Skip to main content
​
KGC continuous-compliance series
Three additions that deepen Anunnaki’s Kahnawake (KGC, permit #1039) regulatory coverage. All are automatic for tenants — keep calling the existing APIs; the new ingest and reporting run centrally. See the new KGC Compliance overview.

​
New features

  • KGC comprehensive self-exclusion ingest. The KGC weekly master self-exclusion list is now ingested centrally and enforced cross-tenant — a player on the master list is blocked across every licensed brand. Reflected at GET /v1/exclusions/check, which matches KGC rows by default (new include_kgc toggle for diagnostics).
  • AML rule R-009 — aggregate threshold. Complements R-001 (single large withdrawal) by catching structured deposits and combined deposit/withdrawal/wager activity that crosses USD 10,000 in aggregate within a rolling window. See AML Pattern Detection.
  • KGC regulatory reporting (s.28 + s.229A). Threshold ($10,000) and self-limitation reports are compiled centrally from the transactions and limit changes you already stream — no tenant action required.

​
Updates

  • Deposit Limits changes are now recorded for KGC s.229A reporting, with no change to the API surface. See Deposit Limits.
​
Embeds, real vendors, and a security fix
This week we shipped the drop-in iframe embeds, swapped the sandbox stubs for production geo and sanctions vendors, and closed a security gap on the self-exclusion embed.

​
New features

  • Embeds (iframe forms). Drop-in hosted forms for the user-facing responsible-gambling actions every operator needs. Add a single <iframe> tag to your site — Anunnaki hosts the form, validates input, persists the record, and fires webhooks. Two embeds are live: Self-Exclusion and Deposit Limits. See Embeds Overview.
  • KYC withdrawal-completed endpoint. New POST /v1/kyc/withdrawal-completed lets you notify Currents that a withdrawal cleared end-to-end so the player’s cumulative-withdrawal counter can advance and trigger the right KYC tier on the next withdrawal. See KYC.
  • Email OTP on self-exclusion embed. The self-exclusion iframe now requires the end-user to confirm a 6-digit code sent to their email before the exclusion is created. Two-step flow: request issues the code, confirm finalizes the exclusion. See Self-Exclusion embed.
  • Privacy Policy. Version 1.0 of the Anunnaki Currents privacy policy is published, effective May 31, 2026. See Privacy Policy.

​
Updates

  • Cloudflare-backed geo resolution. Geo lookups now use Cloudflare’s CF-IPCountry header as the audit-grade source of truth, with the sandbox stub kept as a fallback for test traffic. Replaces the stub-only resolver shipped last week. See Geo-Blocking.
  • OpenSanctions wired in. Sanctions screening now calls the OpenSanctions API for OFAC, EU, and UN list matches, replacing the sandbox stub. Reviewer workflow and tipping-off discipline are unchanged. See Sanctions.
  • Encryption at rest for KYC vendor tokens. Vendor access tokens issued during KYC verification are now encrypted at rest with AES-256-GCM. Existing integrations require no changes. Satisfies the KGC at-rest-encryption requirement.
  • Pakistan added to sandbox geo fixtures. PK is now resolvable in the sandbox stub resolver so partners can exercise PK-routed traffic against the Geo-Blocking API.

​
Bug fixes

  • Self-exclusion embed could be abused to ban arbitrary emails. The single-step submit flow trusted whatever email was in the request body, allowing anyone with the public iframe key to permanently self-exclude a third party. Fixed by requiring email OTP confirmation (see above). The legacy single-step endpoint now returns 410 Gone with a pointer to the new flow.
​
Sandbox launch week
The Currents sandbox is live. This week we shipped the full set of six compliance APIs, along with the underlying tenant and authentication infrastructure.

​
New features

  • Self-Exclusion API. Time-bound and permanent player self-exclusion with cross-tenant enforcement and KGC propagation. See Self-Exclusion.
  • Deposit Limits API. Player-set spending caps with regulator-mandated cooling-off on increases and rolling-window enforcement. See Deposit Limits.
  • KYC API. Five-tier identity verification keyed to cumulative-withdrawal thresholds, with vendor abstraction so you can swap providers without changing your integration. See KYC.
  • Geo-Blocking API. Country-level and sub-region allow, restrict, and block enforcement with cached IP resolution. See Geo-Blocking.
  • Sanctions Screening API. OFAC, EU, and UN sanctions screening with FATF tipping-off discipline and a reviewer state machine. Matched entity details are never returned to operator-facing surfaces. See Sanctions.
  • AML Pattern Detection API. Eight-rule transaction-pattern engine with severity scoring and case lifecycle workflows. See AML Pattern Detection.

​
Updates

  • Tenant and API key infrastructure. Multi-tenant accounts with scoped bearer-key authentication and a consistent error shape across every endpoint. See Authentication.
  • Signed webhooks. A unified webhook envelope with signature verification, exponential-backoff retries, and a tenant-scoped audit log. See Webhooks.
  • Backup and disaster recovery. Automated backups and a documented recovery path now back the sandbox environment.

​
Coming soon

  • Production cutover, rolled out per vendor on request.
  • MaxMind-backed geo resolution replacing the current stub resolver.