AML and KYC for gaming and gambling: checks by product

Three dates mark how far gambling AML reaches today:

• 2003. The FATF brought casinos under its Recommendations.
• 2015. The EU's AML Directive defined gambling services as stakes with money value on games of chance "including those with an element of skill", poker among them. The AML Regulation keeps that wording from 10 July 2027.
• 9 September 2026. The FATF published risk indicators for casinos, other gambling and video gaming.

Casinos are designated non financial businesses and professions under FATF standards, and EU law adds every other gambling provider unless a member state exempts it for proven low risk. For a compliance team the useful question is narrower: in this product, which laundering method could move money without real play, and which record would show it?

Which gaming and gambling products do anti money laundering rules reach?

Table 1 sorts the checks by product, because each product gives money laundering its own route through the operator.

Table 1. AML checks by gaming and gambling product, as of November 2026

The land based row holds the largest cases, because a junket, an agent or a host stands between the casino and the money. Gaming machines show the plainest pattern. AUSTRAC's release of 21 May 2026 describes cash fed into poker machines, little or no real play and then a cash out, the same move FinCEN's 2015 Caesars assessment calls bill stuffing.

In the EU, the old difference between gaming and gambling, skill against chance, exempts nothing. In the US, the Bank Secrecy Act covers licensed casinos and card clubs with gross annual gaming revenue above $1 million (31 CFR 1010.100(t)(5) and (6)). Whether a fantasy contest or a social casino counts depends on whether national law treats it as gambling for money. The FATF project covered video gaming as well.

Why do criminals launder money through casinos, betting and online play?

A casino can turn cash into a payout that looks like winnings, and an online platform ties that payout to payment rails across borders. The FATF's release of 9 September 2026 names the methods: "using gambling platforms to move money without actually gambling", many small transactions to avoid detection, known as smurfing, and bets that are unusually large, or placed in concert, on events already flagged for possible competition manipulation.

Cash, digital wallets, mobile money and virtual assets all appear in the same release as payment methods open to laundering. It also ranks illegal gambling among the sector's most significant risks.

Older guides date the FATF's casino rules to 2009. The year is wrong. Casinos came under the FATF Recommendations in the 2003 revision, and the 2012 edition numbers the duties 22 and 28. The March 2009 study with the Asia/Pacific Group, "Vulnerabilities of Casinos and Gaming Sector", covered casinos with a physical presence and left online gaming and illegal gambling out of scope. The 2026 project is the FATF's first detailed study of both.

How should an operator assess and prevent money laundering risk?

Managing the risk starts with an assessment that scores the business before it scores any player. AUSTRAC's case against The Star, filed on 30 November 2022, alleged a failure to assess risks and to respond as they changed. Six inputs set the result:

1. Product. Every row of Table 1 carries its own signal, so the assessment lists each product the operator runs.
2. Channel. An online account opens without anyone at a counter. Since 29 September 2024, Australia has required online gambling providers to verify identity before an account opens.
3. Payment method. Cash and third party deposits hide who pays. That is the core of AUSTRAC's case against Entain.
4. Geography. Players and marketing offices abroad widen the exposure. Caesars ran branch offices in Hong Kong, Singapore and Tokyo whose marketing staff rarely, if ever, referred suspicious activity.
5. Partners and outsourced work. Junkets, agents, white label partners and outsourced AML work all sit inside the risk. In its case against Mounties, AUSTRAC says a club can outsource parts of its program but not its obligations.
6. Customer rating. Every player gets a rating, and the highest ratings trigger enhanced due diligence (EDD).

Online, the risk follows the payment mix. Review the assessment whenever a product, a payment method or a market changes, and do not wait for the calendar date.

What goes into a player KYC file, from customer identification to sanctions screening?

A player KYC file lets the operator answer two questions about any payout: who the player is, and where the money came from. Identifying the player and verifying that identity is customer due diligence (CDD) at its plainest. The file holds identity and ID verification (name, date of birth, address and a document check), an age check, the risk rating, the source of funds for players whose stakes outgrow their profile, the sanctions and PEP screening result, ongoing monitoring notes and each decision with its date.

The line where identification becomes mandatory differs from one gambling AML rulebook to the next. EU gambling providers identify at €2,000, single or linked, under the AML Directive today and under the AML Regulation from 10 July 2027. UK casinos identify at £2,000. Australian online providers verify before the account opens, while several Australian land based services start at A$5,000.

Picture a sportsbook customer (illustrative) whose $12,000 in winnings is due to a bank account in another person's name. Before the money moves, the file has to show whether the payee is the verified player, whether either name matches a sanctions or PEP list, and whether the source of funds on file explains the stakes. A payment to a designated person breaches sanctions law in every sector, so the payout is the operator's last chance to stop one.

complead, formerly Sanction Scanner, offers this screening to iGaming and gambling operators on lists covering 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. A player who is no longer relevant can leave rescreening, because an API trigger starts or ends ongoing monitoring per player. Each list type, and each single list, can carry its own match threshold.

Which controls does a gambling AML program run day to day?

The program starts with the KYC file. In practice, the rest is what gaming companies run every day after it, online and on the casino floor.

Monitoring compares what each player deposits, stakes and withdraws, so a deposit that is barely played and then withdrawn stands out. In complead, transaction monitoring rules are built without code, and every rule change keeps a version that records who changed it, when and for what reason.

Payouts are screened next. Payment screening checks the payer and the payee through the API while each transfer is still being processed.

Suspicion is reported whatever the amount under the UK's Proceeds of Crime Act and in the EU. US casinos must report suspicious transactions of $5,000 or more, conducted or attempted (31 CFR 1021.320), and may report smaller ones voluntarily.

Records cover every check. In complead the record of each screening search holds the search terms, the time, the result and the person who ran it, a no match result included.

Training goes to the people the money passes through. The Venetian's order of 20 August 2026 names independent agents, casino hosts, player development and marketing staff, and anyone with credit authority of $50,000 or more. The same order requires an outside, independent review that starts two years after approval and covers those two years.

How do you check a white label partner or game supplier?

Treat the partner as a customer. The FATF warns that platform ownership can be structured to stay under the thresholds for regulatory checks, and that software developers and other service providers may sit outside AML rules. complead's KYB and UBO verification confirms the partner against official registers and vetted sources, follows each ownership link upward until it reaches a natural person, and screens each party for sanctions, PEP, watchlist and adverse media hits. Whether a structure is acceptable remains a determination for your compliance function and counsel.

Which landmark casino cases changed what regulators expect?

Older retellings mix these cases up, so the dates, amounts and consequences below come from each regulator's or prosecutor's own release.

Las Vegas Sands, 2013. The Venetian's operator agreed on 27 August 2013 to return $47,400,300. Zhenli Ye Gon, later linked to drug trafficking, had wired about $45 million and deposited about $13 million in cashier's checks from 2005 to 2007, and prosecutors said the casino should have filed more suspicious activity reports. Source of funds on the biggest cash players is the check this case argues for.

Caesars Palace, 2015. FinCEN assessed $8 million. Guests in private gaming salons played on a patron's credit or front money, so some gambled anonymously, and a foreign patron put $50,000 in cash into the casino's Hong Kong bank account without anyone asking where it came from. Every player at the table needs an identity on file, the patron's guests included.

Crown, 2021 and 2023. The Bergin inquiry reported on 1 February 2021 that Crown was unsuitable to hold its Sydney license. On 11 July 2023 the Federal Court ordered Crown Melbourne and Crown Perth to pay A$450 million over two years. Crown had kept a junket operator until 2021 despite allegations of links to organized crime, and one junket's private room at Crown Melbourne saw at least 75 suspicious incidents involving about A$23 million in cash. Due diligence has to reach whoever brings the players in.

Wynn Las Vegas, 2024. The Wynn Resorts subsidiary forfeited $130,131,645 on 6 September 2024 and admitted using independent agents who acted as unlicensed money transmitters. The release also describes "Human Head" play, in which a proxy gambled for a patron who stayed out of sight. For the cage, the open question is who funds and directs the play.

Nevada and Mathew Bowyer, 2025 and 2026. Nevada's Gaming Control Board settled complaints tied to a bookmaker it calls illegal, with proposed fines of $10,500,000 on Resorts World (March 2025), $8,500,000 on MGM Resorts (April 2025, a complaint mostly about a second bookmaker) and $7,800,000 on Caesars (November 2025). The Gaming Commission's order of 20 August 2026 fined the Venetian $7,200,000. Front line staff who report a patron whose money may come from crime are what these orders keep asking for.

The Star, 2022 to 2026. In its 2022 case, AUSTRAC alleged that Star let customers move money through non transparent channels without understanding where it came from. On 2 June 2026 the NICC fined Star Sydney A$10 million, A$5 million of it for financial crime risk failures from July 2023 to September 2025, with a further A$5 million set aside for remediation. Payment channels belong in the risk assessment as much as players do.

Which gambling AML rules and orders are new in 2026?

Other 2026 changes that reach an operator's checks:

• 31 March 2026. Australia's reformed AML/CTF Act took effect. Under section 39E, a casino's services other than online gambling, on course bookmakers and state betting agencies, and gaming machines outside casinos need no initial customer due diligence for several services under A$5,000, unless enhanced due diligence applies.
• 21 May 2026. AUSTRAC ordered Bankstown District Sports Club to appoint an external auditor of its AML controls.
• 30 June 2026. The UK casino line moved from €2,000 to £2,000 (S.I. 2026/621).
• 3 July 2026. AUSTRAC finalized Sportsbet's enforceable undertaking after the bookmaker fixed its controls.
• 6 July 2026. bet365 entered an enforceable undertaking with AUSTRAC covering its risk assessment and how it detects and reports suspicious transactions.
• Next, 10 July 2027. From this date the EU AML Regulation applies directly, with the same €2,000 line.

Whether a payout waits for its screening result, or leaves first and is reviewed later, is the MLRO's call. In the Sands, Crown and Wynn cases, money reached the casino through someone other than the verified player, which argues for making the payout wait on every product line.

Sources and review. Fact checked by Laura Otterpohl, Compliance Manager at Candex; reviewed on 8 November 2026. The page rests on the FATF release of 9 September 2026, the EU AML Directive and Regulation, 31 CFR 1010.100 and 1021.320, the DOJ releases on Las Vegas Sands and Wynn Las Vegas, FinCEN's Caesars Palace assessment, AUSTRAC's releases on Crown, The Star, Entain, Mounties, Bankstown, online identification, Sportsbet and bet365, the NICC pages on the Bergin inquiry and The Star, the Nevada Gaming Control Board releases and the Venetian order, the AML/CTF Act and S.I. 2026/621, all opened on 7 November 2026.