> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anunnakielite.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Product updates and changes to the Currents compliance platform.

<Update label="June 8, 2026" description="KGC continuous-compliance series">
  Three additions that deepen Anunnaki's Kahnawake (KGC, permit #1039) regulatory coverage. All are **automatic for tenants** — keep calling the existing APIs; the new ingest and reporting run centrally. See the new [KGC Compliance](/api-reference/kgc-compliance) overview.

  ## New features

  * **KGC comprehensive self-exclusion ingest.** The KGC weekly master self-exclusion list is now ingested centrally and enforced **cross-tenant** — a player on the master list is blocked across every licensed brand. Reflected at [`GET /v1/exclusions/check`](/api-reference/self-exclusion), which matches KGC rows by default (new `include_kgc` toggle for diagnostics).
  * **AML rule R-009 — aggregate threshold.** Complements R-001 (single large withdrawal) by catching structured deposits and combined deposit/withdrawal/wager activity that crosses **USD 10,000 in aggregate** within a rolling window. See [AML Pattern Detection](/api-reference/aml).
  * **KGC regulatory reporting (s.28 + s.229A).** Threshold (\$10,000) and self-limitation reports are compiled centrally from the transactions and limit changes you already stream — no tenant action required.

  ## Updates

  * **Deposit Limits** changes are now recorded for KGC s.229A reporting, with no change to the API surface. See [Deposit Limits](/api-reference/deposit-limits).
</Update>

<Update label="June 5, 2026" description="Embeds, real vendors, and a security fix">
  This week we shipped the drop-in iframe embeds, swapped the sandbox stubs for production geo and sanctions vendors, and closed a security gap on the self-exclusion embed.

  ## New features

  * **Embeds (iframe forms).** Drop-in hosted forms for the user-facing responsible-gambling actions every operator needs. Add a single `<iframe>` tag to your site — Anunnaki hosts the form, validates input, persists the record, and fires webhooks. Two embeds are live: [Self-Exclusion](/embeds/self-exclusion) and [Deposit Limits](/embeds/deposit-limits). See [Embeds Overview](/embeds/overview).
  * **KYC withdrawal-completed endpoint.** New `POST /v1/kyc/withdrawal-completed` lets you notify Currents that a withdrawal cleared end-to-end so the player's cumulative-withdrawal counter can advance and trigger the right KYC tier on the next withdrawal. See [KYC](/api-reference/kyc).
  * **Email OTP on self-exclusion embed.** The self-exclusion iframe now requires the end-user to confirm a 6-digit code sent to their email before the exclusion is created. Two-step flow: `request` issues the code, `confirm` finalizes the exclusion. See [Self-Exclusion embed](/embeds/self-exclusion).
  * **Privacy Policy.** Version 1.0 of the Anunnaki Currents privacy policy is published, effective May 31, 2026. See [Privacy Policy](/privacy).

  ## Updates

  * **Cloudflare-backed geo resolution.** Geo lookups now use Cloudflare's `CF-IPCountry` header as the audit-grade source of truth, with the sandbox stub kept as a fallback for test traffic. Replaces the stub-only resolver shipped last week. See [Geo-Blocking](/api-reference/geo-blocking).
  * **OpenSanctions wired in.** Sanctions screening now calls the OpenSanctions API for OFAC, EU, and UN list matches, replacing the sandbox stub. Reviewer workflow and tipping-off discipline are unchanged. See [Sanctions](/api-reference/sanctions).
  * **Encryption at rest for KYC vendor tokens.** Vendor access tokens issued during KYC verification are now encrypted at rest with AES-256-GCM. Existing integrations require no changes. Satisfies the KGC at-rest-encryption requirement.
  * **Pakistan added to sandbox geo fixtures.** `PK` is now resolvable in the sandbox stub resolver so partners can exercise PK-routed traffic against the Geo-Blocking API.

  ## Bug fixes

  * **Self-exclusion embed could be abused to ban arbitrary emails.** The single-step submit flow trusted whatever email was in the request body, allowing anyone with the public iframe key to permanently self-exclude a third party. Fixed by requiring email OTP confirmation (see above). The legacy single-step endpoint now returns `410 Gone` with a pointer to the new flow.
</Update>

<Update label="May 29, 2026" description="Sandbox launch week">
  The Currents sandbox is live. This week we shipped the full set of six compliance APIs, along with the underlying tenant and authentication infrastructure.

  ## New features

  * **Self-Exclusion API.** Time-bound and permanent player self-exclusion with cross-tenant enforcement and KGC propagation. See [Self-Exclusion](/api-reference/self-exclusion).
  * **Deposit Limits API.** Player-set spending caps with regulator-mandated cooling-off on increases and rolling-window enforcement. See [Deposit Limits](/api-reference/deposit-limits).
  * **KYC API.** Five-tier identity verification keyed to cumulative-withdrawal thresholds, with vendor abstraction so you can swap providers without changing your integration. See [KYC](/api-reference/kyc).
  * **Geo-Blocking API.** Country-level and sub-region allow, restrict, and block enforcement with cached IP resolution. See [Geo-Blocking](/api-reference/geo-blocking).
  * **Sanctions Screening API.** OFAC, EU, and UN sanctions screening with FATF tipping-off discipline and a reviewer state machine. Matched entity details are never returned to operator-facing surfaces. See [Sanctions](/api-reference/sanctions).
  * **AML Pattern Detection API.** Eight-rule transaction-pattern engine with severity scoring and case lifecycle workflows. See [AML Pattern Detection](/api-reference/aml).

  ## Updates

  * **Tenant and API key infrastructure.** Multi-tenant accounts with scoped bearer-key authentication and a consistent error shape across every endpoint. See [Authentication](/authentication).
  * **Signed webhooks.** A unified webhook envelope with signature verification, exponential-backoff retries, and a tenant-scoped audit log. See [Webhooks](/webhooks).
  * **Backup and disaster recovery.** Automated backups and a documented recovery path now back the sandbox environment.

  ## Coming soon

  * Production cutover, rolled out per vendor on request.
  * MaxMind-backed geo resolution replacing the current stub resolver.
</Update>