On September 9, the Financial Action Task Force (FATF) published Risks of Gaming and Gambling, an update to its 2009 work on casinos, in collaboration with the Asia/Pacific Group on Money Laundering. The document sets out 123 red flag indicators drawn from questionnaire responses across 80 jurisdictions, as well as written comments and consultations with industry bodies and researchers.
The last time the FATF examined this sector, the money moved in chips across a casino floor. The report published now describes e-wallets, virtual assets, VPNs and merchants coded as ordinary retailers. While the media has treated it largely as a gambling story, it is also a banking one. Two of the five indicator categories cover payment behavior and platform characteristics, and several of the entries describe money that never reaches a licensed operator at all.
What the Indicators Have in Common
FATF organizes the list into five groups: customer behavior and profile, online accounts, betting patterns, payment methods and transactions and product and platform features. The first group splits three ways, into brick-and-mortar, online and a third set applying to both. That third set is the largest in the document.
The report is careful about how the list should be read. No single indicator is on its own a clear sign of money laundering, terrorist financing or proliferation financing, though one is enough to justify closer monitoring. Several appearing together around the same customer or transaction warrant a closer examination. FATF also warns that some of these patterns are symptoms of problem gambling rather than deliberate wrongdoing, and that both can be present at once.
On sector exposure, FATF’s general finding is that casinos, whether brick-and-mortar or online, and sports betting are particularly exposed to money laundering. It reports that some jurisdictions consider lotteries, scratch cards and other non-casino products less exposed, which is an attribution to those jurisdictions rather than a judgment of FATF’s own. Terrorist financing shows up more often in online gaming than in gambling, and FATF describes proliferation financing risk as very limited across both.
Gaming and gambling establishments and platforms, FATF writes, “are now part of a broader interconnected value transfer ecosystem with numerous actors, some of which fall outside national anti-money laundering/counter-terrorist financing (AML/CFT) regulatory frameworks.”
What a Verified Identity Cannot Tell You
A large share of the list is answerable at onboarding. Sanctions screening, politically exposed person identification, adverse media, doctored documents, a P.O. box address, refusal to appear on a video call, a customer based in a country where gambling is illegal. These are attributes of a person that are resolved at the door or through a competent customer due diligence program.
What runs through the rest of the list is a different kind of indicator. Several accounts were opened under different names from the same IP address or device. Payment method details that do not match customer registration details. Multiple customers sharing one bank account — deposits followed by withdrawals with minimal or no play in between. A customer is active across multiple platforms simultaneously with no apparent gambling purpose. None of this describes a person; each describes a relationship between events, and each resolves only when an institution can place the events side by side.
Consider the plainest of them. A deposit arrives, a small wager follows, and within the hour, the customer withdraws to a different instrument than the one that funded the account. Each step is individually unremarkable and individually authorized.
A transaction monitoring system tuned to amounts and thresholds sees three compliant events. Detecting the pattern may require joining the funding instrument to the account holder, the wager volume to the deposit volume and the withdrawal destination to the original source, then holding all three relationships together long enough to see the shape. The obstacle is rarely the data. It is that the funding instrument lives in the payments stack, the device lives in the fraud stack, the wagering history lives in the platform and no team owns the join.
Four of the indicators turn on thresholds. Customers structure deposits below reporting thresholds, collect winnings just below a customer identification threshold, and request cash winnings up to the threshold, never returning for the balance. At the corporate layer, owners arrange beneficial ownership shareholdings to fall under the level that triggers regulatory checks. All four work because the trigger level is knowable.
Why These Indicators Belong to Banks
FATF gives one tactic a name. Under the abuse of merchant identity, or what the report calls sham merchants, illicit operators present themselves as legitimate domestic businesses so that gambling traffic clears as ordinary retail payments. It is the entry on the list furthest from a casino floor, and the one that has drawn least attention.
The load-bearing word is domestic. An operator presenting as a local retailer is not evading a gambling regulator. It is evading merchant category codes and geographic blocking, which means detection has to be behavioral and occur within an acquirer’s books.
It does not sit there alone. The same category flags:
- significant business-to-business cross-border financial flows unrelated to regulated gambling activity
- third-party contracts with software, marketing, consultancy or technology providers that “appear to lack economic or commercial sense”
- operators expanding rapidly into virtual asset services, payment services or digital marketing
- commercially questionable transfers of beneficial ownership, including purchases of underperforming gambling businesses at inflated prices
- a gambling license obtained and then left dormant
Read as a set, these are indicators of merchant underwriting and correspondent banking. They describe the gambling company as the customer, and the bank holding that relationship is usually the only party with the transaction history to test them.
FATF’s recommendations run to jurisdictions, and this paper binds no one. But an acquirer’s merchant due diligence obligations exist under its own licensing regime, and both Visa’s Integrity Risk Program and Mastercard’s Business Risk Assessment and Mitigation program already require acquirers to register high-integrity-risk merchants and monitor for transaction laundering. What changed on September 9 was that a standard setter published the behavioral profile, and supervisors now routinely cite FATF typology work when testing whether a firm’s risk assessment was adequate. That makes it harder to characterize a missed sham merchant as an unforeseeable event.
What Restriction Costs the Licensed Market
FATF’s own findings argue against answering a new indicator list with more checks at the door. The report says illegal and unlicensed offshore gambling “is cited as a significant risk,” and that the illegal market “rivals or even exceeds the legal market in some countries and continues to proliferate, attracting players through promotions and greater levels of confidentiality.”
The phrase worth isolating is greater levels of confidentiality. FATF names two draws. One is promotions, which is price and outside a compliance function’s reach. The other is the absence of the checks that a licensed operator must run.
On scale, estimates vary widely, and none of them are small. Regulus Partners and Helios, in a study for EUROMAT, the European Gaming and Amusement Federation, estimate that Europe’s black market has grown at a compound annual rate of 18% since 2019 and could be worth as much as €13 billion this year, according to iGaming Business.
Three discounts apply. The estimate models web traffic, digital marketing and macro data across 28 jurisdictions, using a sample collected between March and May. The full study does not appear to have been published. And EUROMAT is a land-based sector federation that lobbies against restrictive gambling policy. Read with those caveats, the direction of travel is consistent with what FATF reports independently.
The study attributes much of the growth to restrictions in the licensed market, including advertising limits in up to 46% of the markets studied, consumer taxes in 29% and product bans in 14%. Its authors note a rapid reduction in the United Kingdom channeling following the increased use of affordability checks, and estimate that the U.K. black market could reach €1 billion as remote gaming duty rises from 21% to 40% for accounting periods beginning on or after April 1.
FATF does not make that causal link. Only the study does, and its sponsor has the least claim on being believed about it. What survives the discount is narrower and still useful. Restrictions in one vertical move engaged customers across all of them, and each requirement added in the licensed market is, at the margin, a feature of the competing offer. The useful controls are the ones that draw on data a firm already holds.
Where to Start
FATF asks jurisdictions for better risk understanding and a risk-based approach under Recommendation 1, stronger licensing, more public awareness of illegal offshore gambling, deeper international cooperation and public-private partnerships. All five will take years, and a compliance function is working for the next quarter.
- Resolve at the subject level
Link across device, IP, email, phone and payment instrument so that one person holding several accounts appears as one person and test the funding instrument against the account holder while you are there. Without that linkage, most of the relationship indicators stay invisible. - Monitor the ratio of deposits to actual wagering
Money that arrives and leaves with little play between is FATF’s plainest description of laundering through a platform, and among the more straightforward patterns to instrument. - Review merchant categorization where gambling adjacency is plausible Sham-merchant activity often surfaces in payment behavior before it appears in any licensing record.
- Apply the corporate indicators to gambling clients as well as players
Unexplained business-to-business flows, intangible service contracts and sudden ownership transfers are questions for a relationship manager. - Carry FATF’s problem-gambling caveat into the rules themselves
Several of these patterns are also symptoms of gambling harm, and a program that cannot tell harm from crime will produce both bad reports and bad outcomes.
Some of the joining work is a quarter. Some of it is not, and a firm that cannot yet tell which is which does not yet know its own architecture. A firm that finds no matches on this list should check whether its systems can find one.
