Crucial Compliance
Product sources reviewedIdentity partially verifiedCrucial AML is a current, separately licensable gambling AML module. Crucial says it builds dynamic customer risk ratings from configurable flags, triggers, bundles, and markers, monitors behavioral and transactional patterns, and routes alerts into cases, audit trails, and regulator-facing reports.
Current Gibraltar government material and the active Crucial Compliance website identify Crucial Compliance Limited as the operating company. The government evidence supports the legal name but does not expose a company number, current registry status, directors, ownership, engagement signatory, invoice issuer or professional authorization, so the complete corporate and contracting identity remains partially verified.
Crucial AML
Multi ProductMixedAvailability: Standalone and BundledCrucial AML is a current, separately licensable gambling AML module. Crucial says it builds dynamic customer risk ratings from configurable flags, triggers, bundles, and markers, monitors behavioral and transactional patterns, and routes alerts into cases, audit trails, and regulator-facing reports.
Risk 360 is a real modular platform around the specialist products, not just an editorial umbrella. Its current product page includes CDD/EDD, case management, dashboards, reporting, and API integrations, and allows Crucial AML and Crucial RG to be licensed individually or operated together in a shared customer-risk view.
The software, workflow, and gambling-specific models are presented as Crucial products, while the AML page also refers to third-party data providers. Public materials do not identify the PEP, sanctions, identity, payment, or other data sources, their ownership, market coverage, update frequency, matching method, or contractual allocation of data responsibilities.
Integration: Crucial describes SaaS on its AWS environment, deployment in the customer's AWS environment, and on-premise deployment, with APIs into existing systems, CRMs, payment providers, and third-party data sources. A production agreement must define the selected modules and hosting model, source systems, fields, event timing, backfill, data providers, permitted use, thresholds, human review, audit access, retention, security, controller and processor roles, subprocessors, service levels, support, and exit. No public customer API specification or standard contract was found.
- Current Product Boundary
Crucial AML is currently presented as a distinct gambling AML module with behavioral and transactional monitoring, dynamic risk scoring, cases, audit trails, and reporting
Current vendor-described product scope; capability quality and outcomes were not independently tested
- Vendor Reported2026-07-11
- Modular Platform Boundary
Risk 360 includes CDD/EDD, case management, dashboards, Crucial AML, and Crucial RG, with AML and RG available as individual licenses
Current modular product structure; the customer order must identify which modules and shared services are included
- Vendor Reported2026-07-11
- Standard Implementation
The vendor reports 8 to 12 weeks for a standard Risk 360 implementation including mapping, calibration, integration, and training
Risk 360 estimate only; not a contractual SLA, universal timetable, or verified standalone AML implementation time
- Vendor Reported2026-07-11
- Deployment Options
Crucial describes SaaS on Crucial AWS, customer-AWS, and on-premise deployment with integrations to operator systems and third-party data providers
Public deployment options; architecture, security, support, and availability terms are contract-specific
- Vendor Reported2026-07-11
- Screening Data Boundary
Public pages refer to PEP, sanctions, SOF, payment, and third-party data integrations but do not identify providers, datasets, ownership, territories, refresh schedules, or matching rules
Current public documentation; the customer contract and data-source schedule must resolve the production configuration
- Unresolved2026-07-11
- Sar Workflow Boundary
Crucial says case data can support fast SAR generation, but public material does not establish automated approval, signature, authority-specific formatting, or electronic filing
Public product wording only; the operator and MLRO retain their reporting responsibilities unless applicable law and the signed workflow establish otherwise
- Unresolved2026-07-11
- Privacy And Data Roles
No public product DPA, subprocessor schedule, retention schedule, or settled controller and processor allocation was found
Public website review; obtain the current contract, DPA, security schedule, subprocessor list, and data-flow map before production use
- Unresolved2026-07-11
- Legal Identity Boundary
Current Gibraltar government material names Crucial Compliance Limited but does not establish its current registry status, company number, ownership, or the contracting entity for every deployment
Legal name only; obtain a current registry extract and customer contract before signing
- Independently Checked2026-07-11
Delivery options
A separately licensed Crucial AML deployment using the contracted SaaS, customer-AWS, or on-premise model, connected to the operator's selected data and review workflows.
- Operator license
- Operator
- Merchant of record
- Operator
- Player data controller
- Unknown
Included
- + Contracted Crucial AML flags, triggers, bundles, markers, and dynamic risk scoring
- + Behavioral and transactional monitoring against the data feeds defined in the agreement
- + Configured alerts, cases, audit trails, and reports
- + Risk 360 CDD/EDD, case management, and dashboards when included in the contracted configuration
- + The selected hosting model, integration work, calibration, and training stated in the order
Not included
- ! A gambling license or transfer of the operator's AML, MLRO, board, or reporting duties
- ! Crucial RG unless it is separately licensed
- ! Ownership, completeness, or universal availability of PEP, sanctions, SOF, identity, payment, or other third-party data
- ! Automatic SAR approval, signature, submission, or authority-specific electronic filing
- ! Unspecified markets, data sources, subprocessors, security controls, retention terms, or controller and processor roles
- ! A public fixed price, a guaranteed implementation SLA, or an 8-to-12-week promise for every standalone AML deployment
- ! Independently validated detection performance, false-positive reduction, or regulatory outcomes
- Launch time
- Crucial reports 8 to 12 weeks for a standard Risk 360 implementation, including data mapping, calibration, integration, and training
- + Current official pages separate Crucial AML from the responsible-gambling product and say each can be licensed individually.
- + The AML page describes gambling-specific monitoring logic, cases, audit trails, reports, and multiple deployment options.
- + Risk 360 has a concrete modular boundary that includes CDD/EDD, case management, dashboards, and optional combined AML and RG operation.
- + The public implementation description names mapping, calibration, integration, and training instead of presenting go-live as an undefined instant activation.
- ! The current public material does not name the PEP, sanctions, SOF, identity, payment, or other third-party data providers or document their ownership, coverage, refresh cadence, and matching logic.
- ! A claim that cases enable faster SAR generation is not proof of automated SAR approval, submission, regulator-portal connectivity, or an authority-specific filing workflow.
- ! No public customer API documentation, MSA, product DPA, subprocessor schedule, retention schedule, security certification, or settled controller and processor allocation was found.
- ! The 8-to-12-week figure is a vendor-reported standard Risk 360 implementation estimate, not a guaranteed SLA or necessarily the delivery time for standalone Crucial AML.
- ! No public independent validation establishes model accuracy, false-positive reduction, typology coverage, regulator acceptance, or customer outcomes.
- ! Current Gibraltar evidence supports the legal name but not a current registry status, company number, ownership table, contracting entity, or regulatory authorization.
- ! The operator, MLRO, and board retain final AML decisions, reporting duties, data governance, and license accountability.
- Government of GibraltarFilingchecked 2026-07-11— Current Gibraltar government material names Crucial Compliance Limited in proceedings dated March 2026. It supports the legal name, but does not establish a company number, current registry status, ownership, customer counterparty, or regulator authorization.
- Crucial ComplianceVendorchecked 2026-07-11— The current Crucial AML page describes dynamic customer risk ratings built from flags, triggers, bundles, and markers; behavioral and transactional monitoring; alerts, case management, audit trails, reports, SaaS and customer-hosted deployment, and integrations with operator systems and third-party data providers. PEP, sanctions, SOF, performance, and SAR language remains vendor-reported.
- Crucial ComplianceVendorchecked 2026-07-11— The current Risk 360 page presents a modular platform with Crucial RG, Crucial AML, CDD/EDD, case management, dashboards, audit trails, reports, and API integrations. It says RG and AML can be licensed individually and reports an 8-to-12-week standard Risk 360 implementation including data mapping, calibration, integration, and training.
- Crucial ComplianceVendorchecked 2026-07-11— The current technology index lists Crucial Risk 360, Responsible Gambling, Crucial AML, and the Crucial Regulatory System as distinct current offerings and describes SaaS, customer-infrastructure, and on-premise deployment options.
- Crucial ComplianceDirect Checkchecked 2026-07-11— The reviewed public page index and product pages did not expose customer API documentation, an MSA, a product DPA, a subprocessor schedule, named PEP or sanctions data providers, retention terms, a controller-processor allocation, a standard price, independent model validation, or authority-specific SAR e-filing documentation.
Crucial Gambling Compliance Consultancy
Multi ProductCompliance and RegulatoryFirst PartyAvailability: StandaloneCrucial Compliance currently operates separate consulting practices for gambling operators, platform suppliers, and regulators. Its operator scope includes audits, policies and governance, regulatory support, interim MLRO or PML cover, training, and mentoring.
Platform work covers compliance architecture, software assessment, data mapping, workflow design, integration support, gap analysis, and RG or AML model configuration. Regulator work covers policy, supervision, licensing frameworks, model review, reporting, and capability building.
Consultancy is available without buying Crucial software. Advice, an audit, or an interim resource does not make Crucial the operator, license holder, regulator, merchant of record, or permanent owner of the client's statutory duties.
Engagement and contracting boundary: The statement of work should name Crucial Compliance Limited, the client and any licensed entity, target jurisdictions, named consultants, qualifications, any required key-person or regulator approval, decision rights, data access, conflicts, subcontractors, deliverables, evidence standards, acceptance criteria, fees, liability, and handover. Software, regulated legal advice, audit independence, and interim regulated roles should be contracted separately where their duties differ. Public sources do not establish one team, fee, schedule, liability model, or data-role allocation for every engagement.
- Legal Identity
Current Gibraltar government material names Crucial Compliance Limited
Legal name only; obtain a current company-registry extract before contracting
- Independently Checked2026-07-11
- Current Service Boundary
Current services span audits, policies and governance, regulatory support, interim MLRO or PML work, training, platform integration, and regulator advisory
Current vendor-described consultancy scope
- Vendor Reported2026-07-11
- Technology Optional
Crucial says its regulator consultancy can be purchased without its technology platform
Regulator consultancy; software and consulting remain separate procurement decisions
- Vendor Reported2026-07-11
- Public Client Evidence
The current site attributes client or partner statements to William Hill Retail, BoyleSports, DAZN Bet, and eyeDP
Vendor-hosted statements; dates, contracts, deliverables, and outcomes were not independently audited
- Vendor Reported2026-07-11
- Public Commercial Terms
No standard public consultancy rate card or delivery timetable was located
Current public website index
- Independently Checked2026-07-11
Engagement models
Project consultancy, audit, training, regulatory support, or implementation advice delivered under an engagement-specific statement of work.
Included
- + The agreed audit, gap-analysis, policy, governance, or training scope
- + Regulatory and license-application support when contracted
- + Platform or regulator workstreams named in the engagement
- + Defined reports, action plans, workshops, and handover
Not included
- ! A gambling license, regulator decision, certification, or automatic approval
- ! Transfer of the operator's board, license, AML, or player-protection accountability
- ! Regulated legal advice unless separately supplied by an authorized professional
- ! Crucial software unless separately licensed
- ! Unspecified third-party services or guaranteed regulatory outcomes
- ! A universal public price or delivery schedule
Temporary MLRO, PML, or compliance leadership subject to the named jurisdiction's approval, delegated-authority rules, and the licensed operator's continuing accountability.
- Operator license
- Operator
- Merchant of record
- Unknown
- Player data controller
- Unknown
Included
- + The named interim role and approved duties
- + Documented authority, access, escalation, reporting, and availability
- + Regulator or key-person approval support where required
- + A replacement and handover plan to the operator's permanent role holder
Not included
- ! Transfer of the operator's license, board, AML, or player-protection accountability
- ! Merchant-of-record status, custody of player funds, or platform ownership
- ! Regulated legal advice unless separately supplied by an authorized professional
- ! Permanent staffing, Crucial software, or duties not named in the appointment
- + The current site separates operator, platform, and regulator consulting instead of presenting one undefined advisory service.
- + The operator practice covers multiple substantive audit, governance, regulatory, and training workstreams.
- + Consultancy can stand alone without a software purchase.
- + Current pages identify concrete deliverables and workflow areas rather than relying only on a generic gambling-industry claim.
- ! The current site describes team experience but does not publish a complete delivery roster with credentials and engagement roles. Require named personnel in the proposal.
- ! Interim MLRO or PML support cannot bypass operator governance, personal-license rules, statutory accountability, or regulator approval.
- ! Serving both operators and regulators creates potential independence and information-conflict issues. Require conflict disclosure, information barriers, and restrictions on client-data reuse.
- ! The public site does not expose an MSA, DPA, subprocessor schedule, professional-indemnity evidence, fee basis, or standard timetable.
- ! Vendor-hosted client statements establish a reported relationship, not independently measured outcomes or a guaranteed current scope.
- Government of GibraltarFilingchecked 2026-07-11— The current government index names Crucial Compliance Limited in Gibraltar proceedings dated March 2026. This supports the legal name, not a company number, shareholder record, beneficial-ownership conclusion, or regulator authorization.
- Crucial ComplianceVendorchecked 2026-07-11— The current operator page documents RG and AML audits, policy and governance work, regulatory submissions and license applications, interim MLRO and PML cover, training, and mentoring.
- Crucial ComplianceVendorchecked 2026-07-11— The current platform page documents compliance frameworks, software assessments, gap analysis, API and data-mapping support, workflow design, and RG and AML model configuration.
- Crucial ComplianceVendorchecked 2026-07-11— The current regulator page documents policy and guidance drafting, supervision and audit programs, licensing frameworks, model review, reporting design, and training. It says consultancy can stand alone without the software platform.
- Crucial ComplianceVendorchecked 2026-07-11— The current page carries named statements attributed to William Hill Retail, BoyleSports, DAZN Bet, and eyeDP. These establish vendor-presented engagement evidence, not independently measured scope, currency, or outcomes.
- Crucial ComplianceDirect Checkchecked 2026-07-11— The current public page index exposes product, consultancy, contact, and demo pages but no customer MSA, DPA, subprocessor schedule, professional-indemnity evidence, standard rate card, or standard consultancy timetable.
Crucial Compliance License Application Support
Multi ProductFirst PartyAvailability: StandaloneCrucial Compliance has a current operator consultancy that explicitly includes license applications, regulatory submissions, operational and control audits, policy work, and governance support. This module covers that application-readiness and filing-support slice rather than the company's wider software, regulator, or interim compliance practice.
The useful distinction is between preparing an applicant and issuing a license. Crucial can assess controls, organize evidence, draft or support submissions, and help remediate gaps, but the client remains the applicant and the public regulator retains every approval, condition, key-person, and enforcement decision.
The public site does not publish a jurisdiction matrix, standard application package, lawyer roster, fee schedule, outcome record, or delivery timetable. Those missing terms prevent ranking by speed or success and must be resolved in the statement of work.
Integration: The statement of work should name Crucial Compliance Limited, the applicant and licensee, regulator, license class, products, markets, named consultants and qualifications, independent legal counsel, regulator-portal authority, key persons, control and evidence baseline, data access, documents and policies, deliverables, acceptance criteria, milestones, official and professional fees, assumptions, dependencies, conflicts, software boundary, third parties, privilege, data roles, liability, rejection and remediation scope, continuing support, and handover. No public source establishes one jurisdiction list, standard fee, approval time, success rate, or universal legal-advice model.
- Legal Identity
Current Gibraltar government material names Crucial Compliance Limited
Legal name only; obtain a current company-registry extract and professional details before contracting
- Independently Checked2026-07-12
- License Application Scope
The current operator consultancy explicitly includes license applications, regulatory submissions, audits, policies, governance, investigation support, and interim compliance work
Current vendor-described application and compliance support, not regulator-confirmed outcomes
- Vendor Reported2026-07-12
- Regulator Boundary
Crucial separately advises regulators on licensing frameworks and supervision, while operator application support remains a client-side service
Current vendor-described service boundary; require conflict checks and information barriers for each engagement
- Vendor Reported2026-07-12
- Public Terms Gap
No public customer MSA, DPA, subprocessor schedule, standard rate card, or application timetable was located in the current page index
Current public website only
- Independently Checked2026-07-12
Delivery options
A scoped application-readiness, regulatory-submission, and remediation engagement delivered alongside the applicant's legal, operational, and technical owners.
- Operator license
- Operator
- Merchant of record
- Operator
- Player data controller
- Unknown
Included
- + The agreed licensing-readiness audit and action plan
- + Application or regulator-response documents assigned to Crucial
- + Policy, governance, training, or remediation work expressly ordered
- + Reporting, workshops, and handover deliverables named in the scope
Not included
- ! The gambling license, regulator decision, certification, or guaranteed result
- ! Legal advice unless a qualified authorized professional is separately named
- ! Crucial software, interim statutory roles, or continuing compliance unless separately contracted
- ! Transfer of board, key-person, AML, player-protection, or market-access accountability
- ! Unspecified third parties, fees, jurisdictions, or application deadlines
- + The current operator page names concrete application, audit, policy, governance, and regulatory work rather than a generic license promise.
- + Crucial can connect application preparation to the compliance controls that the licensed business must operate after approval.
- + Licensing support is separable from the company's software platform and broader regulator consultancy.
- ! The public site does not identify one complete jurisdiction list, local-counsel model, standard application package, fee basis, or timetable. Do not assume coverage from general regulatory language.
- ! Crucial serves operators, platforms, and regulators. Require matter-specific conflict disclosure, information barriers, and restrictions on reuse of confidential application material.
- ! Interim MLRO or personal-license work can require regulator approval and does not transfer statutory accountability from the applicant's board or approved people.
- ! Keep legal opinions, independent audit or certification, software licensing, and application consultancy in separate scopes when their independence or responsibility differs.
- Government of GibraltarFilingchecked 2026-07-11— The current government index names Crucial Compliance Limited in Gibraltar proceedings dated March 2026. This supports the legal name, not a company number, shareholder record, beneficial-ownership conclusion, or regulator authorization.
- Crucial ComplianceVendorchecked 2026-07-11— The current operator page documents RG and AML audits, policy and governance work, regulatory submissions and license applications, interim MLRO and PML cover, training, and mentoring.
- Crucial ComplianceVendorchecked 2026-07-11— The current regulator page documents policy and guidance drafting, supervision and audit programs, licensing frameworks, model review, reporting design, and training. It says consultancy can stand alone without the software platform.
- Crucial ComplianceDirect Checkchecked 2026-07-11— The current public page index exposes product, consultancy, contact, and demo pages but no customer MSA, DPA, subprocessor schedule, professional-indemnity evidence, standard rate card, or standard consultancy timetable.
Crucial RG
Multi ProductFirst PartyAvailability: Standalone and BundledCrucial RG is the current separately licensable responsible-gambling module from Crucial Compliance. The vendor says its Markers of Harm logic analyzes submitted player patterns such as spend, session time, deposits and safer-gambling-tool use, assigns dynamic risk scores, segments players, and routes configured interactions, marketing suppression, cases, and audit records.
The same module can be deployed inside Crucial Risk 360. Risk 360 is a real modular combined platform, not merely a label: the current page lists CDD/EDD, case management and dashboards as platform components and says Crucial RG and Crucial AML can be licensed individually or together.
This record verifies the current product and documented workflow boundary, not the accuracy of the proprietary Markers of Harm model, regulatory sufficiency, a universal intervention policy, or reduced gambling harm. The operator must approve inputs, thresholds, automation, human review, customer contact, account actions, evidence retention, and market-specific controls.
Integration: Crucial documents hosted SaaS on its AWS environment, deployment in a customer's AWS environment, and on-premises installation, with APIs connecting operator data flows, CRM systems, and agreed third-party providers. The implementation must define every input, source and refresh cycle; score and threshold; automated and human action; CRM and case handoff; hosting region; controller and processor role; retention period; model change; test and acceptance rule; incident path; and jurisdiction-specific responsibility. The published 8-12 week estimate applies to a vendor-described standard Risk 360 implementation and is neither a guaranteed SLA nor a verified timetable for standalone Crucial RG.
- Current Product Boundary
Crucial RG is currently presented as a separately licensable responsible-gambling module for operators and platform suppliers
Current vendor product and packaging claim; not model-performance or regulatory-effectiveness evidence
- Vendor Reported2026-07-11
- Documented Workflow
The vendor documents behavior-pattern analysis, dynamic scores, player segmentation, configured interactions, marketing suppression, case creation, and audit logging
Published functional scope; exact inputs, thresholds, actions, and automation remain deployment-specific
- Vendor Reported2026-07-11
- Risk360 Boundary
Risk 360 is a modular combined platform with CDD/EDD, case management and dashboards, while Crucial RG and Crucial AML can be licensed individually
Current vendor packaging; no universal order content or price is inferred
- Vendor Reported2026-07-11
- Risk360 Implementation Estimate
Crucial reports 8-12 weeks for a standard Risk 360 implementation including data mapping, calibration, integration, and training
Standard combined Risk 360 implementation only; not a guaranteed SLA or standalone Crucial RG commitment
- Vendor Reported2026-07-11
- Current Integration Evidence
GiG's 2025 annual report says it integrated Crucial Compliance for AML and responsible-gaming capabilities
Supplier integration only; module version, contract, configuration, outcomes, and downstream actions were not disclosed
- Independently Checked2026-07-11
- Model Validation
No public independent validation report was located for the current Markers of Harm model
Current public sources; request version-specific validation, threshold, population, and error evidence
- Unresolved2026-07-11
Delivery options
A separately licensed Crucial RG module deployed through Crucial-hosted SaaS, customer-controlled AWS, or on-premises infrastructure and integrated with agreed player-data and CRM flows.
- Operator license
- Operator
- Merchant of record
- Operator
- Player data controller
- Unknown
Included
- + The contracted Crucial RG software and configured Markers of Harm workflow
- + The agreed player-data mapping, risk segments, thresholds, cases, actions, and audit records
- + The contracted hosted, customer-AWS, or on-premises deployment route
- + Training and integration work expressly included in the order
Not included
- ! The operator's gambling license, safer-gambling policy, statutory accountability, and final player decision
- ! Crucial AML, CDD/EDD, third-party checks, or the full Risk 360 bundle unless separately contracted
- ! Independent validation of model accuracy, bias, false positives, false negatives, or harm reduction
- ! Unapproved automatic communication, limits, suspension, closure, self-exclusion, or treatment referral
- ! A universal data-controller allocation, market approval, public price, or guaranteed implementation SLA
- + The current site gives Crucial RG its own product and deployment boundary instead of requiring the full AML bundle.
- + The documented workflow connects risk segmentation to configured cases, actions, suppression, and audit records.
- + Hosted, customer-AWS, and on-premises routes allow different infrastructure and data-residency choices.
- + GiG independently reports a current integration of Crucial responsible-gaming and AML capabilities.
- ! Markers of Harm, dynamic scores, and vendor claims of a proven model are not independent evidence of accuracy, bias control, fewer false positives, fewer false negatives, or reduced harm. Validate the exact model version and population.
- ! Automated interactions, marketing suppression, case creation, and other actions require operator-approved thresholds, lawful basis, human-oversight rules, exception handling, and market-specific governance.
- ! Risk 360's 8-12 week figure is a vendor estimate for a standard combined implementation, not a guaranteed contractual SLA or a standalone RG timetable.
- ! The public sources do not expose a product DPA, subprocessor schedule, complete API reference, security-certification record, universal controller allocation, fixed price, or full market matrix.
- ! Confirm whether each third-party data source, CDD/EDD check, communication channel, case workflow, and dashboard is included in the actual order; a Risk 360 description does not make every component part of Crucial RG.
- ! The operator remains responsible for player interaction, limits, suspension, closure, self-exclusion, referral, record quality, and the defensibility of every final decision.
- Crucial ComplianceVendorchecked 2026-07-11— The current product page identifies Crucial RG as a Responsible Gambling module. It describes vendor-defined Markers of Harm using spend, session time, deposit and tool-use patterns, dynamic scores, player segmentation, configured interactions, marketing suppression, case creation, audit logging, API integration, and hosted, customer-AWS, or on-premises deployment.
- Crucial ComplianceVendorchecked 2026-07-11— The current Risk 360 page presents a real modular platform containing CDD/EDD, case management and dashboards by default, with Crucial RG and Crucial AML available individually or together. It gives a vendor-reported 8-12 week estimate for a standard Risk 360 implementation, not a guaranteed SLA or a standalone Crucial RG timetable.
- GiG Software P.L.C.Filingchecked 2026-07-11— GiG's 2025 annual report says it integrated Crucial Compliance to enhance AML and responsible-gaming capabilities through behavioral analysis and automated risk scoring. This independently confirms a current supplier integration, not the exact module configuration, model performance, player outcomes, or every downstream action.
- Crucial ComplianceDirect Checkchecked 2026-07-11— The current public page index exposes the RG, AML, Risk 360, regulatory-system, consultancy, contact, and demo pages but no public product DPA, subprocessor schedule, complete API reference, model-validation report, security-certification record, standard price, or universal market matrix.
