Player information is collected before an account is registered, and where the system or a third-party service performs registration and verification: only players of legal wagering age may register and an underage birth date is refused; identity is verified before any wager, authenticating at minimum legal name, physical address and age as the regulatory body requires, confirming the player is not on any operator or regulator exclusion list or otherwise prohibited, and keeping the verification details securely; the account becomes active only after age and identity verification, exclusion checks, acknowledgement of the privacy policy and terms and completion of registration; a player holds only one active account unless the regulator authorises more; and passwords, registration information and the financial account can be updated through a multi-factor authentication process.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.