KYC and AML

Transaction Monitoring Basics for Gambling Operators

How online gambling operators monitor deposits, play and withdrawals for money laundering risk: scenarios, thresholds, alert handling, reporting and tuning.

5 min readPart of kyc and aml

On this page
  1. What should a gambling monitoring programme cover?
  2. How should alerts be handled?
  3. How do reporting timelines differ by market?
  4. How do you tune monitoring?
  5. How should alert queues be managed?
  6. How do monitoring and support connect?
  7. What is the difference between rules and models?
  8. Worked example: split payouts within 24 hours
  9. What mistakes do operators commonly make?
  10. Checklist
  11. Frequently asked questions
  12. Sources
  13. More guides

Transaction monitoring is the ongoing review of deposits, gameplay and withdrawals to spot activity that may involve money laundering, terrorist financing or fraud. Operators run rule-based scenarios (and sometimes models) that create alerts, analysts triage alerts into cases, and the MLRO decides whether to report. Reporting rules differ by market: FINTRAC aggregates within 24 hours, Mexico links operations, and the UK expects reports as soon as practicable.

Key takeaways

  • Monitoring must start at account opening, not after a pattern builds.
  • Scenarios should reflect gambling typologies: minimal play, method switching, chip dumping, structuring.
  • Aggregation rules matter: FINTRAC’s 24-hour rule and Mexico’s linked operations [1] [2].
  • Alerts need service levels; the Commission criticised SAR controls that were not timely [3].
  • Tune rules with feedback from closed cases.
24 hoursFINTRAC aggregation window
17thMexico monthly notice deadline
Day onemonitoring starts at account opening

What should a gambling monitoring programme cover?

Core monitoring scenarios
Scenario What it looks for
Minimal play Deposits withdrawn after little wagering
Method switching Deposit by one method, withdraw to another
Third-party funding Payment names not matching the account
Structuring Transactions just under thresholds or split across days
Velocity Sharp increases in deposits
Peer-to-peer transfers Chip dumping or collusion in poker and exchanges
Linked accounts Shared devices, IPs or payment instruments
Profile mismatch Spend against declared income or occupation

How should alerts be handled?

Alert handling1Alert generatedScenario fires on a transaction or pattern.2TriageAnalyst checks context; closes false positiveswith reasons.3CaseEscalated alerts become cases with an ownerand deadline.4MLRO decisionReport or no report, recorded with reasons.5FeedbackOutcomes tune scenarios and thresholds.
From alert to decision.

How do reporting timelines differ by market?

Reporting rules by market
Market Rule Source
Ontario Threshold reports with 24-hour aggregation; casino disbursements of CA$10,000 or more [1] [4]
Mexico Notices by the 17th of the following month; 24-hour notices for suspected illicit origin [2]
Great Britain Reports as soon as practicable; consent may be needed before moving funds [3] [5]
Brazil Reports to Coaf under Ordinance 1,143/2024 [6]
US states SARs and CTRs under the Bank Secrecy Act [7]

How do you tune monitoring?

  1. Measure alert qualityShare of alerts that become cases and reports.
  2. Retire noisy scenariosOr raise thresholds where they add nothing.
  3. Add typologies from casesEach real case should teach the system something.
  4. Test after changesPlatform migrations can break monitoring silently [3].

How should alert queues be managed?

Alert queue practices
Practice Why
Service levels per alert type High-risk alerts handled within hours, not days
Risk-based ordering Analysts see the most important alerts first
Four-eyes on closures Second review for high-risk closures
Backlog reporting Senior management sees ageing alerts
Quality assurance Sampled reviews of closed alerts

How do monitoring and support connect?

Support conversations add context that transactions cannot: a third party on the call, evasive answers, or questions about thresholds. Tagged conversations can raise alerts or add to cases. AI support tools that summarise conversations make this practical at scale; see Cevro Scribe.

What is the difference between rules and models?

Rules versus models
Rules Models
How they work Fixed conditions (if X then alert) Scores based on patterns in data
Strength Transparent, easy to audit Catch complex patterns
Weakness Rigid, noisy Harder to explain; need validation
Regulator expectation Understand and evidence Understand, validate and evidence

Worked example: split payouts within 24 hours

  1. Ontario player withdraws CA$6,000.
  2. Same player withdraws CA$5,000. Together the disbursements reach CA$11,000 within 24 hours.
  3. Aggregation rule creates the casino disbursement report obligation and a structuring alert.
  4. Analyst reviews the pattern and profile; the report is filed and the case closed or escalated with reasons.

What mistakes do operators commonly make?

Monitoring only withdrawals

Risk starts at deposit.

No aggregation

Splitting avoids naive thresholds.

No service levels

Alerts age and reports become late.

No feedback loop

Rules never improve.

Unmanaged backlogs

Late reviews mean late reports.

Opaque models

Regulators expect operators to explain alerts.

Checklist

  • Scenarios cover gambling typologies.
  • Aggregation rules per market.
  • Alert service levels defined.
  • Case decisions recorded.
  • Monthly alert quality review.
  • Post-change testing.
  • Service levels per alert type.
  • Four-eyes on high-risk closures.
  • Backlog reported to management.
  • Support signals feed cases.

Frequently asked questions

What is transaction monitoring in gambling?

Ongoing review of deposits, play and withdrawals for money laundering, terrorist financing and fraud risk.

When must monitoring start?

From account opening.

What is the 24-hour rule?

A FINTRAC rule that aggregates transactions by or for the same person within 24 hours for reporting.

Who decides whether to report?

The MLRO or nominated officer.

Do operators use machine learning for monitoring?

Some do, alongside rules; regulators expect operators to understand and evidence how alerts are generated.

How quickly must reports be made in the UK?

As soon as practicable after the information comes to light.

What is a false positive?

An alert that turns out not to indicate risk; it should be closed with reasons.

Does monitoring cover poker and exchanges?

Yes; peer-to-peer products need scenarios for chip dumping and collusion.

Should operators use machine learning for monitoring?

Many combine models with rules; both must be understood and evidenced.

What is four-eyes review?

A second person checking a decision before it is final.

How should alert backlogs be handled?

With service levels, risk-based ordering and reporting to senior management.

Sources

  1. FINTRAC: the 24-hour rule
  2. KYC Systems: LFPIORPI
  3. Gambling Commission: QuinnBet public statement
  4. FINTRAC: reporting casino disbursements
  5. Gambling Commission: AML guidance
  6. Mattos Filho: Brazil AML ordinance
  7. eCFR: 31 CFR Part 1021

AML red flags for operators

The payment, gameplay and customer warning signs that should trigger review.

Enhanced due diligence triggers

How to set and wire EDD triggers so reviews happen before large losses or wins.

PEP and sanctions screening

Screening players against PEP and sanctions lists: when, which lists, and how to handle matches.

Multi-accounting detection

How operators link duplicate accounts using identity, payment, device and behaviour signals.

Source of funds and source of wealth

When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.

Further reading elsewhere