The case against, stated fairly
Regulators, banks and law enforcement object to crypto casinos for one reason above all others: a venue that accepts value from an address it cannot attribute to a person, lets that value be wagered, and pays it out to another address, is a machine for changing the ownership and history of money without anyone knowing whose it was. Gambling has always been useful for laundering; the AML and Financial Crime course on this site explains why. A crypto casino removes the identity check that regulated gambling put in the way.
The segment's answer is that most of its customers are ordinary gamblers, that its larger operators verify identity above thresholds and screen addresses, that the blockchain is more transparent than cash, and that regulated casinos launder money too. Each of those is true. None of them is the point, which is that the controls are, in practice, largely the operator's choice rather than a requirement a regulator enforces, and that the operators with the least interest in controls are the ones most exposed to laundering.
This lesson sets out how laundering through crypto casinos works, how it is traced, what sanctions add, and what a serious control framework looks like.
Typologies
Placement and layering through play. Deposit illicit crypto, wager it at low risk (a dice game set close to an even chance, or bets on both sides of a market), and withdraw. The funds now come from a casino, and the trail behind them has a gambling transaction in it. The small amount lost to the house edge is the fee. UNODC describes this cash-in, cash-out pattern as the simplest, most typical method of laundering money at a casino, and it works better with a casino that never asked who the depositor was.
Chip dumping and transfers. Two accounts play against each other, or one account tips, transfers or loses deliberately to another, moving value between the parties under cover of gambling. Player-to-player games and tipping features make it easy; originals with two sides make it trivial. UNODC notes that deliberate losses to an accomplice dodge AML detection that is triggered only by bets against the casino itself.
Mule and third-party accounts. Accounts opened by or bought from other people, used to deposit and withdraw funds that are not theirs. Where verification is light, accounts are cheap: UNODC reported, citing regional authorities, mule bank accounts across the Asia Pacific on sale for as little as US$30.
Structuring. Keeping deposits and withdrawals below the operator's verification threshold, across many accounts if necessary. Chainalysis has described gambling services in Chinese-language laundering networks that fragment large transactions into small amounts to evade detection, and notes that many such services accept crypto without asking for identity details.
Proceeds of specific crimes. Ransomware payments, exchange hacks, investment-fraud proceeds and the outputs of the industrial-scale scam operations that UNODC has tied to the casino and online gambling industry of East and South East Asia. UNODC found online gambling platforms, especially illegal ones, among the most popular vehicles for crypto-based money launderers, particularly those using Tether (USDT) on the TRON blockchain, and Chainalysis recorded a substantial increase in funds sent from ransomware to gambling platforms in 2023.
Sanctions evasion. Customers in sanctioned jurisdictions using crypto casinos as a way to convert and move value, and operators, wittingly or not, providing a service to sanctioned persons. The FATF's July 2026 update lists sanctions evasion among the ways criminal networks abuse virtual assets.
How it is traced
The blockchain is public, and the crypto casino's deposit addresses are known to the analytics firms that law enforcement, exchanges and regulators use. Those firms label addresses by the entity that controls them, cluster addresses that belong together, and trace funds from a known illicit source (a hack, a darknet market, a sanctioned wallet) to wherever they go. When they go to a casino, the casino's deposit address is the end of that trail and the start of the next question: who was the account holder?
This is the reversal that the segment did not anticipate. Cash leaves no trail; crypto leaves a permanent one. A casino that accepted stolen funds in 2022 can be identified as having done so in 2026, the customer's account can be tied to the deposit, and the withdrawal address can be traced onward. Centralised exchanges, which are regulated as virtual-asset service providers, can freeze funds coming from illicit sources and identify the owner. Stablecoin issuers can freeze the tokens where they sit, and the United States' GENIUS Act, signed in July 2025, requires regulated issuers to have the technical capability to block, freeze and reject impermissible transactions. The crypto casino is not beyond the reach of investigation; it is, in some ways, more exposed to it than a cash casino ever was.
What a control framework looks like
The larger crypto-native operators have built AML functions, partly because their licences now require it (Curaçao, for example, made its gaming regulator the AML/CFT supervisor for all gambling in and from the island in 2019) and partly because their banking, sponsorship and licensing ambitions depend on it. The framework is recognisable from regulated gambling, adapted to the rail.
Address screening. Every deposit address and withdrawal address checked against analytics providers' risk scores before funds are credited or released. Deposits from mixers, sanctioned addresses, known hacks or darknet markets are held.
Identity thresholds. Verification required at a cumulative deposit or withdrawal threshold, at a risk trigger, or, for the operators moving toward regulation, at registration. The thresholds are the operators' choice unless a licence sets them, and they are the number regulators ask for first. For comparison, the FATF standards set USD/EUR 1,000 as the threshold for occasional transactions above which virtual-asset service providers, and casinos that offer virtual-asset-based gaming, must carry out customer due diligence.
Source of funds. For large deposits, the same enquiry a regulated casino makes, with the added question of where the crypto came from, which the blockchain can partly answer.
Behavioural monitoring. The play patterns that indicate laundering rather than gambling: minimal-risk wagering, rapid deposit-withdraw cycles, transfers between accounts, deposits from many addresses, and withdrawals to addresses that are not the deposit source.
Sanctions screening. Names against sanctions lists where identity is known; addresses against sanctioned-address lists always; geography against the operator's blocked-country list, with the recognition that a VPN defeats the last of these.
Reporting. Suspicious activity reported to the financial intelligence unit of the licensing jurisdiction, where one exists and functions, and cooperation with law enforcement requests.
The gap between this framework and what most of the segment does is the regulators' case. An operator with an island licence that does not require any of it, serving a customer base that chose the venue for its lightness, has every commercial reason not to build it.
The Travel Rule and the regulated perimeter
Financial Action Task Force standards require virtual-asset service providers to obtain, hold and transmit originator and beneficiary information when they transfer virtual assets, the "Travel Rule". Countries may apply fewer requirements to transfers below USD/EUR 1,000, but the European Union applies the rule to transfers of crypto-assets regardless of their amount, from 30 December 2024. In July 2026 the FATF reported that 83 per cent of surveyed jurisdictions had passed Travel Rule legislation, though almost half of those had yet to take any supervisory or enforcement action under it. The FATF's guidance is that when a casino offers virtual-asset-based gaming, countries should subject it to all the measures for virtual-asset service providers, but whether a crypto casino is one is a question jurisdictions answer differently; where it is, the casino owes the same obligations as an exchange. The regulated on-ramps and off-ramps described in lesson two already comply, which is why the identity a customer thought they had left behind is waiting at both ends.
The European Union's Markets in Crypto-Assets Regulation (MiCA), fully applicable since 30 December 2024, and the American stablecoin legislation of 2025, the GENIUS Act, regulate the issuers and service providers around the segment rather than the casinos themselves, and their effect is indirect: a casino running on regulated stablecoins, deposited through regulated on-ramps, is a business whose money is inside the regulated perimeter even when its licence is not.
Responsible gambling as a financial-crime control
The identity question is also the harm question. A customer who cannot be identified cannot be self-excluded, cannot be affordability-checked, cannot be told they are under age, and cannot be recognised as the same person who was excluded last month under another wallet. Regulated markets' player-protection regimes and their AML regimes both rest on knowing who the customer is, and a crypto casino that does not is failing both at once. The Responsible Gambling course covers what protection requires; the point here is that the controls a regulator would demand for laundering are the same controls it would demand for harm, and the segment's argument against one is its argument against the other.
What to take from this lesson
Crypto casinos are useful for laundering because they accept value without identity and return it with a gambling transaction in its history; the typologies are the old ones with the identity check removed. The blockchain's permanence has reversed the exposure: casino deposit addresses are labelled, stolen funds are traced to them and onward, and exchanges and stablecoin issuers can freeze what arrives. A serious control framework (address screening, identity thresholds, source of funds, behavioural monitoring, sanctions, reporting) exists at the top of the segment and not below it, and the gap is the regulators' case. Identity is the control that serves AML and player protection alike.