Managing AML and responsible gambling in a shifting landscape

Global growth brings industry change

The gambling sector globally is growing at a fast pace. The online global gambling market alone is projected to reach USD97 billion in 2024 and USD133 billion by 20291. Whilst there are established gambling jurisdictions, such as the UK, Australia,

EU, Malta, Isle of Man and Gibraltar, new markets are opening facilitated through remote gambling accessed via mobile phones and devices. Remote gambling has substantially increased the reach of gambling operators to offer their services to a wider customer base. This exponential growth fueled by technology, has been combined with an increase in favourable legislation, such as the legalisation of sports betting in the USA.

Regulators globally are trying to keep pace, which has resulted in an ever-shifting regulatory landscape. For example, Irelands’ Senate is expected to sign a new Gambling Act into law during 2024, which will create its first Gambling Regulator. Brazil, which has a market of almost 2 million customers, is establishing a formalised gambling regulatory framework.

New Zealand plans to regulate online casinos by 2026. The UAE established the General Commercial Gaming Regulatory Authority in 2023, which includes US lawmakers, indicating that gambling in the UAE will eventually become regulated.

As jurisdictions around the world open to the gambling sector, operators are finding innovative ways to attract new customers. The growth of the gambling sector will require careful monitoring of Anti- Money Laundering / Counter Financing of Terrorism (AML/CFT) frameworks and any updates for new player protection/responsible gambling laws and regulations designed to protect vulnerable customers.

Active regulators

Governments and regulators across the globe are reacting to an increase in money laundering and problem gambling risk.

• The UK Gambling Commission (UKGC) has issued fines exceeding a total of GBP40 million from January 2023 to April 2024.
• In Australia the Federal Court in 2023 issued a record-breaking AUD450 million fine for AML/CFT Act breaches, with regulatory action turning to on-line wagering.
• Ireland has a new Gambling Regulator coming into being Q4 2024, which will have to grapple with applying its legislation to the gambling industry in Ireland for the first time.

The recently elected Labour government in the UK may bring further changes with a focus on proposals set out in an existing White Paper. The White Paper includes proposed regulatory changes to protect vulnerable customers and relates to a full review of the Gambling Act, which predates the popularity of online gambling.

The EU has set up the Anti-Money Laundering Authority (“AMLA”) for a single rulebook on AML/CFT, which will impact gambling bringing increased attention on payment systems such as cryptocurrency, company ownership, bank accounts, transaction monitoring, customer due diligence, and record-keeping.

As an interesting example, in 2029, the EU will include football agents and some aspects of football club transactions into legislative scope, so transfer fees and betting/sponsorship payments will likely be impacted.

Industry risks and weaknesses

Criminals use innovative methods including stolen IDs, multiple accounts, mule accounts, and cryptocurrencies to obscure fund sources. There is a risk that operators may be used for money laundering, terrorist financing or proliferation financing activity, which poses a risk to society and the wider industry.

The industry is particularly exposed to receiving the proceeds of fraud and theft to fund gambling habits. Recent National Risk Assessments and law enforcement activity has identified ‘lifestyle’ money laundering by career criminals as a risk uniquely faced by the gambling industry. 

Failure to implement safeguards to protect vulnerable customers may lead to social detriment. If left unchecked, this could lead to:

• regulatory breaches;
• increased compliance costs;
• international scrutiny; and
• critical failure of gambling operations, negatively impacting customers and the industry.

Despite industry efforts, regulators continue to identify weaknesses

1. Policy and procedures: Operators failing to adequately implement effective policies, procedures, and controls.
2. Risk assessment: Inadequate risk assessments, as key risks, are not being considered.
3. Activity monitoring: Weaknesses in key player protection controls including, self-exclusion schemes, ‘cooling off periods’, enhanced ‘VIP’ monitoring and deposit limit control breaches, where significant deposits and betting activity occurred prior to KYC (Know Your Customer) checks being completed.
4. Triggers and thresholds: Inadequate transaction monitoring, including, high monetary thresholds and thresholds not triggering risk based AML/ responsible gambling reviews as appropriate.
5. KYC (Source of funds and source of wealth): Operators obtaining inadequate documentation from customers. For documentation received, operators have been identified as not applying appropriate scrutiny of obscure/high risk proof of funds, such as recycled winnings and crypto.
6. Resources: Employing insufficient resources to adequately manage the operator’s financial crime and responsible gambling risks.
7. Responsible gambling interaction: Operators not always interacting with a customer who may be at risk of, or experience harms associated with gambling.

Tailor your risk assessment and resources

Gambling operators are responsible for designing their own financial crime and responsible gambling frameworks, but understanding what is necessary and proportionate can be difficult to envisage and implement. Companies must also run a commercial operation whilst applying resources to maintaining financial crime compliance, managing risk, and ensuring that it is able to embed responsible gambling frameworks.

Where an operator holds licences in multiple jurisdictions, it should ensure its risk assessment methodology identifies the specific risks affiliated to each different jurisdiction. Regulators will expect a risk assessment that is tailored to each entity.

This assessment will enable the operator to identify key risks it faces that may be unique to its industry segment and very different from traditional “financial services” businesses, and then appropriately obtain the resources required for monitoring and control of those risks. Notably, risks faced in one jurisdiction may not be the same as in another. Identification and assessment will be required for each risk. This includes whether it is remote/non-remote, local regulatory requirements, products, customer type, geographical location, and legal and AML framework of that jurisdiction.

Operators should focus on ensuring that the risk assessment is an active document that is frequently reviewed and updated when required and that it informs all other aspects of its financial crime framework. That framework includes regulatory relationships, policy and procedures, controls, governance, assurance, reporting, training, culture, and horizon scanning for future regulatory changes. Operators should also ensure that they consider lessons learnt from regulatory sanctions and guidance material provided by their applicable regulator(s) and any other relevant external sources.

As a number of sectors of the gambling industry are reliant on third-party payment providers, there is an emerging focus on understanding the risks associated with payment channels and their ability to obfuscate the source and nature of funds.

How Grant Thornton can support your business

With a focus on proactive support, our team assists clients in navigating regulatory requirements and enhancing all aspects of their financial crime frameworks. We identify gaps and offer views on enhancements based on our expertise and industry best practice, whilst also calling out positive practice when we see it. Any reports for engagements by companies, are drafted and discussed prior to finalisation.

We excel in supporting clients through all aspects of regulatory assessment - from preparing for a regulator’s visit, to delivering independent audits, right through to supporting remediation activities to address findings. Our approach is tried and tested and emphasises open dialogue with the regulator, cooperation, effective project management, quality assurance and realistic resourcing to achieve timely and high-quality outcomes.

Contact us to find out more about how Grant Thornton can help your business meet its regulatory obligations.