Summary
- The Report supplies risk indicators and policy recommendations without creating directly enforceable operator duties. Its wider coverage does not establish that every gaming business is legally a casino. (Report, Key findings, paras. 1–4, 18; FATF Mandate, paras. 3(a)–(c), 48.)
- FATF identifies casinos and sports betting as particularly exposed to money laundering. Available evidence indicates smaller-scale or both less sophisticated and less frequent laundering through gaming. Operators should preserve these distinctions in their assessments. (Report, Key findings, paras. 6–8.)
- FATF reports more documented terrorist-financing misuse in online gaming than gambling, while describing proliferation-financing risks across these sectors as very limited. These sector-level findings do not exclude serious individual cases. (Report, Key findings, para. 9.)
- Customer identity, betting activity and payment flows need to be examined together. Deposits followed by withdrawals with little play, unrelated third-party funding and coordinated losses warrant attention, subject to the Report's contextual safeguards. (Report, pp. 4, 7–9.)
- Operator ownership and commercial arrangements deserve review alongside player activity. FATF identifies concealed control, poorly supervised white-label arrangements, questionable service contracts and disguised merchant identities among the risks. (Report, pp. 9–10.)
- A red flag does not establish criminal conduct. Several indicators warrant further examination, while some behaviours can reflect problem gambling or account compromise. FATF provides neither a numerical risk score nor an automatic reporting formula. (Report, Red-flag risk indicators, paras. 1–2; pp. 6–7.)
- FATF recommends better risk understanding, stronger licensing and registration, public awareness, international cooperation and consideration of public-private partnerships. National authorities must determine the legal measures appropriate to their jurisdictions. (Report, Key findings, para. 18.)
Scope and legal status of the publication
The Report should inform risk assessments without being presented as a new statute or an amendment to the FATF Recommendations. FATF's mandate separates its risk-analysis, standard-setting and peer-review functions. Paragraph 48 states that the mandate creates no intended legal rights or obligations. The September publication presents suggested measures and indicators within that institutional remit. It specifies no new offence, commencement provision, reporting deadline or penalty. (FATF, Mandate of the Financial Action Task Force, paras. 3(a)–(c), 48–49; Report, Key findings, paras. 4, 18.)
The existing FATF Standards include internet and ship-based casinos. Recommendation 22(a) addresses casino customer due diligence; Recommendation 23 covers other preventive measures. Recommendation 28(a) addresses casino licensing, criminal control and supervision. National implementation and the product's features remain necessary to determine a particular video game's legal classification. (FATF Recommendations (June 2026), Recommendations 22(a), 23, 28(a); Glossary, "Designated non-financial businesses and professions", fn. 101; Report, Key findings, para. 1.)
FATF examined casinos, sports and novelty betting, other non-casino gambling, and online video/mobile gaming. Its work includes illegal operators, payment channels and connections with social media. The 2009 FATF/APG study concentrated on physically present casinos and excluded online gaming and illegal gambling. The 2026 publication therefore covers activities outside that earlier study's scope; this expanded research coverage does not itself extend statutory obligations. (Report, Key findings, paras. 2, 5; FATF/APG, Vulnerabilities of Casinos and Gaming Sector (March 2009), p. 7.)
The public findings draw on questionnaire responses from 80 jurisdictions, written comments from 29 jurisdictions and targeted consultations. FATF also attributes its findings to jurisdiction-provided case studies. The public Report does not reproduce the underlying responses, case files or a quantified prevalence model. These contributions support FATF's qualitative findings, but they do not establish a measured global crime rate. The two jurisdiction counts must not be added because their overlap is not stated. (Report, Key findings, para. 3.)
Differences in money laundering and financing risks
Risk assessments should distinguish the product, delivery channel and payment method. FATF identifies land-based and online casinos and sports betting as particularly exposed to money laundering. Some jurisdictions consider lotteries, scratch cards and certain other non-casino products less exposed. This qualification prevents a universal ranking of every product or operator. (Report, Key findings, paras. 6–7.)
For gaming, FATF describes laundering as apparently smaller in scale or both less sophisticated and less frequent than in gambling. That assessment depends on currently available evidence. The publication contains few video-game-specific indicators, and most supplied indicators concern casinos, followed by betting. Transferring a casino indicator to a video game is an analogy that requires a relevant shared feature, such as a comparable payment, account or communication function. A product without that feature may require a different assessment. (Report, Key findings, para. 8; Red-flag risk indicators, para. 2; p. 9.)
The terrorist-financing comparison differs. FATF reports more observable and documented misuse in online gaming, while gambling-related typologies remain limited and less frequently reported. Social-media connections can support propaganda dissemination and fundraising, as well as coordination of other illicit activity. These observations concern documented misuse; they establish neither a customer-level probability nor proof that ordinary gaming communications finance terrorism. (Report, Key findings, paras. 9, 11.)
FATF describes proliferation-financing risks as very limited while acknowledging possible vulnerability. Its indicators still include sanctions matches, connections with sanctioned actors and income associated with dual-use-goods trade involving sanctioned states. A sector-level risk assessment cannot resolve whether a particular person or transaction triggers an applicable sanctions restriction. That decision requires the relevant sanctions measure, transaction facts and governing law. (Report, Key findings, para. 9; pp. 5–6.)
Cross-border exposure and supervisory gaps
The assessed activity extends beyond wagering into the receipt, conversion and movement of value. FATF identifies cash, cards, bank transfers, virtual assets, mobile money, intermediaries and money or value transfer services. A combination of payment channels can obscure the relationship between the person funding an account and the recipient of withdrawals. A proposed operational response is to review the complete funding and payout sequence, rather than assess each payment channel in isolation. (Report, Key findings, paras. 5, 10; pp. 8–9.)
Illegal and unlicensed offshore gambling warrants separate attention. FATF reports that illegal markets rival or exceed legal markets in some countries and describes confidentiality and promotions as attractions. It also identifies links with corruption, cyber-enabled fraud, organised crime and professional laundering networks. The Report provides no country-by-country market estimates or basis for treating every offshore operator as illegal. A particular operator's permissions and target markets require independent verification. (Report, Key findings, paras. 12–13.)
National differences in supervision, licensing and market-entry controls complicate cross-border responses. FATF identifies obstacles to information sharing and international cooperation, alongside difficulties addressing illegal activity and technological change. A licence in one jurisdiction does not, on this record, establish permission to serve customers elsewhere. Nor does the Report establish a national legal basis for sharing customer information with another business. (Report, Key findings, paras. 15–16; p. 10.)
Recommendations to jurisdictions
FATF proposes five areas of action. Authorities should improve risk understanding and apply proportionate measures. FATF also proposes stronger licensing and registration against criminal control, plus risk information for service providers and the public. It recommends stronger international cooperation and consideration of public-private partnerships. Several practices primarily concern gambling because reported risks and sector knowledge differ. (Report, Key findings, paras. 17–18.)
Recommendation 1 calls for proportionate controls and for countries to allow and encourage simplified measures, as appropriate, where risks are lower. Simplified customer due diligence is not appropriate if money laundering or terrorist financing is suspected or a specific higher-risk scenario applies. Authorities would need jurisdiction-specific risk findings to justify identical risk-based treatment of activities presenting materially different risks. Applicable minimum standards continue to apply. FATF provides no basis in this Report for classifying every product as high risk. (FATF Recommendations (June 2026), Recommendations 1, 22; Interpretive Note to Recommendation 10, para. 21; Report, Key findings, paras. 6–9, 18.)
For implementation, a proposed allocation would give licensing authorities responsibility for ownership checks and supervisors responsibility for testing operator controls. Financial intelligence units and law-enforcement authorities would address reporting and investigative cooperation within their powers. These are analytical applications of FATF's proposals. The Report does not allocate statutory responsibility in any particular country or establish unrestricted information-sharing permission. (Report, Key findings, paras. 15–18.)
Customer behaviour and profile
Customer review should connect identity and financial information with the observed conduct. FATF separates physical-venue indicators, online indicators and indicators common to each. At physical venues, warnings include attempts to influence staff to overlook activity or bypass customer due diligence, third-party cash placement to anonymise gambling and purchases of another customer's winning instruments for presentation as the purchaser's own. Frequent dealings with only one employee while avoiding other staff or unusual conduct require examination in their actual circumstances. The proposed control response is to compare staff observations with customer records and the origin of chips or claim instruments. (Report, pp. 4–6, "Customer behaviour and profile".)
Online warnings include attempts to disguise identity or location, multiple accounts under the same or a false name, mismatched player and payment details, and attempts to reopen or re-register previously investigated suspicious or closed accounts against which the operator has taken action. FATF also lists reluctance to verify identity by video and account content endorsing terrorism or violent extremism. These indicators identify matters for examination without establishing the explanation for the conduct. An investigator needs to distinguish concealment from an unresolved identification or technical discrepancy. (Report, p. 5; Red-flag risk indicators, para. 1.)
Across delivery channels, FATF identifies unreliable documents, unexplained wealth, reluctance to establish the source of funds and third-party relationships. It also includes politically exposed persons, sanctions associations, adverse information and certain geographical connections. Their inclusion does not establish wrongdoing by a particular customer. The stated safeguards require examination of the individual circumstances; any separate sanctions or politically exposed person duty needs its own legal analysis. (Report, pp. 5–6; Red-flag risk indicators, para. 1.)
Online accounts
Account history and connections between accounts can reveal patterns that a single transaction review misses. FATF lists sudden large deposits to dormant accounts that are inconsistent with the accounts' histories, significant changes in account use, frequent failed deposit attempts and frequent deposits from funding sources that resist identification. Shared devices, addresses, contact information or payment details can justify examination of whether apparently separate accounts are connected. The suggested review compares those connections with the recorded account holders and transaction history. (Report, pp. 6–7, "Online accounts"; p. 9.)
A new internet protocol address that differs from the account's previous IP history can also indicate account takeover, which FATF expressly identifies as a possible explanation. An assumption that the registered customer controls all disputed activity would therefore be unsafe without further facts. The account review should consider who controlled the session and whether the payment instructions were authorised. These are proposed investigative questions, not findings about any identified customer. (Report, p. 7, "Online accounts".)
Betting patterns
Betting records should be assessed against the money entering and leaving an account. FATF identifies coordinated betting, repeated losses to another player, low-risk wagering used to justify withdrawals and large cash-outs with little genuine play. It also flags deposits or collections structured around thresholds. These patterns support examination of whether gambling activity explains the movement of funds. An isolated low-risk bet supplies no necessary inference of laundering. (Report, pp. 7–8, "Betting patterns"; Red-flag risk indicators, para. 1.)
Competition integrity requires attention to a different set of facts. FATF lists betting by persons connected with a sport, sustained improbable winning, and coordinated bets on events flagged for possible manipulation. It distinguishes those warnings from an outcome later determined to result from manipulation. A proposed review would compare the customer's connection, bet timing and event information. An integrity alert must retain its status as an alert unless further records establish manipulation. (Report, pp. 7–8, "Betting patterns".)
Payment methods and transactions
The payment indicators concern funding identity, speed, aggregation and withdrawal destination. FATF identifies third-party deposits from persons not clearly related to the account holder, multiple payment methods in different names, pooled funds followed by a single payout and rapid withdrawals to different beneficiaries. It also flags requests to withdraw to an account different from the funding source. A proposed control response is to reconcile the account holder, funder and payout recipient, then investigate unexplained differences. (Report, pp. 8–9, "Payment methods/transactions".)
Payment instruments require assessment in combination with the transaction facts. FATF includes heavy cash use, virtual assets, prepaid instruments, e-wallets and unlicensed remittance providers. The indicator list also covers chargebacks against multiple cards, repeated failed payments and substantial balances left dormant. The use of a listed instrument alone does not establish illicit purpose. The Report's contextual caveat applies to these payment indicators as it does to customer behaviour. (Report, pp. 8–9; Red-flag risk indicators, para. 1.)
Attempts to bypass deposit caps, spending caps, time limits or self-exclusion can raise customer-protection concerns alongside financial-crime concerns. FATF states that problem gambling and illicit activity can coexist. A responsible-gambling explanation should therefore be assessed without automatically closing the financial-crime review, or automatically converting the customer into a criminal suspect. The relevant conduct and available financial records determine the further questions. (Report, p. 8; Red-flag risk indicators, para. 1.)
Product and platform features
The Report supports review of the operator's business as well as individual players. FATF identifies weak customer due diligence, inadequate monitoring, staffing or training deficiencies, and gaps in recordkeeping. It also identifies remote account creation and unmonitored chat functions. A proposed assessment would connect each feature to the actual opportunities for identity concealment, unexplained payments or harmful communications. The mere presence of a remote service does not resolve that assessment. (Report, p. 9, "Product and platform features"; Red-flag risk indicators, paras. 1–2.)
Ownership review should examine the persons exercising control and the commercial explanation for transactions. FATF lists complex cross-border structures that obscure beneficial ownership and control, arrangements designed to avoid ownership-check thresholds and economically questionable ownership transfers. It also identifies beneficial owners' possible criminal connections, unexplained profitability and significant cross-border business-to-business payments unrelated to regulated gambling. These indicators justify questions about control and transaction purpose; they do not establish that a corporate structure is unlawful. (Report, pp. 9–10, "Product and platform features".)
Third-party arrangements merit review where an operator cannot explain or supervise the service provided. FATF identifies poorly supervised white-label relationships, questionable software or consultancy contracts, introducers and junkets involving higher-risk jurisdictions. It also identifies sham merchants that disguise gambling payments as ordinary retail transactions. Proposed checks should compare the contracting party, actual service, merchant identity and payment beneficiary. A contract description alone cannot answer whether those records are consistent. (Report, pp. 9–10; Key findings, para. 14.)
Further examination and reporting decisions
The Report establishes no automatic rule that a specified number of red flags proves illicit finance. FATF states that one indicator can prompt monitoring and that several warrant further examination. Its list is non-exhaustive and not equally relevant to every operator. The appropriate inference is therefore conditional: relevant indicators support further questions, while the answers determine the remaining suspicion. An absent indicator supplies no general assurance that activity is lawful. (Report, Red-flag risk indicators, paras. 1–2.)
Under FATF's existing standards, casino identification and verification apply to financial transactions equal to or above USD/EUR 3,000. Operations that appear to be linked must be considered together. Countries should also require casinos to connect a customer's due diligence information with that customer's transactions. Recommendation 20 calls for prompt reporting to the financial intelligence unit upon suspicion, or reasonable grounds to suspect, that funds derive from crime or relate to terrorist financing. FATF expects suspicious transactions, including attempts, to be reported at any amount, so the identification threshold supplies no reporting safe harbour. Suspicion normally calls for identification and verification of the customer and beneficial owner even below that threshold. In that situation, a casino that reasonably believes those checks would tip off the customer may forgo them, but should file a suspicious transaction report. An operator-specific conclusion still requires national implementation and applicable tipping-off restrictions to be checked. (FATF Recommendations (June 2026), Interpretive Note to Recommendation 22, para. 2; Interpretive Note to Recommendations 22 and 23, paras. 1–2; Interpretive Note to Recommendation 10, paras. 1–3; Recommendation 20 and its Interpretive Note, para. 3; Recommendations 21, 23.)
