AML and Sanctions compliance in Gambling

The latest EU Anti-Money Laundering Regulation (2024/1624) strengthens the requirements for gambling operators to identify and verify their customers in a wider range of scenarios. Under this framework, providers of gambling services are explicitly required to apply customer due diligence measures not only at the outset of a business relationship but also when customers place bets or collect winnings. This ensures that identity verification is embedded directly within key stages of the gambling process, enhancing transparency and reducing the risk of criminal misuse. By focusing on the moments where funds enter or exit the gambling ecosystem, the regulation reflects a more comprehensive and activity-based approach to AML compliance in the sector.

Gambling operators covered by AML framework provisions must implement core measures including verifying customers’ identity and age, identifying beneficial owners, monitoring transactions for unusual or suspicious patterns, keeping detailed records, and reporting suspicious activity to authorities. They are also required to train staff and have internal controls to ensure compliance. These obligations mirror those in other sectors, but regulators have issued sector-specific guidance recognizing the unique aspects of gambling (such as the use of cash, chips, and online payment methods). Ultimately, the EU’s AML laws set a baseline, which individual countries often augment with stricter rules for certain gambling licenses.

Land-based casinos are universally considered high-risk entities and are therefore subject to the full scope of Anti-Money Laundering (AML) requirements. Customers who purchase chips, place cash stakes, or collect winnings must be properly identified. In many European jurisdictions, casinos conduct identity verification either upon entry or at the point of a significant transaction. They are also required to maintain detailed records linking each customer to their respective buy-ins, wagers, and payouts.

Casino compliance teams are trained to watch for classic red flags, such as patrons bringing in large sums of cash, using high-value banknotes, or cashing out chips with minimal play – behaviors that may indicate money laundering. The Financial Action Task Force (FATF)³ has observed the risks posed by the cash-intensive nature of traditional casinos and their ability to facilitate "buy in" and "cash out" transactions with minimal friction. To mitigate this, casinos must implement controls like source-of-funds checks for big spenders, surveillance of transactions on the gaming floor, and strict record-keeping of all significant cash exchanges.

Traditional betting shops, such as retail sports betting outlets or high-street bookmakers, also face AML obligations. Under EU law they are gambling service providers just like casinos and are required to perform CDD (Customer Due Diligence) for payouts or stakes. In practice, even where not legally mandated, many betting operators institute risk-based checks, for example, verifying identity for large winning claims or when a pattern of frequent high wagers emerges. A common safeguard is requiring customers to show ID for payouts over a certain amount to both verify age and record who received the funds.

Furthermore, betting companies are obliged to exercise a high level of vigilance with regard to tactics such as the structuring by splitting of bets in order to minimize suspicion, or the use of third parties to place wagers. While the retail betting environment deals mostly in cash and paper betting slips, modern systems in many shops log transactions and can flag unusual bet sizes or multiple big wins collected by the same person, aiding AML efforts. The prevailing expectation among gambling licensees is to conduct business in a manner that deters and detects criminal money. This principle is further reinforced by licensing objectives outlined in the 6th Anti-Money Laundering Directive⁴ (2024/1640).

Lotteries, especially those operated by the state or for charitable purposes, are generally considered to carry a lower risk⁵ of money laundering due to several structural factors. Tickets are usually low in price, widely distributed through retail networks or online channels, and prize payouts are determined randomly and often announced publicly. In most cases, winnings are issued via traceable methods such as bank transfers, which limits the opportunity for anonymous cash transactions. These features reduce the attractiveness of lottery products for criminals seeking to introduce or disguise illicit funds within the financial system. Nonetheless, lottery operators still implement some controls: big jackpot winners are typically required to provide identification when claiming prizes, and operators check that winners are not on sanctions or self-exclusion lists. To prevent abuse, many lotteries have caps on cash payouts at retail outlets, with larger prizes paid via bank transfer after verifying the winner’s identity. The application of risk-based monitoring is justified in instances where an individual attempts to purchase an unusually large volume of tickets or wins high-value prizes repeatedly, as it may be indicative of fraudulent activity.

Alongside their AML duties, European gambling operators are bound by financial sanctions frameworks established by the EU and other regulatory entities. Financial sanctions prohibit doing business with designated individuals, entities, or countries (for example, terrorist financiers, criminal organizations, or sanctioned states) and can involve asset freezes and restrictions on providing services. Gambling companies must ensure that no sanctioned person is able to deposit, wager, or withdraw funds on their platforms or premises. This requires robust sanctions screening of customers and transactions.

European operators are generally expected to screen all customers’ names and, in some cases, beneficiaries of payouts or other associated parties against the EU consolidated financial sanctions⁶, which is the official EU database of sanctioned persons and organizations. They should also be aware of United Nations sanctions lists⁷ and, if they serve international clientele, other jurisdictions’ lists. For instance, many screen against the U.S. OFAC specially designated nationals list⁸ and the UK sanctions list⁹. Land-based casinos and betting shops must also ensure that if they identify a patron, their name is checked regularly. In practice, a casino might run periodic batch screenings of its membership lists and require checks whenever a high-value transaction or payout occurs.

Best practice is to conduct sanctions screening at onboarding and ongoing monitoring thereafter. Notably, regulators have taken action against operators for failures in this area. In a recent case in the UK, the Gambling Commission¹⁰ fined online betting companies for failing to carry out financial sanctions checks on new customers before their first deposits. In that case, the operators had allowed customers to begin gambling without promptly confirming they were not on sanctions lists, a lapse that regulators deemed a serious compliance failing. To avoid such breaches, many companies enforce a rule that no withdrawals (and in some cases, no deposits) can be processed until the customer’s name is screened and cleared.