AML & KYC for iGaming: Staying Compliant and Safe

by Gergo Varga

Ever since the poker boom of 2003 and the golden days of Chris Moneymaker, the iGaming and gambling industry has been going from strength to strength – though there have certainly been obstacles and challenges along the way.

One of the key testing hurdles for operators has been ever-shifting local legislation, including gambling AML and KYC mandates put in place by various regulatory authorities. These are obligatory for iGaming operators to follow or face strict fines and even removal of licenses – be they online casinos, bookmakers, poker rooms, bingo sites, or offer other types of real-money games enjoyed online.

Let’s take a closer look at the challenges of AML and KYC in iGaming, as well as key considerations along the way to resolving them with the least amount of player churn possible.

What Is AML in Gambling and iGaming?

In gambling, iGaming and adjacent sectors, AML refers to a set of controls put in place to prevent these platforms from being used for money laundering and/or terrorism funding.

Real-money gaming, both online and offline, is considered an activity that is more likely to attract those who seek to launder money, such as money mules.

Reasons for this include the fact that sizable transactions are commonplace here, as well as that it’s not unusual at all for bankrolls to be full of money one day and then completely empty the next one, and vice versa.

At online casinos, it is justifiable and fairly normal for money to be moved in ways that are unusual in other contexts – and this makes the sector more susceptible to money laundering.

What Is KYC for Casinos, Gambling and iGaming?

In iGaming, gambling and other sectors, the term KYC verification refers to a series of checks conducted to satisfy the legal obligation to request identifying documents from new customers at the sign-up stage.

These can differ depending on locale or licensing authority, but generally mean the new user will be asked to prove their name, address and age.

Why Is AML & KYC Important in iGaming?

The short answer is, because if you’re not compliant, you will face hefty fines and/or be shut down and lose your license.

Though authorities acknowledge that the iGaming brands are not an active part in money laundering, the fact the platforms are used to this end is reason enough for these laws to be put in place.

security vs customer friction in igaming

How Is Money Laundered through Gambling and iGaming?

Online casinos, poker rooms and bookmakers are used to layer (launder) illegally obtained funds, thus hiding their true origins from anyone looking to identify them.

Unfortunately, casinos have always been at risk of money laundering, including brick-and-mortar establishments of the past, way before the advent of the internet.

There are various ways to do this, all starting with depositing the money into the player’s bankroll. From there, several avenues open up – which also depend a lot on how sophisticated the iGaming operator’s monitoring tools are:

In player vs player situations such as online poker, the criminals operate two or more accounts, ostensibly having one lose money to the other – with the latter emerging as clean cash. This is called collusion play.
Fraudsters make big deposits, play very little and then cash out the rest.
Fraudsters make several small deposits to their bankroll, and eventually withdraw it all – often splitting up the original funds with multiple “front” players.

There are red flags throughout these steps, including fraudsters normally using fake or synthetic IDs to sign up, discrepancies between money handled and money gambled, multi-accounting, slight differences in provided documentation, and more.

You can also have fraudsters playing as rings. When this happens, good fraud prevention platforms will identify connections between them that indicate a synchronized operation.

As they are opportunistic, some fraudsters may also take the opportunity to attempt some bonus abuse, disputed payments, or other fraud against the operator themselves, though it should be noted that the more experienced and well-conducted laundering schemes would not risk exposing their operations in such a way – all in the spirit of the fraudster motto “don’t get greedy, don’t get caught”.

What Are the AML & KYC Requirements for iGaming and Casinos?

There are various KYC & AML requirements for betting/iGaming companies around the world, depending on the operator’s country and the locale of the players who are allowed to join the casino or betting site.

However, in general terms, they include showing the iGaming operator proof of identity, proof of age, as well as proof of address.

Most countries incorporate guidance for casinos and other gambling firms within their umbrella AML bills, which tend to follow the United Nations Office on Drugs and Crime programs against money laundering.

The relevant UNDOC mandate is called Anti-Money-Laundering/Countering the Financing of Terrorism (AML/CFT), implementing “capacity building activities” that cover “both traditional and new means of money laundering techniques and illicit financial flows” – including online gambling.

Some of the legal mandates from major countries around the world are:

Bank Secrecy Act (BSA) in the USA
Anti-Money Laundering Act of 2020 in the USA
European Union’s Anti-Money Laundering Directive 6 (6AMLD) and its previous versions, e.g. 5AMLD, in the EU
Proceeds of Crime Act 2002 (POCA) in the UK
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) in the UK
Terrorism Act 2000 in the UK
AML/CTF Act in Australia
Anti-Money Laundering and Counter-Terrorism Financing and Other Legislation Amendment Bill 2020 in Australia
Prevention of Money Laundering Act, 2002 (PMLA) in India
Prevention of Money Laundering (Maintenance of Records) Rules, 2005 in India
Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) in Hong Kong
etc.

AML vs KYC for iGaming & Gambling

AML stands for anti-money laundering (measures, legislation or steps). It’s the reason why KYC and similar processes, such as enhanced customer due diligence (ECDD) are enforced.

The key takeaway here is that KYC is only one piece of AML, and specifically the part introduced whenever a new customer wants to sign up for a service/company’s products.

From there, AML goes beyond KYC to include other steps, such as organizations requesting evidence linked to how a customer acquired the funds they want to deposit or invest.

Sometimes, steps taken to comply with AML legislation are called AML in everyday speech. And it’s not unusual for all three terms – AML, KYC and CDD – to be used interchangeably, though there are technical differences.

Your company’s legal advisor will be able to specify exactly which mandates apply to you, which is an important first step. From there, it’s time to find those KYC and AML platforms and tools that cover your needs.

Challenges & Risks for AML and KYC in iGaming

There are several challenges iGaming operators face in relation to their AML and KYC obligations, and these originate both in legislation and new criminal schemes.

In terms of legislation, authorities have been ramping up their demands in recent years, with technological as well as geopolitical developments leading to a heightened need for stricter laws – in the opinion of legislators and regulators.

On the other hand, fraudsters and criminals of varying degrees of experience continue to come up with new methods and ways to circumvent legacy anti-fraud and anti-layering measures, which they either conduct themselves or instruct money mules to do. Sometimes, this involves smurfing, for example – the practice of breaking large sums to be laundered into smaller ones in order to go unnoticed.

But from there, the potential risks extend to almost every area of activity for iGaming brands:

hefty fines impacting revenue
closure/removal of license if found non-compliant
player friction if asked for too much documentation
new user churn
bad publicity
stalled growth
etc.

Therefore, the key challenge for gambling brands is finding how to fully comply with all applicable legislation with minimal disruption to the customer journey, including sign-up and deposits.

AML/KYC Software & Tool Features to Look Out For

KYC, CDD, AML software, tools and platforms for iGaming brands need to be able to provide strict, provable adherence to any and all applicable mandates, and to do that without insulting legitimate players.

Key AML and anti-fraud software features include:

full compliance with legal obligations
PEP and sanctions list screening
real-time account monitoring for red flags
strong document verification capabilities
transaction and deposit method monitoring
machine learning to learn from historical fraud events
data enrichment to gauge user legitimacy
device fingerprinting
blacklists, shared or not shared
consumer affordability checks
pre-KYC checks as a first line of defense

Operators will additionally want the various AML fraud detection tools deployed to be as discreet as possible, both in terms of interruptions to the player’s enjoyment of the gaming services, as well as in communications with the player. This is because many choose not to reveal their passion for online gaming to everyone they know. As a result, privacy is more important to iGaming fans than online shoppers, for example.

Overall, the concept of friction is key: the more frictionless the solution, the less churn there is – and thus the more profitable the bookmaker, casino or poker room will be.

Some steps need to be taken always, as defined by legislators. However, for the rest, it is still important to find the best possible way to combine protection for the iGaming company and maximum player satisfaction, as we will see below.

How SEON Complements AML & KYC in iGaming

The way SEON’s anti-fraud solutions work means that they can adapt to different needs, including those of the iGaming sector as well as its individual operators. This means that the benefits can be reaped as well as tweaked to suit everyone’s needs.

SEON’s AML API provides manual as well as automatic AML screening, including against PEP and RCA lists, criminal watchlists, sanctions lists and other watchlists that apply.
In terms of KYC in particular, SEON can be a valuable pre-KYC check tool that integrates well with your document verification strategy. Using SEON’s platform to run strong fingerprinting and analysis algorithms, you will be able to catch a portion of the fraudsters targeting you as soon as they attempt to sign up. This means you will have fewer bad users to run KYC checks on, saving you time and money.
SEON also allows you to do transaction monitoring and other AML monitoring features that will flag transactions over legally set thresholds for example, or other potentially suspicious player actions. In iGaming specifically, SEON can help protect against collusion play such as chip dumping, for example.
By protecting against account takeovers, identity fraud, as well as other types of fraud, SEON further boosts your compliance efforts.
Finally, SEON also helps you keep safe from fraudsters attempting affiliate fraud, bonus fraud, etc. in addition to AML considerations.

SEON cannot verify player ID documents for you, but everything else on your AML and KYC checklist is provided. In fact, SEON uses reverse email and phone number lookups, IP analysis, behavior analysis, device fingerprinting, user connections and more algorithms to gauge which users are suspicious without asking the consumer for anything. Based on the results, they will then be let through – or asked for more stringent documentation, blocked or forwarded to fraud analysts for manual checks.

Another important consideration here is the question of hard vs soft KYC. This is a strategy SEON employs, allowing for dynamic friction. In simple terms, this means only requesting additional steps from those who are classed as suspicious at pre-KYC, letting legitimate, “good” customers through with minimal disruption.

When conducting manual reviews of players seeking to sign up or to withdraw funds, the casino, bookie or poker room’s analysts can use SEON’s software to get a 360-degree view of the player’s digital footprint, which helps assess whether they are a real person or a throwaway email address and persona created to assist with money laundering and/or other criminal schemes. There are also BIN lookups, IP lookups and more modules to provide additional information.

You can try out SEON’s AML lookup module right here:

Moreover, money laundering attempts can be caught through real-time fraud monitoring, using red flags at other touchpoints of an online casino player’s interactions with the platform.

These can be defined using the preset rules crafted specifically for iGaming by SEON, as a way to get started or as a set-and-forget solution. SEON’s engine can also generate ruleset suggestions specific to each platform using machine learning, or the operator can start from scratch, deciding and defining each rule manually. Of course, you can combine these strategies too, if you wish.

SEON’s end-to-end solution integrates defenses against several additional pain points for online gambling brands:

A case in point is Playtech, one of the most well-known software providers in iGaming, which recently integrated SEON to enhance its KYC procedures. The partnership allows Playtech to take advantage of data enrichment via the digital footprinting solution to make better KYC decisions.