AML Requirements for Gambling Operators: FATF’s New Risk Indicators

Gambling and iGaming, Corporate Clients Insights, AML, White collar crimes and investigations

The Financial Action Task Force (FATF) has once again sharpened its focus on a sector presenting increasingly complex money laundering, terrorist financing and proliferation financing risks: gaming and gambling. Its September 2026 report, “Risks of Gaming and Gambling”, is not merely a typology exercise. It is a clear regulatory signal that the digitalisation, internationalisation and increasing financial sophistication of gambling markets are creating vulnerabilities that can no longer be addressed through traditional, transaction-level AML controls alone.

The report identifies a broad range of risk indicators affecting land-based and online casinos, betting, lotteries, bingo, gaming and illegal gambling markets. More significantly, however, it demonstrates how gambling platforms can be exploited as financial channels, including through third-party funding, rapid movement of funds, multiple accounts and payment instruments, virtual assets, offshore structures and the use of unlicensed operators.

From the perspective of companies operating at the intersection of AML compliance, financial services regulation and financial crime risk management, the report marks an important development. It reframes gambling risk from a question concerning the conduct of individual customers to one concerning the integrity of the wider ecosystem through which gambling-related funds are transferred, converted and ultimately integrated into the legitimate financial system.

Gambling Platforms as Financial Channels

At the core of FATF’s analysis is a recognition that gambling services may be used for purposes extending well beyond genuine gambling activity.

The report identifies patterns involving substantial deposits followed by limited or no gambling, rapid deposits and withdrawals, withdrawals disproportionate to gambling activity, and the movement of funds between multiple accounts and payment methods. Such activity may indicate that the gambling platform is being used primarily as a mechanism for transferring or disguising funds rather than for participating in legitimate gaming.

This distinction is particularly important in the online environment. The speed with which funds can be deposited, wagered and withdrawn, combined with the availability of multiple payment channels, can make it difficult to distinguish legitimate customer behaviour from deliberate financial structuring.

The implications for operators are immediate. AML frameworks must increasingly assess the economic substance of gambling activity, rather than relying solely on formal transaction thresholds or conventional customer risk classifications.

A customer who deposits a significant amount and subsequently withdraws most of it after minimal gambling activity presents a materially different risk from a customer whose transactions are consistent with an established pattern of genuine betting. The difference lies not necessarily in the individual transaction, but in the relationship between the customer’s funding, gambling behaviour and subsequent movement of funds.

Recharacterising Gambling Risk Through Behavioural Indicators

A critical contribution of the FATF report lies in its detailed identification of behavioural and transactional indicators.

These include multiple accounts connected to the same device or IP address, repeated use of VPNs, discrepancies between a customer’s declared location and detected location, frequent changes in payment methods, third-party deposits, transactions involving multiple unrelated individuals and activity involving numerous international accounts.

FATF also identifies the structuring of deposits into smaller amounts to remain below identification or reporting thresholds, repeated withdrawals just below applicable thresholds, and multiple smaller deposits from different sources which are subsequently consolidated into larger withdrawals.

None of these indicators, considered in isolation, establishes money laundering or terrorist financing.

FATF expressly recognises that individual indicators may have legitimate explanations and that some may also be associated with problem gambling rather than financial crime. Their significance arises from their combination and the context in which they occur.

For businesses, this reinforces the importance of a genuinely risk-based approach.

The regulatory expectation is increasingly moving away from a model in which an individual alert automatically leads to a predetermined compliance response. Instead, obligated entities should be able to demonstrate how multiple indicators were assessed collectively, what additional information was obtained, and why the resulting risk assessment was considered proportionate.

This distinction is particularly important from a legal perspective. A red flag is an indicator of risk, not proof of criminal conduct. Effective AML governance must preserve that distinction while ensuring that potentially suspicious activity is appropriately escalated and, where legally required, reported.

Structuring, Multiple Accounts and Transaction Monitoring

The typologies identified by FATF demonstrate how traditional money laundering techniques can be adapted to the gambling environment.

A purely transaction-based monitoring model may fail to identify the relevant pattern because each individual transaction appears relatively low risk. The risk becomes apparent only when transactions are aggregated across time, accounts, payment methods and potentially related customers.

The same applies to multiple gambling accounts. Where several accounts are controlled from the same device, IP address or location, or where they share payment instruments or other identifying characteristics, the relevant risk may lie in the relationship between the accounts rather than in the activity of any individual account.

For operators, this places greater emphasis on the ability to conduct network-level and behavioural analysis, particularly within online gambling environments.

This is also where the distinction between compliance by design and compliance by documentation becomes important. An AML policy may contain appropriate provisions concerning structuring, third-party payments and suspicious activity. That does not necessarily mean that the operator’s systems are capable of identifying those risks in practice.

The effectiveness of the control environment must therefore be capable of being demonstrated through actual monitoring, escalation and decision-making processes.

Payment Systems and Third-Party Funding

Another significant area identified by FATF concerns the payment ecosystem surrounding gambling.

The report identifies heavy use of cash, frequent cash deposits, multiple payment methods registered in different names, combinations of fiat and virtual assets, withdrawals to accounts different from the original source of funds, third-party deposits, multiple international bank accounts, rapid withdrawals to different beneficiaries and transactions involving higher-risk jurisdictions as relevant risk indicators.

The implications extend beyond gambling operators. Banks, payment institutions, electronic money institutions, virtual asset service providers and other financial intermediaries servicing gambling businesses may also be exposed to these risks.

A transaction that appears ordinary when examined independently may form part of a substantially more suspicious pattern when considered alongside the customer’s gambling activity, funding history and subsequent movement of funds.

This creates a particular challenge for regulated financial institutions. They may have visibility over the payment leg of the transaction but not necessarily over the underlying gambling behaviour. Gambling operators, conversely, may understand the customer’s betting activity without having complete visibility over the wider source of funds.

This makes information-sharing and effective cooperation between gambling operators and financial institutions increasingly important. The regulatory boundary between gambling risk and financial services risk is consequently becoming increasingly difficult to maintain.

Illegal and Offshore Gambling as a Structural Risk

A particularly important aspect of the FATF analysis concerns illegal and unlicensed gambling.

FATF identifies illegal gambling markets as a significant source of money laundering and other financial crime risks and highlights the use of offshore operators, unlicensed platforms and arrangements designed to circumvent regulatory restrictions.

The problem is not limited to the operators themselves. Unlicensed platforms may interact with payment providers, technology companies, affiliates, marketing businesses and legitimate gambling operators. The resulting ecosystem can create channels through which illicit funds enter the regulated financial system.

The report also identifies the use of so-called “sham merchants”, whereby gambling-related transactions may be disguised as payments for apparently legitimate goods or services.

For regulated businesses, this creates a counterparty and ecosystem risk. It is therefore increasingly insufficient to establish that a customer or commercial counterparty is formally incorporated and apparently legitimate. Companies may also need to consider whether that entity has connections to unlicensed gambling activity, whether its regulatory status is credible, and whether the commercial relationship has a legitimate economic rationale.

This is particularly relevant for businesses operating across multiple jurisdictions, where a gambling service may be legally authorised in its home jurisdiction while seeking to access customers or financial infrastructure in jurisdictions where its activity is not permitted.

Beneficial Ownership and Corporate Structures

The FATF report also places significant emphasis on beneficial ownership risk.

Complex ownership structures, nominee arrangements, trusts and foundations, unexplained changes in ownership and the deliberate fragmentation of shareholdings may all indicate attempts to obscure the identity of persons exercising effective control.

This is particularly relevant in the gambling sector because licensing, ownership and suitability requirements often make transparency of control a fundamental regulatory issue. FATF identifies commercially questionable acquisitions and transfers of gambling businesses as additional risk indicators, including purchases of under-performing businesses at inflated valuations and unexplained transfers involving financially successful gambling companies.

For businesses and regulators, this reinforces the principle that beneficial ownership verification cannot be reduced to identifying the individual whose name appears in a corporate register.

A meaningful assessment may require consideration of the entire ownership and control structure, the source of acquisition funding, shareholder arrangements, voting rights, related-party transactions and the economic rationale for changes in ownership.

For professional advisers involved in gambling licensing, M&A transactions or regulatory restructuring, this also creates a broader due diligence consideration. The relevant question is not simply whether a proposed ownership structure is legally permissible, but whether it is sufficiently transparent to withstand regulatory scrutiny and support a defensible AML risk assessment.

Virtual Assets and the Gambling Ecosystem

The intersection between gambling and virtual assets adds another layer of complexity. FATF identifies the use of virtual assets and virtual asset wallets on unlicensed platforms, combinations of fiat and virtual-asset payments, international withdrawals in virtual assets and business-to-business transactions involving virtual assets as relevant indicators.

The issue is not necessarily the use of virtual assets itself. The more relevant questions are who controls the wallet, the origin of the assets, the regulatory status of the relevant virtual asset service provider, the purpose of the transaction and whether the movement of value is consistent with the customer’s established profile.

For crypto businesses servicing gambling operators, the analysis operates in the opposite direction: the source and destination of funds should be assessed with an understanding of the underlying gambling activity and the specific risk typologies identified by FATF.

For EU-based Crypto-Asset Service Providers, this is particularly relevant given the increasingly integrated regulatory framework under MiCA and the EU AML regime.

The EU Context: Gambling within the AML Framework

Within the European Union, FATF’s findings should be considered alongside the new EU AML framework.

Regulation (EU) 2024/1624 expressly brings providers of gambling services within the EU’s harmonised AML framework. The Regulation adopts a risk-based approach and recognises that gambling activities differ substantially in their nature, geographical scope and associated ML/TF risks.

The framework also establishes specific customer due diligence requirements for gambling services. Customer due diligence is triggered where winnings are collected or a stake is placed, or both, in transactions amounting to at least EUR 2,000, including where the threshold is reached through linked transactions.

The concept of linked transactions is particularly significant in light of FATF’s findings concerning structuring. The regulatory challenge is therefore not simply to identify a transaction exceeding a particular threshold. Systems must be capable of identifying relationships between transactions and recognising circumstances in which a customer may deliberately structure activity below applicable thresholds.

At the same time, the EU framework preserves the principle of proportionality. The presence of a risk indicator does not automatically justify treating a customer as high risk or applying enhanced measures without further assessment.

For EU gambling operators, the FATF report consequently provides a useful practical reference point for assessing whether existing monitoring systems adequately reflect the risk-based requirements emerging under the EU AML framework.

Implications for Bulgarian Gambling Operators

For Bulgarian gambling businesses, these developments are particularly significant. Gambling organisers operating in Bulgaria are subject to AML obligations under the Prevention of Money Laundering Act, with the National Revenue Agency exercising supervisory functions in respect of licensed gambling operators.

The Bulgarian framework has also established a direct connection between AML compliance and the continued validity of a gambling licence. Systematic breaches of specified AML obligations may result in the revocation of a gambling licence.

This gives AML compliance a significance extending beyond conventional regulatory reporting.

For a Bulgarian operator, deficiencies in customer due diligence, transaction monitoring, beneficial ownership verification or internal AML controls may ultimately have consequences for the operator’s ability to conduct its licensed business.

FATF’s new indicators should therefore be viewed not merely as international guidance but as a practical benchmark against which Bulgarian operators can test the effectiveness of their existing AML frameworks.

This is particularly relevant for online operators, where the combination of multiple accounts, digital payment methods, international customers, VPN usage, virtual assets and cross-border counterparties can create substantially more complex risk profiles than those associated with traditional land-based gambling.

The Supervisory Challenge: From Formal Compliance to Effectiveness

FATF’s publication also reflects a broader evolution in international AML regulation: the increasing emphasis on effectiveness.

For regulators, it is no longer sufficient that an operator has AML policies, procedures and risk assessments on paper. The more important question is whether those controls identify and mitigate the risks actually present in the business. For operators, this creates a corresponding evidentiary challenge.

A defensible compliance framework should be capable of demonstrating:

• how the operator identified its principal ML/TF risks;
• how those risks informed its customer risk methodology;
• how transaction-monitoring scenarios were designed;
• how alerts are investigated and escalated;
• how related accounts and transactions are identified;
• how beneficial ownership information is verified;
• how third-party and payment risks are assessed; and
• how decisions to continue, restrict or terminate relationships are documented.

This is particularly important in the context of regulatory supervision and enforcement. The existence of a written AML policy may provide limited protection where the operator’s systems and actual practices do not correspond to that policy.

Strategic Considerations for Market Participants

For compliance professionals and legal teams, the direction is clear. Gambling-related AML risk is becoming increasingly behavioural, interconnected and data-driven.

Companies operating in or servicing the sector should consider:

• Reviewing business-wide ML/TF risk assessments to ensure that they reflect the operator’s actual products, customers, jurisdictions, payment methods and distribution channels;
• Strengthening transaction monitoring to identify linked transactions, rapid deposits and withdrawals, limited gambling activity, structuring and unusual payment patterns;
• Assessing account relationships and digital identifiers, including common devices, IP addresses, payment instruments and other indicators of potentially connected accounts;
• Enhancing beneficial ownership due diligence, particularly where ownership structures are complex, cross-border or commercially unusual;
• Reviewing third-party and counterparty exposure, including relationships with payment providers, affiliates, technology providers, white-label operators and offshore entities;
• Assessing exposure to illegal or unlicensed gambling, including indirect exposure through customers, counterparties and payment flows;
• Reviewing virtual asset exposure, particularly where customers or counterparties use crypto-assets in connection with gambling activity; and
• Testing whether AML policies are operationally effective, rather than limiting the review to whether the required policies and procedures formally exist.

Conclusion

The FATF report marks an important evolution in the regulatory treatment of gaming and gambling risks. It shifts the focus from individual gambling transactions towards the broader financial and technological ecosystem in which those transactions take place.

For gambling operators, financial institutions and service providers, the message is clear. AML exposure can no longer be assessed solely through customer identification, transaction thresholds or isolated suspicious activity alerts. Risk increasingly emerges from behavioural patterns, interconnected accounts, payment structures, beneficial ownership arrangements and relationships with offshore and unlicensed entities.

For Bulgarian operators, this development is particularly relevant given the existing AML supervisory framework and the potential licensing consequences of systematic AML breaches.

The practical challenge is therefore not simply to incorporate FATF’s new indicators into an AML policy. It is to determine whether the operator’s systems, governance arrangements and compliance processes are capable of identifying the underlying patterns which those indicators describe.

As gambling markets become increasingly digital, cross-border and integrated with the wider financial system, effective AML compliance will depend on the ability to understand how value moves through the gambling ecosystem, who ultimately controls it, and whether the activity has a credible economic rationale.

FATF’s latest publication provides both a risk framework and a practical basis for reassessing existing AML controls. For businesses operating in this environment, the report should therefore be treated not simply as a catalogue of red flags, but as a broader indication of the regulatory expectations that will increasingly shape the supervision of gambling and its surrounding financial ecosystem.

New Balkans Law Office advises Bulgarian and international clients on AML compliance, financial crime risk management and regulatory matters, including the application of EU and Bulgarian AML requirements to regulated businesses and financial-sector participants.