09 September 2026
FATF ¦ Risks of Gaming and Gambling: Red Flag Risk Indicators
Gambling and gaming as an interconnected value-transfer ecosystem
The Financial Action Task Force (FATF) has updated its assessment of the money laundering, terrorist financing and proliferation financing risks of casinos, gambling and gaming, and has paired it with a catalogue of red-flag indicators. The earlier FATF and Asia/Pacific Group work dated from 2009 and looked at casinos. The new picture is one of online, cross-border, multi-product and multi-payment platforms that connect with banks, payment providers, virtual asset firms and social media.
The findings draw on questionnaire responses from 80 jurisdictions, written comments from 29, consultation with industry bodies, researchers and private sector stakeholders, and numerous case studies. For compliance teams the result is a risk assessment and a working list of indicators in one publication.
From casinos to video games: the scope of the assessment
The FATF looked at online and brick-and-mortar casinos, sports and novelty betting, other non-casino gambling such as scratch cards, arcades, bingo, lotteries and slot machines outside casinos, and online video and mobile gaming. It also examined risks from illegal operators, the business models and delivery channels in use, how these services interact with the financial system and where they intersect with social media.
The FATF has no strict definition of a casino. Under the risk-based approach, jurisdictions assess their own risks and apply proportionate measures. That freedom explains part of the problem: the scope of AML/CFT regulation varies between jurisdictions, some actors in the ecosystem fall outside national frameworks, and countries differ in what they treat as risk-exposed gaming activity.
Payment mix and delivery channel drive the risk
The sector has grown, online platforms have multiplied and services and payment mechanisms increasingly overlap. Customers can pay with cash, cards, bank transfers, virtual assets, mobile money, third-party intermediaries and money or value transfer services. The level and type of money laundering risk depends on the combination of payment methods and services offered, and on whether the operator is land-based or online.
Cash, e-wallets, mobile money and virtual assets are particularly vulnerable. The range of accepted methods allows rapid, anonymous, cross-border transactions and the conversion of value into different forms.
Where money laundering risk concentrates
Money laundering through gambling is an established risk in many jurisdictions. Brick-and-mortar and online casinos and sports betting are considered particularly exposed, while lotteries, scratch cards and some other non-casino forms may be viewed as less exposed by some jurisdictions. On the evidence available, laundering through gaming appears to happen on a smaller scale, and with less sophistication and frequency, than through gambling.
The abuse of gambling operators for illicit finance is linked with corruption, cyber-enabled fraud, professional money laundering networks and organised crime. Illegal and unlicensed offshore gambling is cited as a significant risk. In some countries the illegal market rivals or even exceeds the legal one and keeps growing, drawing players in with promotions and greater confidentiality.
Terrorist and proliferation financing: narrower, but present
Terrorist financing typologies related to gambling remain limited and are reported less often. Online gaming shows more observable and documented misuse for terrorist financing, influenced by social and technological factors. The vulnerability to proliferation financing may exist in both gaming and gambling, but the risk is very limited.
Social media widens the exposure
Gaming and gambling platforms are increasingly interlinked with social media and other digital platforms, which raises the risk. Social media can be used to communicate and coordinate illicit activity such as competition manipulation, to advertise illegal or unlicensed gambling, to recruit money mules, to spread terrorist propaganda and to raise funds for terrorist financing.
Ownership and licensing: who really controls the operator
Junkets are declining and increasingly tightly regulated, yet they still raise concerns about the anonymity of players and the obscured beneficial ownership of the junket operator. The ownership indicators in the FATF list extend that concern to operators generally. They include cross-border ownership structures that obscure beneficial ownership and control and may hide criminal elements during licensing, numerous or complex legal arrangements such as nominees, trusts and foundations, and shareholdings structured to stay under thresholds for regulatory checks, especially where AML/CFT and anti-corruption controls are weak.
Other indicators concern citizenship-by-investment nationals or dual nationals as beneficial owners, ownership transfers that make no commercial sense, such as giving away a profitable business or buying an under-performing one at an inflated price, and a gambling licence followed by a long period of inactivity. Open-source information linking beneficial owners to organised crime, bribery, corruption, fraud, modern slavery or competition manipulation is treated as an indicator in its own right.
How to read the red-flag indicators
The indicators come from country questionnaires and were elaborated with open-source research and work by other international organisations. The list is not exhaustive. A single indicator is not necessarily a clear sign of money laundering, terrorist financing or proliferation financing, but it can prompt further monitoring and examination, and several indicators for one customer or transaction warrant closer examination. Some indicators may instead reflect problem gambling, and the two can exist side by side.
Most of the indicators concern land-based and online casinos and, to a lesser extent, betting. Indicators for video games were uncommon, although they share features with online casinos and betting platforms and some of the listed indicators apply to them as well. The list is organised into customer behaviour and profile, betting patterns, payment methods and transactions, and product and platform features, with separate points for online and land-based settings where they differ.
Customer behaviour and betting patterns
In venues, indicators include attempts to influence or bribe staff to skip customer due diligence, dealing with only one member of staff, using third parties to place cash, buy chips or place bets, asking for winnings in cash up to a threshold and never collecting the balance, and buying winning tickets from other customers to present them as one’s own. Online, the FATF points to repeated VPN use, multiple devices, mismatches between claimed and detected location, several accounts under the same or a fake name, reluctance to appear on a video call and attempts to re-register an account that was closed as suspicious.
Across both settings, profiles that do not fit are central: wealth or funds that cannot be explained, reluctance to evidence source of wealth, and source-of-wealth checks that show income from trading dual-use goods with sanctioned states, such as washing machines, cars or medical equipment. Sanctions matches, PEP status and customers with no known relationship who share funds also appear on the list.
Betting patterns point to collusion and to money moved without genuine play: one player consistently winning against another, chip dumping in peer-to-peer settings, betting on all outcomes such as red and black in roulette, low wagers alongside large deposits and withdrawals, deposits structured to stay under reporting thresholds, winnings collected just below an identification threshold, and short-odds bets used to justify withdrawals. Bets by people linked to the sport concerned, bets on events flagged by integrity bodies and a highly improbable winning streak may indicate collusion, insider information or corruption.
Payment and platform indicators
On the cash side, the FATF lists heavy use of higher-denomination notes, cash loading of digital accounts through a betting shop linked to a remote account, and numerous daily cash deposits within seconds of each other. On the digital side, it names virtual assets, prepaid cards, vouchers and e-wallets, multiple payment methods in different names, deposits followed by withdrawals with minimal play, withdrawals to an account other than the source, pooled deposits followed by a single transfer, mule accounts, high-velocity transfers, unlicensed remittance providers, chargebacks against several cards and repeated attempts to bypass responsible gambling limits.
At operator level, unexplained profitability or revenue spikes, large business-to-business cross-border flows unrelated to gambling, rapid expansion into payment or virtual asset services, contracts with intangible service providers that lack commercial sense, dependence on white-label arrangements without oversight, customer intake through introducers and agents, and frequent changes of URLs or brand names all appear as indicators. One typology concerns sham merchants: illicit operators disguise themselves as legitimate domestic businesses so that gambling payments look like ordinary retail transactions.
Supervisory gaps and the FATF recommendations
The scope of AML/CFT supervision, the distribution of oversight responsibilities, licensing regimes and market entry controls differ between jurisdictions. Supervisors, law enforcement and operators struggle with regulatory arbitrage by operators, limited information sharing between the private and public sectors, difficult international co-operation, illegal gambling and the speed of technological change. Many of the best practices shared concern gambling, because risk is better understood and reported there than in gaming.
The FATF recommends improving risk awareness and applying a risk-based approach under Recommendation 1, strengthening licensing and registration so that criminals cannot control gambling operators, raising awareness among service providers and the public, especially on illegal offshore gambling, strengthening formal and informal international co-operation on online, illegal and cross-border activity, and developing public-private partnerships for faster information sharing.
What this means for operators, banks and payment providers
For operators, the indicators are most useful when monitoring combines behaviour, payments and account data, because most single signals have innocent explanations. The overlap with problem gambling means alerts should be reviewed with responsible gambling teams as well as compliance.
Banks and payment providers see the other side of the same flows. Merchant descriptions that do not match the underlying activity, mule accounts, rapid pass-through of funds and business-to-business payments that have no link to regulated gambling are the points where an operator’s laundering activity becomes visible outside the platform. The ownership indicators matter to anyone that licenses, banks or supplies an operator, since hidden control and commercially odd ownership transfers are among the clearest warnings the FATF identifies.
Dive deeper
- FATF ¦ Risks of Gaming and Gambling ¦ Link
EU Sanctions Helpdesk
The EU Sanctions Helpdesk platform supports European operators in complying with European Union restrictive measures (also known as sanctions) imposed worldwide.
Aimed primarily at Small and Medium-sized Enterprises (SMEs), the Helpdesk offers resources and personalised help to companies performing sanctions due diligence checks.