On February 7, 2024, the US Department of the Treasury (DOT) published the 2024 National Risk Assessments on Money Laundering, Terrorist Financing, and Proliferation Financing. The reports highlight the most significant illicit finance threats, vulnerabilities, and risks facing the United States. National Risk Assessments are used by regulators and lawmakers as a basis for developing anti-money laundering action plans and policies and ensures a common understanding of the relevant risks among all stakeholders including the private sector.  

The National Money Laundering Risk Assessment (NMLRA), one of the reports released February 7, was highly critical of the gaming industry and included a dedicated “special focus" section on online gaming. In fact, this was the first NMLRA to include a dedicated section on gaming, showing the heightened concern of money laundering in the gaming space by the US government.

The following are some of the key findings and our analysis.  

Key Findings

Explosive Growth in Land based and Online Gaming: the gaming industry has expanded considerably in recent years with record-breaking revenue numbers, which raises the risk profile of gaming operators in the United States. The growth has also led to an influx in new entrants with less experience and knowledge of AML risk management, raising the risk profile of the gaming industry even more.  

Casinos Need to Take Proactive Action When Risks are Identified: the report noted that “federal and state law enforcement underscored the extent to which covered casinos and card clubs may be fulfilling their required obligations, including SAR and CTR filings, but not taking other forms of proactive risk-based action against suspected money laundering.” The implication is that AML compliance is not simply a check- the- box exercise of filing reports but should be a proactive regime in helping law enforcement identify and provide information on bad actors.

Inconsistent Regulation: the sophistication and resourcing of regulatory regimes (federal, state, tribal, and territorial) for gaming operators vary considerably. This variation may create opportunities for illicit actors to target jurisdictions or spread activity across jurisdictions to launder money (jurisdictional arbitrage). Additionally, the size, volume of cashflow, location, customers, clientele, and games and services offered vary, further complicating regulatory regimes and risk management.

Inconsistent Licensing – Games of Skill and Casino-like Activity: there are continuing challenges with AML supervision of some operators who engage in casino-like activities, but are not licensed as casinos and therefore are not necessarily subject to Bank Secrecy Act (BSA) obligations. These operators include online platforms, firms offering “games of skill,” and third-party operators that engage in casino-like activities.  

Misuse of Casino Services: standard business services can be misused by customers to conduct illicit activities. Some of the schemes the NMLRA details include:

• Money Transmission Schemes: Some illicit actors engage in transfers wherein they deposit funds at a foreign location of a US gaming operator and then access the funds at a US location of the same casino operators – either in cash, chips, or through a line-of-credit vehicle, allowing them to bypass regulated wire transfer or money transmission regulations. While this risk is global, the risk assessment  specifically detailed the risk of international money movement from China to the United States for high net-worth individuals. These money transmission schemes often include chip walking, structuring, and minimal gaming activity with large deposits or withdraws.  
• Growth of Chip Walking, Structuring, and Minimal Gaming: gaming operators filed a record number of SARs relating to chip walking and a six-year record of SARs relating to structuring and minimal gaming with large transactions in 2022. The risk assessment used these stats as an indication of the increasing risk of customers misusing casino services for money transmission schemes. The risk assessment also specifically pointed out the risk of chip walking in denominations lower than casinos typically track (lower than $5,000).  
• Other schemes: the risk assessment included the following additional schemes of concern: money mule networks, misuse of lines of credit to avoid CTR filings, and the misuse of private gaming salons.  

Online Gaming: the variations of online gaming received special attention in the risk assessment with special concern around sports betting, offshore sports betting, and virtual asset gambling. In addition to similar AML risks faced by land-based casinos, online gaming faces other risks identified by the NMLRA. The rapid growth of the sector in itself is viewed as a risk, as well as the varying degree or inconsistency of state-by-state regulations. In addition, bad actors can be afforded further anonymity due to the lack of face-to-face interactions with gaming operators.

• Online sports betting: most sports betting activity in the United States occurs via online or mobile gaming platforms. These platforms generally operate either as third-party operators entering a licensing agreement with a casino or by directly acquiring an online gaming operator license without an affiliation to a land-based casino. Both models create AML/CFT compliance challenges and opportunities to launder illicit proceeds.  

The following are areas of specific concern for the US government:

• Online gaming platforms may not have robust AML controls
• Betting platform  and service providers, not directly licensed as casinos, can be unaware of BSA obligations as a provider for Casinos.
• Regulated casinos may have limited visibility into potential criminal activity occurring on its third-party operator’s services

• Online gaming operators who are not licensed may fall under the definition of a money transmitter and be unaware of their BSA/AML obligations

The risk assessment is clear that these factors, in addition to the volume of the betting activity, the rapid growth of the sector, and the lack of uniform requirements or regulations of these services across state, territorial, and tribal jurisdictions, present significant and increasing money laundering risks.

• Offshore online gaming: illegal sports betting is prevalent in the United States. Industry reporting suggests that Americans wager an estimated $64 billion annually on illegal or offshore gaming platforms, accounting for 40 percent of the U.S. sports betting market. Many illegal sports betting platforms are based in foreign jurisdictions with deficient regulatory frameworks yet actively advertise to U.S. consumers and markets.  

• Virtual asset gambling: Large, transnational virtual asset gambling firms have grown rapidly since 2020, driven by increases in the adoption of virtual assets as well as the anonymity provided by the technology. In 2019 guidance, FinCEN clarified that gaming operators and internet casinos that are not covered by the regulatory definition of casino, gambling casino, or card club but that accept and transmit virtual assets may still be regulated under the BSA as a money transmitter. Many of these large virtual asset gambling firms screen users by location, but users can easily spoof these controls by using a VPN.  

Analysis

The NMLRA’s message is clear: the growth of the industry equates to an increased money laundering risk that needs to be addressed. This national risk assessment is an acknowledgement that the gaming industry is rapidly growing in both land based and online gaming spheres with record-breaking revenues, innovation, new products / services, and new entrants into the space. Furthermore, the assessment does our industry a favor by identifying specific areas of risk we should address to grow responsibly.  

Kinectify has the privilege of working across a wide range of gaming AML teams across North America. This is our analysis of some important points made in the NMLRA in more practical terms for operators to consider:

Market Access Agreements (MAA): MAA’s are commonplace in our industry for sports betting and iGaming and they present a significant AML risk. Many gaming attorneys  interpret AML laws and regulations as either not covering the market access partner or as imposing no obligations to sharing of data (transactions, SARs, etc.) between the casino and online operator. This interpretation presents a significant AML risk to both the online operator and the licensed casino. The NMLRA suggests the AML obligations of the licensed casino extend to the online operator via the commercial agreement, regardless of how the commercial agreement is worded. The AML obligations must be clearly met and limiting data sharing and AML cooperation inhibits the meeting of these obligations.

In simple terms, casinos are at significant AML risk if they delegate their AML program to an online gaming provider and have no visibility or access to their data to oversee and manage its AML obligations. The same holds true for the online operator - the AML obligations extend via the commercial agreement and the online operator is fully obligated to adhere to all AML regulations.  

Gambling-like products: the industry is now saturated with gambling-like games that creatively avoid gaming licensure. These products range from skilled-based games, sweepstakes games, daily fantasy sports offerings similar to sports betting, slot machines classified as lottery products or other non-slot products, free-to-play or non-real money games that use virtual currency or meta-verse casinos which can through some mechanism be redeemed or converted into real money.. The NMLRA correctly identifies that most of these types of gaming products carry money laundering risk, putting the industry at increased money laundering risk as these products proliferate without proper controls and AML risk management.

Non-licensed operators unknowingly operate as MSBs (Money-Services Businesses): Many upstart companies or growing companies that have a product that are not licensed as a gaming product, but that transmit money, are  likely money services businesses (MSBs), which are  covered under the BSA with AML obligations along with a range of other compliance obligations. Many startups and even mature free-to-play, skilled-based games, creative slot-like products, and various offshore licensed gaming institutions may actually be an MSB with a range of compliance obligations including AML.  

Lack of automation in online gaming and AML monitoring: the sports betting industry grew so rapidly over the past three years that AML did not keep up. At launch, no AML technology providers had products for online gaming, . This gap compelled online gaming operators to rapidly expand into new jurisdictions across the US. To navigate this, states opened their markets and simply added human resources with the help of some custom reporting from their IT departments and an extensive use of excel spreadsheets.  

The current state of AML risk management is untenable in online gaming. The NMLRA is incredibly concerned about this, dedicating an entire section to detailing how these online operators may not have adequate AML monitoring capabilities, causing significant AML risk to their own operators and to the casinos to which they provide services. Humans using manual processes or inadequate software cannot monitor 32 million transactions and wagers daily, which is the estimated volume of top online operators in the United States. Online gaming operators are expensing significant human resources, using manual processes, and using ill-suited banking AML technology, which exposesing them as well as their casino operation partners to significant AML risks. Simply put, their current AML technology does not align with the size and complexity of their online gaming operations.  

Inconsistent regulation: the NMLRA details the varying sophistication and resourcing of regulatory regimes covering gaming operators at the federal, state, tribal, and territorial level including all types of gaming from card clubs to casinos to online gaming. Across the United States, we see some gaming commissions have robust AML teams that actively audit gaming organizations while others have no resources dedicated to gaming with a whole range of resource allocation in-between.  

The regulations at the state level vary on what constitutes a licensed gaming operation, as well as the resources and training of the local regulator. This creates the opportunity for illicit actors to target jurisdictions with weaker controls or to run certain schemes across jurisdictions (jurisdictional arbitrage).  

We encourage groups like GLI Academy and the GLI Roundtable that trains gaming regulators and provides a forum for more effective and harmonious regulations across jurisdictions. We also encourage broad regulations that support best practices like risk scoring of players, conducting EDD, monitoring transactions for suspicious activity, and similar pillars of best AML practices. We discourage the legacy practice of licensing technology providers thereby establishing monopolies that discourage technological innovation, competition, and best practices. Regulations that are prescriptive, or specific to technical products that regulators are already aware of, do not encourage good compliance practices because methods should evolve as technology evolves and regulators should focus on establishing frameworks that encourage this evolution. A regulatory regime around technology needs to be flexible and dynamic to allow for innovation and evolution as risk typologies change.

Willful Blindness and Chinese Money Laundering Organizations (CMLO)s:

This is not just an international customer issue; land-based gaming organizations are also exposed as the recent $7.45M enforcement action against MGM shows. In this matter, the president of MGM Grand believed a high-value customer was operating an illegal bookmaking business but did not want to officially know about it in order to avoid banning the customer. He justified the illegal activity because it was not cheating the casino and he encouraged this individual to gamble and spend money at the casino, including authorizing complimentary benefits such as meals, room, board, and golf trips with senior executives and other high net-worth customers of the casino. MGM reached a $7.45M settlement in this case and the former president of MGM Grand pleaded guilty and is facing up to five years in prison and a $250,000 fine. Willful blindness and massaging or disregarding AML obligations to facilitate relationships and revenue puts both the casino and executives at risk of enforcement actions and personal criminal liability.  

CMLOs are compartmentalized and decentralized groups that are incredibly effective at moving money across different currencies and jurisdictions. While not usually participating in generation of ill-gotten funds, they tend to move money for Transactional Crime Organizations, in Mexico, South America and other jurisdictions. Additionally, they provide a mode of wealthy Chinese nationals moving money outside of China beyond their $50,000 flight restriction. While the source of wealth of these patrons is not in question, the source of funds (SOF) can be. Casinos need effective processes in place to identify these situations, understand where customers got these and the organizations that they came from. CMLOs are running as non-registered money services businesses and the information from these patrons can help identify them.

‍

ABOUT KINECTIFY

Kinectify is an AML risk management technology company serving gaming operators both in the US and Canada. Our modern AML platform seamlessly integrates all of the organization's data into a single view and workflow empowering gaming companies to efficiently manage risk across their enterprise. In addition, Kinectify's advisory services enhance gaming operators' capacity with industry experts who can design and test programs, meet compliance deadlines, and even provide outsource services for the day-to-day administration of compliance programs.

To learn more about Kinectify and book a demo, click here.