The case against, stated fairly
Regulators, banks and law enforcement object to crypto casinos for one reason above all others: a venue that accepts value from an address it cannot attribute to a person, lets that value be wagered, and pays it out to another address, is a machine for changing the ownership and history of money without anyone knowing whose it was. Gambling has always been useful for laundering; the AML and Financial Crime course on this site explains why. A crypto casino removes the identity check that regulated gambling put in the way.
The segment's answer is that most of its customers are ordinary gamblers, that its larger operators verify identity above thresholds and screen addresses, that the blockchain is more transparent than cash, and that regulated casinos launder money too. Each of those is true. None of them is the point, which is that the controls are the operator's choice rather than a regulator's requirement, and that the operators with the least interest in controls are the ones with the most laundering.
This lesson sets out how laundering through crypto casinos works, how it is traced, what sanctions add, and what a serious control framework looks like.
Typologies
Placement and layering through play. Deposit illicit crypto, wager it at low risk (dice at 49.5 per cent win chance, or bets on both sides of a market), and withdraw. The funds now come from a casino, and the trail behind them has a gambling transaction in it. A few per cent lost to the house edge is the fee. This is the oldest gambling typology, and it works better with a casino that never asked who the depositor was.
Chip dumping and transfers. Two accounts play against each other, or one account tips, transfers or loses deliberately to another, moving value between the parties under cover of gambling. Player-to-player games and tipping features make it easy; originals with two sides make it trivial.
Mule and third-party accounts. Accounts opened by or bought from other people, used to deposit and withdraw funds that are not theirs. Where verification is light, accounts are cheap.
Structuring. Keeping deposits and withdrawals below the operator's verification threshold, across many accounts if necessary.
Proceeds of specific crimes. Ransomware payments, exchange hacks, investment-fraud proceeds and the outputs of the industrial-scale scam operations that law enforcement has traced through crypto casinos, sometimes in very large amounts. Public blockchain analysis has repeatedly shown stolen funds arriving at casino deposit addresses within hours of a theft.
Sanctions evasion. Customers in sanctioned jurisdictions using crypto casinos as a way to convert and move value, and operators, wittingly or not, providing a service to sanctioned persons.
How it is traced
The blockchain is public, and the crypto casino's deposit addresses are known to the analytics firms that law enforcement, exchanges and regulators use. Those firms label addresses by the entity that controls them, cluster addresses that belong together, and trace funds from a known illicit source (a hack, a darknet market, a sanctioned wallet) to wherever they go. When they go to a casino, the casino's deposit address is the end of that trail and the start of the next question: who was the account holder?
This is the reversal that the segment did not anticipate. Cash leaves no trail; crypto leaves a permanent one. A casino that accepted stolen funds in 2022 can be identified as having done so in 2026, the customer's account can be tied to the deposit, and the withdrawal address can be traced onward. Exchanges, which are regulated, freeze the funds when they arrive and identify the owner. Stablecoin issuers freeze the tokens where they sit. The crypto casino is not beyond the reach of investigation; it is, in some ways, more exposed to it than a cash casino ever was.
What a control framework looks like
The larger crypto-native operators have built AML functions, partly because their licences now require it and partly because their banking, sponsorship and licensing ambitions depend on it. The framework is recognisable from regulated gambling, adapted to the rail.
Address screening. Every deposit address and withdrawal address checked against analytics providers' risk scores before funds are credited or released. Deposits from mixers, sanctioned addresses, known hacks or darknet markets are held.
Identity thresholds. Verification required at a cumulative deposit or withdrawal threshold, at a risk trigger, or, for the operators moving toward regulation, at registration. The thresholds are the operators' choice unless a licence sets them, and they are the number regulators ask for first.
Source of funds. For large deposits, the same enquiry a regulated casino makes, with the added question of where the crypto came from, which the blockchain can partly answer.
Behavioural monitoring. The play patterns that indicate laundering rather than gambling: minimal-risk wagering, rapid deposit-withdraw cycles, transfers between accounts, deposits from many addresses, and withdrawals to addresses that are not the deposit source.
Sanctions screening. Names against sanctions lists where identity is known; addresses against sanctioned-address lists always; geography against the operator's blocked-country list, with the recognition that a VPN defeats the last of these.
Reporting. Suspicious activity reported to the financial intelligence unit of the licensing jurisdiction, where one exists and functions, and cooperation with law enforcement requests, which the larger operators now publicise.
The gap between this framework and what most of the segment does is the regulators' case. An operator with an island licence that does not require any of it, serving a customer base that chose the venue for its lightness, has every commercial reason not to build it.
The Travel Rule and the regulated perimeter
Financial Action Task Force standards require virtual-asset service providers to share sender and recipient information on transfers above a threshold, the "Travel Rule", and most jurisdictions have implemented it for exchanges and custodians. Whether a crypto casino is a virtual-asset service provider is a question jurisdictions answer differently; where it is, the casino owes the same obligations as an exchange. The regulated on-ramps and off-ramps described in lesson two already comply, which is why the identity a customer thought they had left behind is waiting at both ends.
The European Union's MiCA framework and the American stablecoin legislation of 2025 regulate the issuers and service providers around the segment rather than the casinos themselves, and their effect is indirect: a casino running on regulated stablecoins, deposited through regulated on-ramps, is a business whose money is inside the regulated perimeter even when its licence is not.
Responsible gambling as a financial-crime control
The identity question is also the harm question. A customer who cannot be identified cannot be self-excluded, cannot be affordability-checked, cannot be told they are under age, and cannot be recognised as the same person who was excluded last month under another wallet. Regulated markets' player-protection regimes and their AML regimes both rest on knowing who the customer is, and a crypto casino that does not is failing both at once. The Responsible Gambling course covers what protection requires; the point here is that the controls a regulator would demand for laundering are the same controls it would demand for harm, and the segment's argument against one is its argument against the other.
What to take from this lesson
Crypto casinos are useful for laundering because they accept value without identity and return it with a gambling transaction in its history; the typologies are the old ones with the identity check removed. The blockchain's permanence has reversed the exposure: casino deposit addresses are labelled, stolen funds are traced to them and onward, and exchanges and stablecoin issuers freeze what arrives. A serious control framework (address screening, identity thresholds, source of funds, behavioural monitoring, sanctions, reporting) exists at the top of the segment and not below it, and the gap is the regulators' case. Identity is the control that serves AML and player protection alike.