Why anti-money laundering guidance is evolving with the gaming industry

Risks associated with organized, large-scale cyber-enabled crimes, such as identity and credit card theft fraud rings

• Industry guidance: Large-scale fraud rings have targeted online gaming and sports wagering operations due to the ability to create or takeover multiple accounts quickly to move funds, oftentimes using stolen identities.  
• Best practice considerations: Given the AGA’s emphasis on preventative measures, operators should consider establishing preventative tools focused on geolocation. This includes monitoring patron account for device sharing, common IP addresses and indicators of multi-accounting, such as players utilizing the same or similar contact information across accounts.

Risks associated with the types of online fund deposit and withdrawal methods

• Industry guidance: Offering multiple forms of online fund deposit and withdrawal increases the risks of coordinated efforts to launder money between accounts, using one type of account to deposit funds, and another to withdraw. While online transfers mean that these transactions are cashless and therefore not subject to currency transaction report (CTR) requirements, operators should still evaluate and implement procedures that review transactions at a certain threshold or risk profile. 
• Best practice considerations: Operators should, where possible, return funds to the method paid, implement payment controls around deposits and withdrawals requiring the account information to match that of the patron’s account with the operator, and consider analyzing patron accounts with multiple payment methods and consecutive deposits within a short period of time.

Risks related to the acceptance of cryptocurrencies, a blockchain-based technology, as an alternative payment method for online gaming and sports wagering

• Industry guidance: Accepting cryptocurrencies as a form of payment allows operators to benefit from the decentralized record-keeping properties of cryptocurrency, however, the changing regulatory landscape and overall volatility of the market creates additional risks for digital operators to consider.  
• Best practice considerations: As operators consider expanding their deposit and withdrawal methods to include cryptocurrency, additional steps, such as the conversion of funds into cash, should be implemented. By requiring virtual currency be converted to US dollars prior to deposit or wagering, this will subject the activity to the same CTR requirements, suspicious activity review and monitoring as other cash transactions conducted at the casino.

Risk associated with customer identity verification in the virtual environment and the benefit of leveraging third- party databases and solutions

• Industry guidance: Casinos should examine their risk-based approach to identification and verification.  
• Best practice considerations: Some operators allow for accounts to be established in person, while others take a non-documentary approach and require the patron to enter personal identifying information (PII) into their online platform, which is then independently verified through a comparison of information obtained from consumer reporting agencies, public databases or other third-party electronic ID verification services. 

Risk that casino employee training programs do not address risks specific to digital operation environments

• Industry guidance: Trainings should be department-specific and address risk factors that are pertinent to digital operations, as the risks associated to digital gaming are different than traditional brick-and-mortar operations.
• Best practice considerations: Ongoing training should be provided to employees with customer-facing roles such as customer service, customer experience or other employees who would not traditionally be given training on how to identify suspicious behavior. Specialized training should also be provided to those reviewing patron transactions, such as compliance investigators, and should be refreshed periodically to capture new and growing threats in the digital space. All employees, regardless of their role, should be able to understand their role in the overall AML program and be informed on how to identify and escalate suspicious typologies.