What laundering actually requires
Money laundering is the process of giving criminal proceeds an apparent legitimate origin. It is usually described in three stages, and knowing them is the difference between applying controls mechanically and understanding what you are looking for.
Placement introduces criminal funds into the financial system. It is usually the most exposed stage for the launderer, because it is the point at which physical cash or an obviously suspicious transfer has to touch a regulated institution.
Layering moves the funds through transactions designed to obscure the trail. Complexity is the objective: multiple accounts, multiple jurisdictions, multiple instruments, each hop making the original source harder to reconstruct.
Integration returns the funds to the launderer in a form that appears legitimate and can be spent, invested or declared.
The stages overlap in practice and a single scheme rarely maps cleanly onto them: the United Nations Office on Drugs and Crime notes that real cases may skip a stage, combine two or repeat one several times. Their value is as a lens: when you look at a suspicious pattern, ask which stage it serves. A pattern that makes no sense as placement, layering or integration is probably not laundering, and a pattern that serves two stages at once deserves more attention than one that serves none.
Why gambling is attractive
Gambling has features that make it useful at each of the three stages, and being specific about them is more useful than the general observation that the sector is high-risk.
It converts the character of money. Funds enter as a deposit and leave as a withdrawal. The customer receives a payout from a licensed business, which is a more presentable origin than the one the money had before. This is the core attraction and it operates whether or not the customer gambles at all.
It provides a plausible explanation for wealth. "I won it" is a socially and legally recognised explanation for a sum of money appearing. In jurisdictions where gambling winnings are not taxed, it also explains why no tax was paid on it. A launderer who can produce an operator's withdrawal record has documentary support for that claim, which is precisely why some schemes are built to generate the paperwork rather than to hide the money.
Losses are expected, so cost is not suspicious. In most laundering schemes, the fee paid to move money is a problem to be hidden. In gambling it is the product. A launderer accepting a modest loss to convert funds is behaving exactly like an ordinary customer having a bad month.
Volume provides cover. Large numbers of customers transacting frequently means an individual pattern has to be genuinely unusual to be visible at all.
It is fast and remote. Deposit and withdrawal are designed to be quick, and the customer relationship is established through data rather than presence.
Some products allow near-riskless play. Betting both sides of a market, or playing a very low-edge game, converts funds with minimal expected loss; Britain's Gambling Commission warns that casino products with higher return-to-player ratios are at risk of being exploited for money laundering. Peer-to-peer products go further, because value can be transferred to a chosen counterparty by design rather than by chance.
The typologies worth knowing by name
These are the recurring patterns. Regulators and the Financial Action Task Force describe variations of each, most recently in the FATF's September 2026 red-flag indicators for gaming and gambling, and they are the patterns a monitoring system should be built to find.
Minimal-play deposit and withdrawal. Funds deposited, little or no gambling, withdrawal requested. The purest form and the easiest to detect, which is why sophisticated schemes add a layer of genuine play.
Withdrawal to a different instrument. Deposits from one source, payout requested to another account, card or wallet. The mismatch is the point: the money has changed hands. This is why paying out to the original funding instrument, where the payment rails allow it, removes a large share of the risk at a stroke.
Hedged or offsetting play. Betting both outcomes of a market, across accounts or across operators, so the aggregate loss is close to the margin. The customer looks like a busy bettor and is in fact converting funds at a known cost.
Minimal chip play and structuring in land-based venues. Buying chips, playing minimally, cashing out, and keeping each transaction below a reporting threshold; the FATF's 2009 report describes a case in which a customer cashed in chips after minimal play and associates cashed chips worth USD 2,000 or less across several casinos. Structuring, the deliberate splitting of transactions to stay below a threshold, is itself an offence in some jurisdictions regardless of the source of the funds: in the United States, structuring transactions to evade currency reporting requirements carries up to five years' imprisonment, or up to ten years in aggravated cases.
Peer-to-peer transfer. In poker and other player-versus-player products, value moves deliberately from one account to another through arranged losses. Chip dumping is collusion when done for advantage and laundering when done to move value.
Account takeover and money muling. A third party's account is used, knowingly or otherwise, to receive and forward funds. The FATF notes that social media is used for the recruitment of money mules, and the Gambling Commission's 2026 risk assessment rates mule accounts as a risk in remote gambling, with case studies involving students and an 18-year-old gambling with third-party funds. The account holder may not understand what they are participating in.
Third-party deposits. Funds arriving from a person other than the account holder. This is a control failure before it is a typology, and it recurs in regulators' casework: the Gambling Commission's October 2025 casework trends describe customer bank statements with significant third-party deposits evident that operators did not identify or act on.
Winnings purchase. Buying a winning ticket or a credit balance from a genuine winner, at a premium, to acquire the paperwork rather than the money. Primarily a land-based and lottery typology and a persistent one: the FATF described it in its 2009 casino typologies report and still lists the purchase of winning lottery tickets, betting slips and vouchers among its 2026 indicators.
Affiliate and agent structures. Value moved through commission arrangements or agent networks, where the flow of funds is obscured by a commercial relationship. Junket operations have attracted sustained regulatory attention for this reason, and although they are in decline and more tightly regulated, the FATF still identifies risks from player anonymity and obscured junket ownership.
The offences behind the obligation
The control framework exists because of criminal law, and the distinctions matter when someone asks why a process cannot be shortened.
Money laundering in most frameworks covers acquiring, using, possessing, concealing, converting or transferring criminal property, and entering into an arrangement that facilitates another person doing so. In the United Kingdom these are the principal money laundering offences in sections 327 to 329 of the Proceeds of Crime Act 2002. Note the breadth: an operator that processes a transaction it suspects involves criminal property may commit an offence by doing so, which is why suspicion changes what the business is permitted to do rather than merely triggering a report. In the UK the defence is to make an authorised disclosure and obtain consent before proceeding.
Failure to report is a separate offence in some regimes, including the UK's. A person in a regulated business who knows or suspects laundering, or who has reasonable grounds to suspect it, and does not report it, commits an offence independently of whether laundering occurred; in the UK this is section 330 of the Proceeds of Crime Act.
Tipping off is a third. Disclosing that a report has been made, or that an investigation is contemplated, in a way that is likely to prejudice an investigation, is an offence; in the UK regulated sector it is section 333A of the Proceeds of Crime Act. This constrains what a customer can be told, and it is the reason a customer whose account is restricted for financial crime reasons is not given the reason.
Terrorist financing is legally distinct and frequently paired with anti-money-laundering obligations. The critical difference is direction: laundering concerns proceeds of crime, while terrorist financing may involve funds from legitimate sources destined for an illegitimate purpose. In the UK the offence turns on purpose, not origin: it is an offence to provide money knowing or having reasonable cause to suspect that it may be used for terrorism. Value can be small, and the FATF notes that many jurisdictions face persistent attacks from small cells and radicalised lone actors. Small sums make threshold-based detection close to useless and sanctions screening correspondingly more important.
Sanctions breaches are not an anti-money-laundering matter at all, although the same team usually handles them. The liability standard for civil penalties is stricter than anywhere else in the framework, because no knowledge or suspicion needs to be shown. In the United States, OFAC imposes civil penalties generally on a strict liability basis, so a firm can be liable without knowing or having reason to know it was dealing with a designated person. In the United Kingdom, OFSI can impose a civil penalty without having to show that the person knew or suspected anything, although the criminal offence of dealing with a designated person's funds still requires knowledge or reasonable cause to suspect. Not knowing is therefore not a defence to a civil penalty in either country.
The international architecture
You will meet these names constantly and should know what each one actually does.
The Financial Action Task Force (FATF) is an intergovernmental body that sets the international standards, the Recommendations, and evaluates countries against them through mutual evaluations, which are peer reviews by assessors from other countries. It does not regulate businesses. Its influence runs through national implementation and through its public lists of jurisdictions with strategic deficiencies, updated after each plenary, for which the FATF calls on jurisdictions to apply enhanced due diligence and, in the most serious cases, countermeasures. In practice, firms elsewhere apply enhanced due diligence to business connected with listed countries.
FATF-style regional bodies such as MONEYVAL and the Asia/Pacific Group on Money Laundering (APG), both FATF associate members, conduct evaluations to FATF standards in their regions.
National financial intelligence units (FIUs) receive suspicious activity or suspicious transaction reports, analyse them and disseminate intelligence to law enforcement. They are the destination of the reports an operator files.
National regulators and supervisors set and enforce the obligations on firms. In gambling this is frequently the gambling regulator itself, sometimes alongside a separate financial supervisor, and the division of responsibility varies by jurisdiction.
Egmont Group, a body of more than 180 FIUs, provides the platform through which they exchange financial intelligence securely across borders.
FATF issued risk-based guidance for casinos in 2008 and, with the APG, a casino typologies report in 2009 that left online gambling out of scope. In September 2026 it published Risks of Gaming and Gambling, its first detailed examination of online and illegal gambling, with red-flag indicators covering most of the typologies above. It is now the most useful single reference for anyone building controls in this sector.
The risk-based approach, and what it is not
Every modern framework is risk-based. The phrase is used loosely and the loose use is where firms get into trouble.
The risk-based approach means that the intensity of a control is proportionate to the assessed risk: higher risk attracts more scrutiny, lower risk attracts less. It permits an operator to apply simplified measures where risk is genuinely low and requires enhanced measures where it is high.
It does not mean the operator decides which obligations to follow. Certain requirements are absolute: identifying the customer, screening against sanctions, reporting suspicion, keeping records. Risk determines depth and frequency, not whether.
It also does not mean the operator's own commercial judgement of a customer is the risk assessment. A customer who is commercially valuable may be high risk precisely because of the characteristics that make them valuable, and a framework in which value reduces scrutiny has inverted the model. Britain's Gambling Commission makes the point in its October 2025 casework trends: the level of risk attributed to customers may not correspond to their commercial value to the business.
Two things make a risk-based approach defensible rather than decorative. It has to be written down, with the reasoning, before it is applied. And it has to be capable of producing a decision to decline business, otherwise the assessment has no operative content.
Where this course goes next
The remaining lessons follow the shape of an actual control framework.
The business risk assessment comes first, because everything else is supposed to be derived from it and frequently is not. Then customer due diligence, including the identification and verification work that everything downstream depends on. Then source of funds and source of wealth, which is where gambling differs most from other sectors. Then transaction monitoring, which is where the typologies above become rules and models. Then sanctions and screening, which follows a different logic from everything else. Then reporting, record-keeping and governance, which is where the obligation is discharged or not.
Throughout, the operative requirement is the current law and regulatory guidance of the market you operate in. This course teaches the structure, the reasoning and the failure modes, which are stable. The thresholds are not, and anyone who quotes one from memory in a regulated context is making an avoidable mistake.