Suspicion, and the threshold that is lower than people think
The reporting obligation in most regimes is triggered by knowledge or suspicion, and in many by reasonable grounds to suspect. The EU's Fourth Anti-Money Laundering Directive requires a report where an obliged entity knows, suspects or has reasonable grounds to suspect that funds are the proceeds of crime, and in Britain the Proceeds of Crime Act 2002 makes it an offence in the regulated sector not to report where a person knows or suspects, or has reasonable grounds for knowing or suspecting that another person is engaged in money laundering. That last formulation is objective: it does not matter that the individual did not personally suspect, if the facts were such that a reasonable person in that position would have. The Gambling Commission's casino guidance describes it as a lower test which introduces an objective test of suspicion.
Suspicion is a low bar. It is more than speculation and considerably less than proof: in R v Da Silva (2006) the Court of Appeal described it as a possibility, which is more than fanciful, that the relevant facts exist, while noting that a vague feeling of unease would not suffice. It does not require evidence, a completed investigation, or knowledge of the exact criminal offence behind the funds. The common failure is the opposite belief: teams that delay reporting while they build a case, or that close a matter because they could not establish what the underlying crime was.
The practical consequence is that reporting is not an accusation and should not be treated internally as one. It is a disclosure of information to a financial intelligence unit, which has powers, data and context the operator does not.
The mechanics
The nominated officer, variously titled money laundering reporting officer or equivalent, is the individual to whom internal reports are made and who decides whether to make an external report. The role is usually a legal requirement, often requires regulatory approval or a licence, and carries personal exposure. In Britain the Money Laundering Regulations 2017 require a nominated officer to be appointed and the supervisor told of the appointment within 14 days, and the Gambling Commission requires the head of an operator's anti-money laundering function to hold a personal management licence. It must sit at a level with authority to act, must have unrestricted access to information, and must be able to decide without commercial clearance. The Commission's guidance says the nominated officer must have the authority to act independently and access to all relevant information.
Internal reporting is how a member of staff discharges their own obligation. Any employee with knowledge or suspicion reports internally to the nominated officer. The internal report discharges the individual's own duty to disclose whether or not an external report follows, which is why the route must be easy, documented and free of any sense that raising something is a nuisance.
External reporting goes from the nominated officer to the financial intelligence unit, in the prescribed form and timeframe. Quality matters: a report that states the facts, the pattern observed, what the operator did and what it concluded is actionable; a report consisting of a transaction dump is not.
Consent and defence regimes. Several jurisdictions provide a mechanism by which an operator can seek a defence before dealing with funds it suspects are criminal property. Where such a regime exists, the sequencing is critical, because acting on the funds first can commit the offence the report was about. In Britain the request for a defence goes to the National Crime Agency, and consent is treated as given if it is not refused within seven working days or, if it is refused, once a 31-day moratorium has expired; a court can extend the moratorium in steps of up to 31 days, but by no more than 186 days in total beyond the initial 31-day period.
Tipping off prohibits disclosing that a report has been made or that an investigation is contemplated where the disclosure is likely to prejudice an investigation. This shapes customer communication, internal communication and the wording of account restriction messages, and staff need a prepared form of words rather than improvisation.
Records
Record-keeping obligations are unglamorous and matter more than they look, because a control you cannot evidence is a control you did not have.
The scope typically covers identification and verification evidence, due diligence assessments and their conclusions, transaction records, the reasoning behind decisions including decisions not to report, internal and external reports, training records, and the risk assessment and its revisions. Retention periods are set by jurisdiction and are commonly five years from the end of the relationship or the transaction, as under the EU directive and the UK regulations, but the period is one of the details to check rather than recall.
Two qualities separate a usable record from a compliant-looking one.
It records the conclusion and the reasoning, not only the artefact. "Bank statement obtained" is an artefact. "Bank statement shows salary of X, deposits over the period were Y, the ratio is consistent with the declared position, no further action, review at Z" is a record.
It is retrievable. A supervisor asking for every enhanced due diligence file from a given period, or the full history on one customer, expects it within days. Firms that store the evidence across four systems with no case reference discover this the hard way.
Governance
The arrangements that make the framework operate are the same shape as in any risk discipline, and the failures are the same.
Board accountability. A named individual at board or senior management level is responsible for compliance, receives information capable of supporting a decision, and can stop something. Reporting that consists of alert counts and report volumes describes activity; reporting that shows where the framework is failing, what the overdue review population is, what the closure quality sampling found, and what the financial crime consequences are of the products and markets being added, supports a decision.
Independence of the second line. The nominated officer and the financial crime function must be able to restrict or exit a relationship without the agreement of the person whose revenue it is. Where they cannot, every individual decision will look reasonable and the aggregate will be a customer processed for years.
Three lines, actually staffed. The business owns the risks it creates, which includes payments, VIP and B2B partnerships. The second line sets policy and challenges. Internal audit tests both, independently, on a defined cycle, reporting to the audit committee.
Training that is role-specific. Generic annual e-learning satisfies a box and changes nothing. A payments analyst, a VIP manager and a customer support agent encounter different typologies and need different training, and the people most likely to see the first indicator are usually the most junior. The UK regulations require relevant staff to be regularly given training in how to recognise and deal with transactions and other activities or situations which may be related to money laundering, with a written record kept.
Independent testing. Many regimes require an independent audit of the framework, proportionate to size: the EU directive and the UK regulations both call for an independent audit function where appropriate to the size and nature of the business. The value is entirely in its independence: an audit conducted by the function it examines is a self-assessment with a different cover page.
Why enforcement keeps finding the same things
Published financial crime enforcement in this sector is repetitive, and the repetition is the lesson. The Gambling Commission's own compliance report for 2019 to 2020 listed operators failing to learn lessons from its compliance and enforcement activity among the problems it kept finding.
Source of funds requested and not assessed. Documents on file, no conclusion, activity continued. A recurring finding: in 2022 the Commission found one operator had allowed a customer to deposit £742,000 in 14 months without appropriate source of funds checks, and in 2025 another was overly reliant on customers' self-reported financial position.
Thresholds inherited, not derived. Triggers nobody could justify, sometimes set high enough that the largest customers never crossed them, and policies the Commission has called too reliant on financial thresholds.
The customer risk rating that did nothing. Calculated at onboarding, stored, never used to change a threshold, a review interval or an approval. In one 2025 case, customers with a medium or high risk score were not given an enhanced due diligence check until a financial trigger was hit.
Alerts closed without assessment. Volume beyond the team's capacity, closure rates reported upward as evidence of performance.
Commercial override. The most valuable customers subject to less scrutiny rather than more, with escalations resolved in favour of the relationship. Announcing a £17 million settlement in 2022, the Commission's chief executive reminded operators that they must never place commercial considerations over compliance.
Third-party deposits accepted. Funds arriving from a card or account in someone else's name. A control failure that requires no sophistication to prevent.
Reviews overdue. A periodic review programme with a backlog is a documented failure to operate a stated control.
Group brands not joined. One person, several accounts across the operator's own brands, each below every threshold. In the same 2022 case, a customer blocked at one brand for failing to provide source of funds opened an account with a sister brand and deposited £30,000 in a single day.
Read any published notice against that list and most of it will be there. The uncomfortable implication is that these are not hard problems. They are problems of authority, capacity and incentive, and they persist because the fix costs revenue in the short term.
What good looks like
A framework worth defending has a small number of observable properties.
The risk assessment is current, the reasoning is written down, and any control can be traced back to a risk in it. Thresholds have documented rationales produced before their commercial impact was known. Customer risk ratings change something concrete. Alert volume is matched to review capacity and the mismatch, where it exists, is acknowledged and being addressed. Closure quality is sampled and the result is reported. Source of funds files contain conclusions. Sanctions screening has been tested with seeded near-misses. B2B partners and affiliates are screened. Reviews are on time. The nominated officer has exited a relationship in the last year against commercial preference, and the board knows about it.
None of that is exotic. All of it is checkable in an afternoon, which is precisely how a supervisor will approach it.