means transforming principles and requirements into concrete processes: reviewing our actions, recognizing what already works, identifying opportunities for improvement, and establishing a viable path for continued progress.
For this reason, the model was designed as a progressive process.
Not all organizations start from the same point or face the same risks. The challenge lies in each organization identifying its starting point and moving forward from there, continuously strengthening its prevention system.
The steps
The process begins with becoming familiar with and understanding the Standard, followed by an assessment of the organization against its requirements.
Based on this diagnosis, it is possible to identify strengths, gaps, and opportunities for improvement, make the necessary adjustments, and prepare the organization to move toward certification.
In this way, the Standard ceases to be merely a technical reference and becomes a tool for continuous improvement.
Certification: Turning Commitment into Evidence
CIBELAE’s Level 1 Certification under the AML/CFT Technical Standard represents the realization of that journey.
Today, the major challenge is to encourage CIBELAE member organizations to embark on this journey via Level 1 Certification; it should not be viewed merely as a goal to be reached, but as an opportunity to pause and examine how they operate.
It is a chance to question what is already in place, what we is being done well, what needs strengthening, and what evidence can be provided to substantiate the stated practices.
This review process generates value for the organization even before certification is actually obtained.
And when Level 1 Certification is finally achieved, it represents something very concrete: an institutional decision to translate the commitment to AML/CFT prevention into verifiable actions, processes, and evidence.
From that point on, the next challenge begins: continuing to move forward.
That is precisely the true purpose of a tiered model: ensuring that each certification serves not only as recognition of what has been achieved but also as a starting point for the next level of maturity.
Obtaining certification means demonstrating that a commitment to prevention translates into concrete policies, procedures, controls, and actions.
Above all, however, it means voluntarily embracing the challenge of reviewing practices and being willing to improve.
That is why CIBELAE views certification not as a final destination, but as the beginning of a process of continuous evolution.
Every organization that decides to embark on this path contributes not only to strengthening its own prevention system but also to raising integrity standards across our entire sector.
A shared commitment
What began as a concern within the Technical Commission evolved, through collaborative effort, into a concrete tool for CIBELAE member organizations.
Today, the challenge is to take the next step: putting the Standard into practice, implementing it, measuring performance, and obtaining certification.
For in the face of constantly evolving risks, the tools must evolve as well.
And because building organizations that are more principled, transparent, and prepared requires more than mere compliance: it requires commitment, continuous improvement, and, above all, the resolve to translate that commitment into concrete actions.
CIBELAE certification for preventing money laundering and terrorist financing on the digitalRG Platform
Background
CIBELAE, the Corporación Iberoamericana de Loterías y Apuestas de Estado, has developed its own Technical Standard for the Prevention of Money Laundering and Terrorist Financing (Estándar Técnico de Prevención del Lavado de Activos y Financiación del Terrorismo) (PLA/FT) and established a Certification Committee to assess member lotteries against it. Level 1 of the standard verifies that an applicant has the fundamental elements of an AML/CFT programme in place: a policy approved at the highest level, a designated compliance officer or committee, registration as an obligated entity where local law requires it, approved procedures, and plans for training and audit.
In 2026 digitalRG became a CIBELAE associate member. The CIBELAE process of certifation for preventing money laundering and terrorist financing (PLA/FT) is run on the digitalRG Platform. The arrangement mirrors the one digitalRG has had with the WLA since January 2024, under which applicants for Responsible Gaming certification submit their evidence and the Independent Assessment Panel conducts its review in the same place.
digitalRG’s role is to provide and operate the Platform, configure the standard within it, manage user accounts and automate notifications, certificate issue and renewal reminders. The standard, the assessment and the decision remain with CIBELAE.
What the Platform offers
For the applying lottery, the certification module presents Level 1 as eight areas: introduction, commitment, responsibility, registration, internal regulations, training, audit, and legal requirements (presentación, compromiso, responsable, registración, regulación interna, capacitación, auditoría and requisitos legales), preceded by general information about the entity.
Each area sets out the evidence expected, and the lottery uploads its documents and adds observations against each criterion. Work saves as it goes, so an application can be built over several sessions and by several people: sections can be assigned to owners, and earlier versions remain accessible.
For the certification committee, the Platform handles the assessment side. The coordinator decides which panel members may open each application, which is how declared conflicts of interest are enforced in practice: an excluded member simply cannot see the file. Members record their comments under their own accounts, so every evaluation is attributable. Requests for clarification, findings and the deadlines attached to them are recorded against the application rather than scattered across email threads.
Once CIBELAE approves, the Platform issues the certificate automatically, with its date and its sequential CIBELAE number, together with logos and communication materials the lottery can use. Certificates are valid for three years with an annual documentary update, and the platform sends renewal reminders six and three months before expiry. CIBELAE has a view of every application and certificate in the region, broken down by country and by level.
Beyond certification itself, lotteries that want to raise their standard can draw on the wider Platform: e-learning for staff and retail networks in Spanish and Portuguese, policy examples, benchmarks and case studies. These sit outside the certification module and are covered by a digitalRG membership.
How lotteries access it
Access to the certification module is included in CIBELAE membership at no additional cost, with two users per lottery.
A lottery begins by telling CIBELAE that it intends to certify. There are no submission windows; applications are received at any point in the year. digitalRG activates the lottery’s accounts and the Platform notifies CIBELAE that the process has started. CIBELAE Executive Direction confirms the lottery is in good standing before the work begins.
The lottery then completes the application form and uploads its evidence at its own pace. When it submits, the application locks and the committee is notified. Applications are taken in the order they arrive, and the lottery can see where its own submission stands throughout.
The committee reviews the evidence against the standard and may ask for clarification through the Platform. Findings are recorded in three categories: non-conformities, observations, and opportunities for improvement. Where observations are raised, the lottery has 60 days to resolve them. The committee then issues a technical report with its recommendation, and CIBELAE’s Executive Direction gives the final approval that releases the certificate. Recertification follows the same route.
Benefits
The clearest gain is a single, ordered evidence trail. AML documentation is typically spread across departments and formats; the module asks for it once, in a defined structure, and maintains the content. When recertification comes round three years later, the file is still there.
Guidance is attached to each requirement, in Spanish and Portuguese, so a lottery is not left guessing what evidence of an approved policy looks like in practice. Smaller lotteries, which may not have a dedicated compliance function, benefit from this most. Much of what Level 1 asks for already exists in a lottery that works on prevention; the difficulty is usually assembling, rather than creating the content.
The process is traceable on both sides. Lotteries can see where their application stands and what is being asked of them; the committee can show how a decision was reached, by whom, and on what evidence. Conflicts of interest are enforced through access control rather than good intentions, and confidentiality obligations apply throughout.
For CIBELAE, the arrangement gives a regional picture of which lotteries hold the certification, which are in progress, and which are approaching renewal. It also removes the administrative friction of running a certification scheme by correspondence.
For other Regional Associations, the point of interest is that the model is transferable. A regional standard, a certifying panel and a shared Platform can be put together without each association building its own submission system from scratch. The same digitalRG architecture now serves two different standards, WLA Responsible Gaming and CIBELAE PLA/FT, and could serve others.
More information: digitalrg.com
