The iGaming, AML & Regulatory Glossary

Adverse media screening complements sanctions and PEP screening by surfacing reputational, criminal or regulatory risks not yet on official lists. Sources include global news aggregators, court dockets, regulatory enforcement actions and corruption indices. FATF and Wolfsberg Group guidance recognise adverse media as a key EDD input. Operators must define adverse-media categories (fraud, money laundering, terrorism, tax evasion) and document how alerts are dispositioned.

Alert disposition is the audit trail showing why each TM alert was closed as false positive, escalated for EDD, or filed as a SAR/STR. Regulators including UKGC, MGA and FinCEN expect a four-eyes review for higher-risk dispositions, a documented rationale referencing customer profile and SoF, and retention of the decision record for at least five years. Poor disposition quality is a common enforcement finding; UKGC has fined operators where dispositions were copy-paste boilerplate.

The AMLCO has programme-level ownership of policies, risk assessment, training, technology and audit; the MLRO has specific responsibility for SAR decisions. In smaller operators the two roles are sometimes combined, but FATF Rec. 18 and the EU AMLDs prefer separation where possible. The AMLCO typically reports into the board AML/Risk Committee and is the primary point of contact for thematic regulator reviews.

Required by FATF Rec. 1, UK MLR 2017 reg. 18 and equivalent EU rules, the BWRA must be in writing, kept current, approved by senior management and made available to the regulator. It informs the design of policies, controls, monitoring rules and EDD triggers. UKGC and MGA have both fined operators for outdated, generic or copy-paste BWRAs that fail to reflect actual product and customer mix.

Chip dumping is a gambling-specific laundering and collusion technique, most common in online poker and peer-to-peer products. A 'dirty' account intentionally loses to a 'clean' account, which then withdraws the funds as apparent gambling winnings. Detection rules monitor for unusual loss patterns, repeated head-to-head play between linked accounts, and deposit-method or device fingerprint overlaps. UKGC, MGA and most regulators expect operators to have specific chip-dumping detection in their P2P transaction monitoring.

Mixing services such as the now-sanctioned Tornado Cash (OFAC SDN designation, August 2022) and Blender.io are designated by FATF as high-risk for layering. Funds passing through mixers should generally be treated as high-risk in gambling AML programmes, often warranting auto-block or mandatory EDD. Many regulators (UKGC, MGA, NJDGE) expect chain-analysis tooling such as Chainalysis or TRM Labs where crypto deposits are accepted.

Under 31 CFR 1021.311, US casinos must file FinCEN Form 112 for any cash-in or cash-out aggregating more than USD 10,000 in a 24-hour gaming day for a single patron. Filing is mandatory and threshold-driven (no suspicion required); attempts to evade it through structuring trigger separate criminal liability. Title 31 (Bank Secrecy Act) compliance is a major operational workstream for Nevada, New Jersey and tribal casinos.

CDD under FATF Recommendation 10 requires firms to identify the customer using reliable independent documents, verify beneficial ownership, understand the purpose of the business relationship and conduct ongoing monitoring. For casinos, CDD must be triggered at or above the EUR/USD 3,000 occasional-transaction threshold under FATF Rec. 22, or earlier under stricter national rules (e.g. UK MLR 2017 requires CDD on any single transaction of EUR 2,000+).

Defensive filing dilutes FIU intelligence value and is criticised by FATF, the UK NCA and FinCEN. Indicators include vague narratives, repetitive boilerplate, and SARs filed against customers with no enriching investigation. UKGC and the NCA have explicitly warned the gambling sector to invest in narrative quality and underlying analysis rather than volume. A high SAR-to-customer ratio combined with low conviction follow-up rates is a regulatory red flag.

FATF Rec. 22 and 23 designate casinos (including internet and ship-based casinos), real-estate agents, dealers in precious metals/stones, lawyers, notaries, accountants and trust/company service providers as DNFBPs subject to CDD, record-keeping and SAR obligations. For gambling specifically, the EUR/USD 3,000 transaction threshold triggers CDD. National regimes may extend DNFBP coverage to other gambling sectors such as betting shops, bingo halls or lottery retailers.

EDD is mandatory under FATF Rec. 12, 19 and the EU AMLDs for higher-risk relationships including foreign PEPs, customers from high-risk jurisdictions and complex or unusually large transactions. Measures include obtaining additional ID documents, evidencing source of funds and source of wealth, senior management sign-off before onboarding or continuing the relationship, and tighter ongoing monitoring with reduced alert thresholds.

FPR is a key efficiency metric for AML programmes: an FPR above ~95% typically indicates poorly tuned rules or thresholds, wasting analyst capacity and risking genuine alerts being lost in noise. The Wolfsberg Group recommends regular tuning, segmentation by customer risk band and back-testing against confirmed SARs. Lowering FPR without lowering true-positive detection is the central optimisation problem for modern AML technology.

Formally called Jurisdictions under Increased Monitoring, the grey list is updated three times per year at FATF plenary meetings. Listed countries (e.g. recent additions including Bulgaria, Croatia, Monaco) face increased EDD requirements from counterparties and reputational pressure on inbound capital. Black-list countries (the High-Risk Jurisdictions Subject to a Call for Action - currently DPRK, Iran and Myanmar) trigger mandatory counter-measures.

The FATF 40 Recommendations are the internationally endorsed standards that countries must implement to combat money laundering, terrorist financing and proliferation financing. They cover legal, regulatory and operational measures including customer due diligence, suspicious transaction reporting, beneficial ownership transparency, sanctions and international cooperation. FATF Recommendation 28 specifically requires casinos to be licensed and supervised for AML purposes.

FATF Rec. 29 requires every country to establish an FIU. Examples include the UK National Crime Agency UKFIU, US FinCEN, Canada FINTRAC, France TRACFIN, Malta FIAU and Australia AUSTRAC. FIUs are members of the Egmont Group, which facilitates secure intelligence sharing across 160+ jurisdictions. They are the recipient of all gambling operator SARs and frequently issue typology alerts that operators must incorporate into transaction-monitoring rules.

Issued under UN sanctions regimes (via UNSCR resolutions), the EU (Council Regulations under CFSP), the UK (Sanctions and Anti-Money Laundering Act 2018, OFSI) and the US (OFAC under IEEPA), freezing orders require regulated firms to block accounts and report holdings without prior notice to the customer. Breach is a strict-liability criminal offence in most regimes. Operators must screen against updated lists continuously; OFSI requires UK firms to report frozen assets and exposure annually.

At integration the funds appear as legitimate wealth: property purchases, business investments, luxury goods or apparent gambling winnings used as cover stories for unexplained income. Casino-issued win cheques and wire-out documentation have historically been used as integration vehicles, which is why FATF Rec. 28 requires casino licensing and Rec. 22 mandates CDD on transactions above the threshold. Effective AML programmes seek to prevent funds from reaching this stage.

KYT complements traditional KYC for VASPs and crypto-accepting gambling operators by tracing the on-chain provenance of incoming funds back through mixers, darknet markets, sanctioned addresses and high-risk exchanges. Tools like Chainalysis KYT, Elliptic Navigator and TRM Labs assign risk scores per address and per transaction. KYT is increasingly required by regulators including NYDFS, MAS and the FCA for crypto-asset firms.

Layering creates distance between the criminal source and the funds via wire transfers between jurisdictions, conversions between currencies, crypto mixing, shell-company invoicing or chip exchanges across multiple casino sessions. The goal is to break the audit trail. Sophisticated layering exploits weak-AML jurisdictions, opaque corporate structures and high-throughput products such as online slots with rapid bet-cycle velocity.

MLR 2017 (SI 2017/692) sets out CDD, EDD, risk assessment, record-keeping, training and MLRO requirements for UK regulated businesses. Casinos (online and land-based) are regulated by the UKGC under these rules and the parallel POCA 2002. Casinos must apply CDD on transactions of EUR 2,000+ (lower than the FATF Rec. 22 EUR 3,000 standard) and conduct a documented written risk assessment under regulation 18.

FATF Rec. 18 and UK MLR 2017 regulation 21 require a board-level MLRO (called the Nominated Officer in some statutes). The MLRO receives internal suspicion reports, decides whether to file external SARs, and is personally liable for failures. Under UKGC LCCP 1.1.1 and MGA Implementing Procedures, the MLRO must be approved as a Personal Management Licence holder or Key Function holder. The role is distinct from the broader AMLCO compliance function.

Money mules may be witting accomplices, coerced victims or unwitting recruits responding to fake job ads. In gambling, mule accounts typically deposit, play minimally, then withdraw to a different payment instrument from the deposit method, producing a clean-looking 'gambling winnings' paper trail. Detection rules look for payment-method mismatches, unusual IP/device sharing across accounts, and rapid play-through patterns. Europol's EMMA action days target mule networks annually.

Required by FATF Rec. 10(d), ongoing monitoring involves transaction surveillance, periodic CDD refresh and trigger-event reviews (e.g. PEP match, sanctions hit, unusual deposit pattern). For licensed gambling operators, the UKGC LCCP and MGA Implementing Procedures require monitoring intensity to be calibrated to risk, with documented triggers for stepped-up review.

Placement is the riskiest stage for launderers, as physical cash is most visible. In gambling, placement typically involves buying chips with cash, loading cash into TITO tickets, or funding online accounts via cash-purchased vouchers or e-wallets. FATF Rec. 22 sets the EUR/USD 3,000 casino CDD threshold specifically to attack placement risk. Detection at placement preserves the maximum investigative trail.

FATF Rec. 12 distinguishes foreign PEPs (always high risk, mandatory EDD), domestic PEPs and international organisation PEPs (EDD only when risk assessment indicates). The category covers heads of state, senior politicians, judges, military officers, central bank officials and senior executives of state-owned enterprises, plus their family members and close associates (RCAs). Gambling operators must screen at onboarding and continuously thereafter, with senior management sign-off for any PEP relationship.

Money laundering is by definition derivative; it requires a predicate offence such as drug trafficking, fraud, corruption, tax evasion or human trafficking. FATF Rec. 3 requires countries to apply ML to the widest range of predicate offences, and EU 6AMLD harmonises a list of 22. Some jurisdictions (e.g. UK under POCA 2002 s.327-329) operate an 'all crimes' predicate model. The choice matters for SAR drafting: the narrative should articulate the suspected predicate where possible.

FATF Rec. 1 and Rec. 7 require countries and obliged entities to identify, assess and mitigate proliferation-financing risk, primarily linked to UN Security Council sanctions on Iran (UNSCR 2231) and DPRK (UNSCR 1718/2270/etc). The 2020 amendment made PF risk assessment mandatory alongside ML/TF risk assessment. Sanctions screening, beneficial-ownership transparency and trade-finance scrutiny are the primary mitigants; gambling operators encounter PF risk mainly via payment counterparty and corporate ownership chains.

The Risk-Based Approach requires operators to identify, assess and understand their ML/TF risks, then apply mitigation measures proportionate to those risks. FATF Recommendation 1 mandates this approach. In practice it means a low-risk recreational player may receive Simplified Due Diligence, while a high-risk PEP receives Enhanced Due Diligence and ongoing monitoring with tighter thresholds.

Sanctions evasion typologies catalogued by OFAC, OFSI and FATF include use of front companies in non-sanctioned jurisdictions, vessel AIS-spoofing for oil shipments, document falsification, layered correspondent banking and crypto mixing services. Following the 2022 Russia sanctions, FATF and the G7 Russian Elites, Proxies and Oligarchs (REPO) task force expanded typologies around luxury goods, real estate and gambling-sector exposure. Operators must include evasion typologies in transaction-monitoring rules.

Sanctions screening compares customer data against consolidated lists including the US OFAC SDN list, UN Consolidated Sanctions List, EU Consolidated Financial Sanctions List and the UK OFSI Consolidated List. Hits must be investigated and, if confirmed, the account frozen and the regulator notified. Screening is required at onboarding, on every list update (often daily), and before processing payments. Failure carries strict-liability penalties; OFAC has fined firms hundreds of millions of dollars for sanctions breaches involving even small dollar values.

Shell companies are not illegal per se but are heavily exploited for laundering, sanctions evasion and tax fraud, as documented in the Pandora, Panama and Paradise Papers. FATF Rec. 24-25 require beneficial-ownership transparency to defeat shell-company abuse. Operators must apply EDD to corporate customers showing shell indicators: registered-agent-only address, no employees, nominee directors, opaque ownership chain across multiple secrecy jurisdictions.

SDD allows reduced identification, verification or monitoring measures when the customer, product and jurisdiction together present low money-laundering risk. It is permitted under FATF Rec. 10 and 6AMLD only where the risk assessment supports it, never as a default. Typical SDD use cases include small-stake recreational players verified through trusted government ID matches, but operators must still apply ongoing monitoring sufficient to detect changes that would trigger standard or enhanced CDD.

Directive (EU) 2018/1673, transposed by 3 December 2020, defines 22 predicate offences for money laundering, criminalises aiding/abetting/attempt, and introduces corporate criminal liability with minimum 4-year maximum sentences for individuals. It complements the operational obligations of 4AMLD and 5AMLD. The EU's 2024 AML package replaces much of the directive structure with directly applicable Regulation (EU) 2024/1624 and creates the new EU AML Authority (AMLA).

SoF refers to where the actual money used in a transaction came from, such as a salary credit, a property sale or a gambling win at another operator. It is narrower than Source of Wealth. Operators must request and evidence SoF when EDD is triggered, when a transaction is unusually large for the player profile, or when monitoring rules flag the deposit. UKGC enforcement cases (Entain, William Hill) have repeatedly cited inadequate SoF evidencing as a primary failure.

SoF Declarations are the operational artefact through which operators evidence SoF for EDD or threshold reviews. UKGC enforcement (e.g. 2022 Entain GBP 17m settlement, 2023 William Hill GBP 19.2m settlement) has repeatedly cited acceptance of customer assertions without supporting evidence as a primary failing. Acceptable evidence includes recent payslips, bank statements showing salary credits, sale contracts or accountant letters; verbal assurances are not sufficient.

SoW describes how the customer built their overall wealth over time, for example inheritance, business sale, long-term salary, investments or property portfolio. It is broader and more structural than Source of Funds, and is required under FATF Rec. 12 for PEPs and other high-risk customers. Evidencing SoW typically requires tax returns, audited accounts, trust deeds or probate documents rather than a single bank statement.

Structuring (sometimes called smurfing when multiple individuals are used) is a placement-stage laundering technique designed to stay below thresholds such as the US Currency Transaction Report USD 10,000 trigger or the FATF Rec. 22 EUR/USD 3,000 casino CDD threshold. It is itself a standalone offence under 31 USC 5324 in the US, irrespective of whether the underlying funds are criminal. Modern TM rules detect velocity-based patterns, multiple deposits just below threshold, and aggregation across linked accounts.

Required by FATF Rec. 20, SARs (called STRs in many jurisdictions) are filed with the FIU - the UK NCA, US FinCEN, Canada FINTRAC, France TRACFIN, etc. There is no monetary threshold for suspicion-based reporting. Filing protects the operator from ML liability and is legally privileged in most regimes. Tipping off the customer about a SAR is a separate criminal offence under POCA s.333A (UK) and equivalent statutes.

Tipping off is a criminal offence under POCA 2002 s.333A in the UK (max 5 years imprisonment), 18 USC 1510(b) in the US and equivalent provisions in EU 6AMLD. Operators must train front-line staff to never reveal that a withdrawal hold, account closure or document request is AML-related. Even hinting via tone or visible system messages can constitute tipping off; processes must use neutral language such as 'regulatory checks'.

TBML uses over-invoicing, under-invoicing, multiple invoicing, phantom shipments or misrepresented goods to move value across borders while appearing to be normal commerce. FATF and the Egmont Group have identified TBML as one of the largest and least-detected laundering channels, with estimated volumes in the hundreds of billions annually. It is less directly relevant to most gambling operators but can appear via affiliate payment flows, B2B supplier invoicing and crypto-merchant settlement.

Transaction monitoring uses rules, thresholds and increasingly machine-learning models to flag unusual deposits, withdrawals, velocity, structuring patterns or counterparty risk. Each alert is reviewed by an analyst and either closed as false positive, escalated for EDD, or filed as a SAR. UKGC and MGA expect documented rule sets reviewed at least annually and tuned to the operator's product mix; common gambling-specific rules include rapid deposit-withdrawal with minimal play (chip-dumping) and chip purchases without commensurate gameplay.

FATF Recommendation 16 (the Travel Rule) requires financial institutions and Virtual Asset Service Providers to obtain, hold and transmit originator and beneficiary information for wire transfers and virtual asset transfers above USD/EUR 1,000. The rule is designed to prevent anonymous movement of funds across the financial system. For crypto, it was extended via the 2019 FATF guidance on virtual assets, and is now enforced through the EU Transfer of Funds Regulation (TFR) and FinCEN equivalents.

POCA 2002 sections 327 (concealing), 328 (arrangements) and 329 (acquisition, use, possession) create the three principal ML offences, each carrying up to 14 years imprisonment. Section 330 imposes a personal reporting obligation on individuals in the regulated sector; section 333A creates the tipping-off offence. UKGC-licensed operators must comply with POCA in parallel with MLR 2017; POCA offences carry no monetary threshold.

FATF Rec. 24 and 25, the EU 4th/5th/6th AMLDs and UK MLR 2017 require operators to identify the UBO behind any corporate customer, payment provider or affiliate. The default threshold is 25% ownership or control, though some regimes (e.g. Germany's Transparency Register, France) apply lower thresholds. UBO opacity is a primary money-laundering vector, especially via shell companies and nominee directors.

FATF defines a VASP in Rec. 15 as any natural or legal person conducting exchange between virtual assets and fiat or other VAs, transfer of VAs, safekeeping/administration, or participation in issuance/sale services. VASPs are subject to the full AML/CFT regime including licensing/registration, CDD and the Travel Rule. The EU's MiCA Regulation and Transfer of Funds Regulation operationalise this for European crypto firms.

Formed in 2000, the Wolfsberg Group publishes principles and FAQs that are widely treated as best-practice benchmarks by regulators and supervised firms. Key outputs include the Wolfsberg CBDDQ (Correspondent Banking Due Diligence Questionnaire), Sanctions Screening Guidance and Payment Transparency Standards. Although bank-focused, much of the guidance is applied by gambling operators particularly around correspondent payment-provider due diligence and sanctions tuning.