Casino AML Audit Checklist: FINTRAC and BSA Evidence Requirements

A casino AML audit tests whether the written program matches what staff actually do. Canada requires a two-year effectiveness review of the compliance program under section 156 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR), and the United States requires internal and/or external independent testing under 31 CFR 1021.210(b)(2)(ii). The checklist below applies to casinos and card clubs under Part 1021, to Canadian casino operators and provincial gaming corporations that are reporting entities under the PCMLTFA, and to online operators whose controls must align with them. Consult qualified legal counsel on how these provisions apply to your licence structure.

This checklist was built from FINTRAC’s compliance program guidance, 31 CFR Part 1021 as published in the eCFR (current to 26 May 2026), and the AGCO and AGLC internet gaming standards.

What each regime requires of the audit itself

FINTRAC defines the two-year effectiveness review as a review conducted every two years at a minimum, by an internal or external auditor, to test the policies and procedures, the risk assessment and the training program. The US rule lists independent testing as a minimum element of the written program and ties its scope and frequency to the money laundering and terrorist financing risks of the casino’s products and services. The table compares the two as of May 2026.

FINTRAC’s guidance requires the results to be documented and reported to a senior officer. The report covers the findings (deficiencies, recommendations, action plans), any policy updates made during the review period that did not result from the review, and the status of implementing those updates.

Program documents examiners request first

FINTRAC’s guidance lists the elements of a compliance program: an appointed compliance officer, written policies and procedures kept up to date and approved by a senior officer, a documented risk assessment, a written training program and plan, and a plan for the two-year review. In practice, each element should be producible with dates and approvals, since a manual with no approval record or one that predates a legislative change will not survive a document request.

The risk assessment must be documented and must consider clients and business relationships, products, services and delivery channels, geographic locations, new developments and technology, and affiliates where they exist. FINTRAC’s current guidance extends the assessment to sanctions evasion risk as well as money laundering and terrorist activity financing.

FINTRAC’s guidance says the training program should include a record of the date training took place, the attendees and the topics covered, tailored to roles. Under 31 CFR 1021.210(b)(2)(iii), US casinos must train personnel, including in identifying unusual or suspicious transactions. US casinos must also retain a copy of the compliance program itself under 31 CFR 1021.410.

Transaction sample testing

FINTRAC’s guidance describes the review procedures an effectiveness review should include. These are a review of transactions to assess whether suspicious transactions were reported, a review of large cash transactions to assess whether they were reported accurately and within the prescribed timelines, and a sample of records to assess whether client identification procedures were followed. The guidance also calls for a sample of client records to see whether the risk assessment was applied as written, and whether ongoing monitoring frequency matched each client’s risk level.

US testing follows the reporting rules. Testers reconstruct gaming-day aggregation under 31 CFR 1021.313, where multiple currency transactions are treated as one if the casino has knowledge that they are by or on behalf of one person. They check that the cash-in and cash-out items listed in 1021.311, such as front money, marker payments and chip redemptions, were captured. They also test SAR timing. As of May 2026, a casino must file a SAR within 30 calendar days of initial detection of facts that may constitute a basis for filing. That period extends by a further 30 days only where no suspect is identified, and never beyond 60 days. Situations requiring immediate attention, such as ongoing schemes, also require immediate telephone notification to law enforcement.

Trade press reported in July and September 2026 that FINTRAC penalised Atlantic Lottery $212,025 for failing to report suspicious transactions, maintaining outdated policies and documenting inadequate risk assessments. The same reports put the New Brunswick Lotteries and Gaming Corporation penalty at $399,712.50 and the Nova Scotia Gaming Corporation penalty at $231,826, citing missed common player identifiers and unverified identification documents, and said BCLC and SIGA are contesting larger penalties in federal court. In Ontario, the AGCO fined Great Canadian $170,000 over controls at Pickering Casino Resort after an audit found inadequate monitoring of high-risk patrons and unfiled Suspicious Transaction Reports, according to a July 2026 report.

Independence, remediation and the online overlay

The US rule does not define independence, so the casino must be able to evidence the testing team’s separation from the compliance function. FINTRAC’s guidance says the review should be conducted by someone knowledgeable of the Act and Regulations and, as a best practice, someone not directly involved in compliance program activities. In practice, that points to an external reviewer or an internal audit function reporting outside the compliance line.

Keep the action plan, owners, completion dates and the senior officer’s sign-off in one file. Because FINTRAC’s guidance requires the senior officer report to state the status of policy updates, the next review should be able to show that the last one’s recommendations were closed.

For online operators in Ontario, AGCO Registrar’s Standard 6.02 requires copies of all reports filed with FINTRAC and supporting records to be available to the Registrar under the notification matrix, and requires AML internal controls to align with those of the designated reporting entity. Standard 6.03 adds risk-based source of funds corroboration. The AGLC’s SRIG contains the same alignment requirement. See our analyses of AGCO compliance lessons at year three and the AGLC SRIG framework.

Key Resources

Matt Denney

Editorial · gamingcompliance.io

Reads the primary source so you don't have to. Fifteen years inside iGaming compliance: operator, supplier, and crown-corporation lottery.