KYC and AML

AML Red Flags for Online Gambling Operators

The money laundering warning signs online casinos and sportsbooks should monitor, grouped for payments, fraud, VIP and support teams, and what to do (and not do) when one appears.

11 min readPart of kyc and aml

On this page
  1. Why are online gambling operators exposed to money laundering?
  2. What are the main payment red flags?
  3. What are the gameplay red flags?
  4. What are the customer red flags?
  5. What should staff do when they see a red flag?
  6. How do operators handle AML-related queries in support at scale?
  7. How should red flags be prioritised?
  8. Which teams spot which red flags?
  9. How do red flags feed transaction monitoring?
  10. What do red flags look like as monitoring rules?
  11. How should a red flag case be written up?
  12. What do regulators say about red flags?
  13. Why do red flags get missed?
  14. What happens from red flag to report, step by step?
  15. Who supervises AML for gambling operators in each market?
  16. What does a good AML red flag programme look like?
  17. Worked example 2: third-party funding
  18. What training does each team need?
  19. Where do operators report suspicions in each market?
  20. Worked example: a layering pattern
  21. What mistakes do operators commonly make?
  22. Checklist
  23. Frequently asked questions
  24. Sources
  25. More guides

The strongest money laundering red flags in online gambling are spend that does not fit what the operator knows about the customer, deposits followed by withdrawals with little genuine play, funding from cards or accounts that are not the player’s, and links between accounts that move value to each other. One flag is a reason to look closer; several together are a reason to escalate to the money laundering reporting officer, who decides whether to file a suspicious activity report.

Key takeaways

  • Gambling is used to make criminal money look like winnings, to move it between payment instruments, and to spend proceeds of crime.
  • Profile mismatch was central in the 2026 NorthStar and QuinnBet cases [1] [2].
  • Payment red flags (third-party funding, many methods, method switching at withdrawal) are often the earliest signal.
  • Escalate through the MLRO; never tell the customer a report has been or may be made.
  • Speed matters: the Commission criticised controls that did not ensure reports were made as soon as practicable [2].
3laundering stages: placement, layering, integration
MLROdecides on reporting
As soon as practicableUK expectation for SARs

Why are online gambling operators exposed to money laundering?

Criminals use gambling to make money look like winnings (integration), to move it between payment instruments, for example in by card and out to a bank account (layering), and simply to spend the proceeds of crime, which is itself an offence in the UK under the Proceeds of Crime Act 2002. Operators are also exposed to terrorist financing and to funds from fraud against third parties such as stolen cards.

What are the main payment red flags?

Payment red flags
Red flag What it can indicate
Deposits followed by withdrawal with little play Using the account to move or clean money
Many payment methods or frequent changes Layering, stolen cards or third-party funding
Cards or accounts in another person’s name Third-party funding, mules or fraud
Requests to withdraw to a new method or account Attempt to break closed loop
Deposits just under thresholds (structuring) Avoiding due diligence or reporting
Large or rapid deposits out of line with profile Unexplained funds
Crypto from mixers or high-risk exchanges Obscured origin
Prepaid vouchers bought in bulk Cash converted to anonymous value

What are the gameplay red flags?

  • Low-risk betting. Betting both sides of an outcome, or covering most roulette numbers, keeps losses small while creating “winnings”.
  • Chip dumping. In peer-to-peer games one account deliberately loses to another to transfer value.
  • Linked accounts. Accounts sharing devices, IPs or payment details that play against or alongside each other; see multi-accounting detection.
  • Unusual sportsbook activity. Heavy stakes on obscure markets or apparent knowledge of outcomes.

What are the customer red flags?

  • Spend that does not match declared occupation or income
  • Politically exposed persons and their associates; see PEP screening
  • Connections to high-risk jurisdictions named by the FATF
  • Reluctance to provide documents, or altered documents
  • Third parties contacting support on the customer’s behalf
  • Questions about reporting thresholds
  • Sudden reactivation of a dormant account with large deposits

What should staff do when they see a red flag?

  1. Record itLog the observation in the case system, not a private message.
  2. Escalate internallyPass it to the MLRO or nominated officer.
  3. Apply holds by policyUse the standard wording.
  4. Do not tip offDisclosing that a report has been or may be made is a criminal offence in the UK.
  5. Let the MLRO decideReports go to the national FIU: NCA (UK), FINTRAC (Canada), FIAU (Malta), Coaf (Brazil), UIF via SAT (Mexico), FinCEN (US).

Most AML-related contacts arrive as withdrawal or verification questions. At scale, routine document and status questions are answered from live data with approved wording; cases where a report may be involved are routed to compliance with a neutral script. See withdrawal support automation guide, KYC support guide, how to automate withdrawal support in online casinos and how to automate KYC for online casinos.

How should red flags be prioritised?

Prioritising red flags
Priority Example combinations Response
High Third-party cards plus minimal play plus new payout account Hold by policy, escalate to MLRO same day
Medium Spend out of line with profile plus rapid escalation Source of funds request; enhanced monitoring
Low Single payment method change Note and monitor

Which teams spot which red flags?

Red flags by team
Team Red flags they see first
Payments Third-party funding, method switching, structuring
Fraud Linked accounts, device sharing
Trading and risk Unusual betting, chip dumping
VIP Profile mismatch, pressure to skip checks
Support Third parties on calls, evasive answers, questions about thresholds

Training should be specific to each team’s red flags; see Cevro Academy courses.

How do red flags feed transaction monitoring?

Every confirmed case should become a rule or scenario improvement. See transaction monitoring basics.

What do red flags look like as monitoring rules?

Red flags as rules
Red flag Example rule (illustrative)
Minimal play before withdrawal Withdrawal requested after wagering less than a set share of deposits
Many payment instruments More than a set number of cards or wallets in 30 days
Structuring Several deposits just under a reporting or EDD threshold in a short period
Rapid escalation Monthly deposits several times the previous average
Third-party funding Payment instrument name does not match account name
Chip dumping or collusion Repeated transfers of value between the same players in peer-to-peer games

Thresholds must come from the operator’s own risk assessment.

How should a red flag case be written up?

  1. SummaryWhat triggered the case, in one paragraph.
  2. Customer profileIdentity, occupation, declared income, risk rating, history.
  3. ActivityDeposits, play and withdrawals with dates and amounts.
  4. AnalysisWhy the activity is or is not consistent with the profile.
  5. DecisionClose, monitor, request information, restrict, or escalate for a report.
  6. ApprovalsWho reviewed and approved, with dates.

What do regulators say about red flags?

The QuinnBet case shows what happens when source of funds checks are not applied consistently to higher-spending customers [2].

Why do red flags get missed?

Most operators have a list of red flags. They are missed for practical reasons: alerts arrive faster than analysts can review them, information sits in different teams, and commercial pressure encourages giving high-value customers the benefit of the doubt. Enforcement cases often describe controls that existed on paper but were not followed [1] [2].

Three habits help. First, combine signals across teams so that payments, fraud, VIP and support observations reach the same case. Second, make escalation easy and safe for staff, including those in commercial roles. Third, review closed alerts regularly to check that decisions were sound.

What happens from red flag to report, step by step?

  1. DetectA rule, model or member of staff spots a red flag.
  2. TriageThe alert is prioritised by risk; high-priority combinations go to an analyst the same day.
  3. InvestigateThe analyst reviews profile, payments, play, devices and support conversations.
  4. DecideClose with reasons, request information, restrict, or escalate to the MLRO.
  5. ReportWhere suspicion remains, the MLRO reports to the financial intelligence unit as soon as practicable.
  6. Handle the accountDecide on continuing, restricting or ending the relationship, without tipping off.
  7. LearnFeed confirmed patterns back into rules and training.

Who supervises AML for gambling operators in each market?

AML supervisors by market
Market Regulator What it covers for this topic Official source
Great Britain Gambling Commission AML supervisor for casino operators under the Money Laundering Regulations [3] AML and CTF guidance
Ontario FINTRAC (with AGCO) Federal AML supervisor and financial intelligence unit; AGCO standards apply too [4] FINTRAC casino guidance, FINTRAC 24-hour rule, Registrar’s Standards
Malta FIAU AML supervisor and financial intelligence unit [5] FIAU Implementing Procedures
Sweden Spelinspektionen AML supervision of licensed gambling operators Spelinspektionen AML rules
Germany GGL Supervisory authority for online gambling, including AML duties GGL
Netherlands Kansspelautoriteit Supervises gambling operators’ AML compliance Kansspelautoriteit
Brazil SPA AML ordinance for betting operators [6] Secretaria de Prêmios e Apostas
United States FinCEN Bank Secrecy Act rules for casinos [8] 31 CFR Part 1021, FinCEN

What does a good AML red flag programme look like?

AML red flag playbook
Area What good looks like
Coverage Rules for payments, gameplay and customer red flags, mapped to the risk assessment
Capacity Alert volumes matched to analyst capacity, with service levels
Joined-up view Payments, fraud, VIP and support signals in one case
Speed Reports made as soon as practicable, with timing monitored
Culture Staff in commercial roles escalate without fear
Assurance Independent testing of rules and sampled reviews of closed alerts

Cevro Academy offers Cevro Academy courses.

Worked example 2: third-party funding

  1. A player deposits with a card in their own name, then adds two e-wallets.
  2. Payment data shows one e-wallet is registered to a different name.
  3. The alert combines third-party funding with a new payout account and limited play. It is high priority.
  4. The analyst restricts the wallet, asks the player to explain, and reviews linked accounts.
  5. The explanation is not credible. The MLRO reports, and the relationship is ended without telling the player about the report.

What training does each team need?

AML training by team
Team Training focus
Payments Third-party funding, structuring, method switching, payout account changes
Fraud Linked accounts and how fraud overlaps with laundering
VIP and account management Profile mismatch, pressure to skip checks, independence of decisions
Support (human and AI) Spotting red flags in conversations, escalation, never tipping off
Product and engineering How changes can break controls; testing before and after release [2]
Senior management Risk appetite, oversight of alerts and reporting, accountability

Training works best when it uses the operator’s own cases and is refreshed after enforcement actions or rule changes.

Where do operators report suspicions in each market?

Reporting routes by market
Market Financial intelligence unit Notable rule Source
Great Britain National Crime Agency Consent (DAML) may be needed before moving funds [3]
Ontario FINTRAC 24-hour aggregation for threshold reports [4]
Malta FIAU Implementing Procedures for remote gaming [5]
Brazil Coaf Ordinance 1,143/2024 [6]
Mexico UIF (notices via SAT) 24-hour notice for suspected illicit origin [7]
US states FinCEN SARs under the Bank Secrecy Act [8]

Worked example: a layering pattern

  1. New account deposits £900 with three different debit cards in two hours.
  2. Plays £60 on low-variance slots.
  3. Requests withdrawal of £820 to a newly added bank account.
  4. Rules flag: multiple cards, minimal play, new payout account. Analyst finds two cards in other names.
  5. Withdrawal held by policy with neutral wording; case escalated to the MLRO, who decides on reporting.

What mistakes do operators commonly make?

Treating flags in isolation

Patterns matter more than single signals.

Slow escalation

SARs must be made as soon as practicable [2].

Leaky scripts

Any hint about reporting is tipping off.

No feedback loop

Cases should refine rules and training.

Checklist

  • Payment, gameplay and customer red flags defined and monitored.
  • Clear escalation route to the MLRO.
  • Neutral hold wording for AML cases.
  • SAR timeliness measured.
  • Linked-account detection in place.
  • Staff trained on tipping off.
  • Red flag priority matrix agreed.
  • Team-specific training.
  • Confirmed cases feed monitoring rules.
  • Case write-up template.
  • Tipping-off training for support.

Frequently asked questions

What is the biggest AML red flag in online casinos?

Deposits followed by withdrawals with little genuine play, especially with payment method changes or spend that does not match the profile.

What is chip dumping?

Deliberately losing to another player in a peer-to-peer game to transfer money.

What is structuring?

Splitting transactions to stay below due diligence or reporting thresholds.

What is tipping off?

Telling a customer that a suspicious activity report has been or may be made; a criminal offence in the UK.

Who decides whether to file a report?

The MLRO or nominated officer.

Where do operators send reports?

To the national FIU: NCA, FINTRAC, FIAU, Coaf, UIF or FinCEN depending on the market.

Are support agents responsible for AML?

They must recognise and escalate red flags and avoid tipping off. Reporting decisions sit with the MLRO.

Does a single red flag mean money laundering?

No. It means look closer; combinations of flags justify escalation.

Which team usually spots laundering first?

Often payments or support, because they see funding patterns and conversations first.

Should red flags be escalated even if small?

High-priority combinations should be escalated regardless of amount.

What is tipping off?

Telling someone that a suspicious activity report has been made or an investigation is under way, which is an offence in many places.

Should every red flag lead to a report?

No. Red flags lead to review; reports follow when suspicion remains after review.

Who receives suspicious activity reports in Great Britain?

Reports go to the UK Financial Intelligence Unit at the National Crime Agency.

Does reporting mean the account must close?

No. Operators decide separately whether to continue the relationship, taking care not to tip off.

How fast must a report be made?

As soon as practicable after suspicion is formed, in most regimes.

Sources

  1. Gaming Intelligence: AGCO penalty on NorthStar Gaming
  2. Gambling Commission: QuinnBet public statement
  3. Gambling Commission: AML and CTF guidance
  4. FINTRAC: the 24-hour rule
  5. FIAU: Implementing Procedures
  6. Mattos Filho: Brazil AML ordinance
  7. KYC Systems: LFPIORPI
  8. eCFR: 31 CFR Part 1021

Transaction monitoring basics

Rules, scenarios, alerts and case handling for gambling transaction monitoring.

Source of funds and source of wealth

When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.

Enhanced due diligence triggers

How to set and wire EDD triggers so reviews happen before large losses or wins.

PEP and sanctions screening

Screening players against PEP and sanctions lists: when, which lists, and how to handle matches.

Multi-accounting detection

How operators link duplicate accounts using identity, payment, device and behaviour signals.

Further reading elsewhere