The gaming and gambling industry has undergone a significant transformation. What was once largely a land-based, cash-intensive sector now includes online casinos, mobile gaming, sports betting, digital wallets, virtual assets, cross-border payments, third-party technology providers, and increasingly interconnected digital platforms.
That evolution has created tremendous opportunity, but it has also changed the financial crime risk landscape.
In its September 2026 report, Risks of Gaming and Gambling, the Financial Action Task Force (FATF) provides an updated assessment of money laundering, terrorist financing, and proliferation financing risks across the global gaming and gambling ecosystem. The work covers brick-and-mortar and online casinos, sports and novelty betting, lotteries and other non-casino gambling, online and mobile gaming, and risks associated with illegal operators.
The report is particularly significant because of its breadth. FATF's findings were informed by questionnaire responses from 80 jurisdictions, written comments from 29 jurisdictions, targeted consultation with industry bodies, researchers and private-sector stakeholders, and numerous jurisdictional case studies.
The Risk Environment Is Becoming More Complex
One of the clearest themes from FATF's analysis is convergence.
Gaming and gambling operators increasingly operate within an interconnected value-transfer ecosystem involving cash, cards, bank transfers, e-wallets, mobile money, virtual assets, third-party intermediaries and money or value transfer services. FATF notes that the type and level of money laundering risk can differ substantially depending on the products offered, payment methods used, and whether the operator is land-based or online.
FATF identifies brick-and-mortar and online casinos and sports betting as particularly exposed to money laundering risk. It also highlights vulnerabilities associated with payment methods that can facilitate rapid, cross-border transactions and conversion of value between different forms.
For operators, this means AML risk can no longer be assessed solely through the traditional lens of customer wagering activity. The broader movement of funds, customer identity, geography, devices, payment instruments, third parties, and platform behavior all contribute to the risk picture.
Red Flags Operators Should Be Evaluating
The report provides a useful set of risk indicators that can help inform transaction monitoring, customer due diligence, investigations, and broader risk assessments.
Among the indicators identified by FATF are:
- Repeated VPN use, multiple devices, and inconsistencies between a customer's stated residence and detected location.
- Customer wealth or funds that are inconsistent with the customer's profile or cannot be reasonably explained.
- Sudden changes in betting behavior, structuring deposits below reporting thresholds, and withdrawals that are not commensurate with actual gambling activity.
- Deposits followed by withdrawals with minimal or no play, third-party deposits, rapid withdrawals to different beneficiaries, and transactions involving higher-risk jurisdictions.
- Multiple payment methods in different names associated with the same player account.
- Dependence on third-party providers or white-label arrangements without robust oversight.
Importantly, FATF cautions that one indicator alone does not necessarily establish ML/TF/PF activity. Rather, indicators should prompt appropriate monitoring and examination, particularly when multiple indicators appear in connection with the same customer or transaction.
That distinction is critical to an effective risk-based AML program.
What This Means for Operators
The question for gaming and gambling operators is not simply whether an AML program exists. The more important question is whether that program reflects how the business and its risks operate today.
FATF recommends improving risk awareness, applying a risk-based approach, strengthening licensing and registration controls, increasing international cooperation, and developing stronger public-private information-sharing mechanisms.
From an operational standpoint, operators should consider whether their current frameworks adequately address emerging risks across:
Enterprise and product risk assessments. Risk assessments should reflect changes in products, jurisdictions, customer demographics, payment methods, delivery channels, and third-party dependencies.
CDD and EDD. Customer risk should be evaluated dynamically rather than solely at onboarding, particularly where customer behavior, source of funds, payment activity, geography, or account characteristics change.
Transaction monitoring. Monitoring scenarios should reflect gaming-specific typologies rather than relying exclusively on traditional financial-services indicators.
Third-party risk. Payment processors, technology providers, affiliates, white-label partners, and other critical vendors can materially affect an operator's financial crime exposure.
Independent testing. AML programs should be periodically challenged to determine whether written policies, monitoring controls, escalation procedures, and actual operational practices remain aligned with the operator's risk profile.
The FATF report reinforces a broader reality for the gaming and gambling sector: financial crime risk is becoming more complex as products, payment methods, technology, and customer activity become increasingly digital and interconnected.
Operators should view these developments as an opportunity to reassess whether their current AML frameworks remain aligned with their actual risk exposure. Effective compliance will depend on maintaining a clear understanding of evolving typologies, identifying meaningful red flags, and ensuring controls are proportionate to the risks presented by customers, products, jurisdictions, payment methods, and third-party relationships.
Ultimately, a strong AML program is not defined by the number of controls in place, but by how effectively those controls identify, assess, and respond to real financial crime risk.
Read the FATF report here: Risks of Gaming and Gambling