As far as I know, getting whitelisted is the only requirement. In my own testing that was the only thing I needed to do. I wasn't too clear in whether the process is fully automated or if there is some form of manual reviewing going on though.
I don't know if you strictly need to have existing traffic, but I think it weights in the review process, that is what I meant in the first post when I mention you need a "real" website. I am not sure what would happen in the case of submitting a brand new website that looks nice but has little to no exposure.
As for iframes, I tried this out myself to be sure what was going to happen. I did this by placing my whitelisted website in an iframe in another website I made which is not whitelisted.
The results where, interesting...
Initially it didn't work, as expected because the website iframing the original content was not whitelisted. But I found out that if I navigated in the iframe to other parts of the contained website, then ads started to work in it. I mentioned this to people at Google and they told me that shouldn't have worked. So I am thinking that at one point or another they will fix it.
DiegoM - is your whitelisted website in Wordpress? afaik Adsense only accept sites with the usual blog structure (with About Us, Contact, Privacy etc). Since C3 is not a site builder, then we all have to iframe it on a CMS?
H5AdsEngineer - would Adsense recognise if the site is submitted as a game rather than a blog website for whitelisting?