Does online gambling have a money laundering problem?

Our November article on the extraordinary level of financial settlements being imposed by the Gambling Commission (GC) had almost as a throwaway remark a comment that the overwhelming reason given was social responsibility and AML failures. We asked at the time whether or not this indicated a money laundering problem in online gambling without drawing any firm conclusions. Since then, the European Commission has published its Supranational Risk Assessment (SNRA) which singled out gambling (alongside crypto-assets) as a sector which required a “re-calculation of risk levels involved” as “significant changes have been detected” in the time elapsed since the previous report in 2019.

This is in contrast to the findings of the MONEYVAL Panel of Experts report3 (albeit dating from 2013) which said:

There is currently very limited information or evidence suggesting that licensed online gambling operators in Europe are being misused for ML/FT purposes. Furthermore, various sources of literature on the topic, which were consulted by the project team, seem to indicate that the ML/FT risks linked to regulated online gambling are low and that the sector is not likely to be the preferred option for money launderers or terrorist financiers due to the following factors:

• Gamblers are subject to customer identification controls and therefore their identity is known;

• Financial transactions related to online gambling are conducted electronically and are therefore easily traceable;

• All wagering carried out by online gambling operators is recorded.

So where does the truth lie? Has so much changed since 2013 that online gambling deserves to be considered at high risk of money laundering?

A growing problem?

In 2018, the EU introduced the Fifth Anti-Money Laundering Directive (5AMLD), which expanded the scope of AML regulations to include provisions for the gaming and gambling industry, making it mandatory for operators to implement effective AML measures. Under 5AMLD, gaming and gambling companies are required to conduct Customer Due Diligence (CDD), and Enhanced Due Diligence (EDD) measures for high-risk customers, including politically exposed persons (PEPs). Operators must also monitor and report any suspicious transactions to the relevant authorities, such as the Financial Intelligence Units (FIUs). Despite this, reports of AML failures in gambling across European jurisdictions have been limited to date.

In the UK, the key AML regulations are the Money Laundering, Terrorist Financing, and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), which apply to all sectors, including the gaming and gambling industry. MLR 2017 requires all gaming and gambling companies to conduct a risk assessment of their business to identify and mitigate the risks of money laundering and terrorist financing. In addition, the UKGC has been given specific responsibility for money laundering in the gambling sector and issued specific guidance for the gaming and gambling industry on AML requirements. This key difference from most other jurisdictions explains why anti-money laundering failures have appeared so frequently in its judgements. But does it indicate a money laundering problem?

In its SNRA the Commission did not provide any data or evidence to support the risk upgrade but quoted unnamed “competent authorities reporting that risks arising from online gambling have increased”. This, together with an industry “characterised by fast economic growth and technological development, with a strong growth of the online sector”, seems to have been enough to give rise to the concerns. At the same time, the SNRA seemed to relax its stance towards brick-and-mortar casinos. Although these still “present an inherently high-risk exposure, their inclusion in the AML/CFT framework since 2005 has had a mitigating effect”.

Taken at face value, online gambling with its high growth, technology base and chequered past associations would appear to be the perfect conduit for the transfer of illegal funds to the legitimate economy. There are huge volumes of financial transactions providing cover, there is no physical product and winnings are often tax free. The European Gaming and Betting Association (EGBA) in its advice on AML also recognizes a higher risk inherent in the digital world. It says: “business relationships that do not take place face to face, such as online gaming, pose a higher ML/TF risk (e.g., risks of identity theft and other fraudulent acts relating to impersonation).” Although it does go on to say that “due to the technological mitigating measures and controls put in place, this risk can be mitigated to an acceptable level.”

With concerns raised at such a high level, we wanted to investigate further to understand whether worries over money laundering through online gambling were justified and whether the steps being taken in the UK and further afield are likely to achieve their objective of reducing the risks. Without such analysis there is a danger that there is a greater focus on what AML compliance should look like than is known about how money laundering is organized via online gambling platforms or the reductive impact of AML compliance mechanisms.

Some definitions

Money laundering is described in the UN Vienna 1988 Convention Article 3.1 as: “the conversion or transfer of property, knowing that such property is derived from any offense(s), for the purpose of concealing or disguising the illicit origin of the property or of assisting any person who is involved in such offense(s) to evade the legal consequences of his actions.” For the purposes of this article we will consider this the “traditional” definition.

This narrow description is quite different from the UK position where money laundering is defined in the Proceeds of Crimes Act 2002 (POCA) and includes all forms of handling or possessing criminal property,8 including possessing the proceeds of one’s own crime, and facilitating any handling or possession of criminal property. The catch all UK approach explains in part why there are so many more apparent AML failures identified by the Gambling Commission. As highlighted above, the UKGC’s specific remit to address money laundering in the industry is another reason. In March 2023 in just the latest enforcement action, brands within the William Hill Group were asked to pay a record £19.2 million penalty for social responsibility and anti-money laundering failures.

The SNRA essentially encourages European gambling regulators to move much closer to the UK position. The EGBA guidelines also mirror this position in advising gambling operators to take a proactive approach to consider the risks of money laundering when conducting customer due diligence and monitoring. Given the broad agreement that the UK’s approach is helpful, we will use UK data to try and understand whether and how much money laundering is going on and how current AML regulations would likely impact it.

Under the UK definition of money laundering, the proceeds of crime flowing through online gambling platforms fall broadly into two categories. Internally and externally derived funds. Internally derived funds are those where there is an irregularity within the game itself. Players of online poker could, for example, collude using messaging services to cheat other players. The EGBA confirms this in its 2023 AML Guidelines saying that “where the outcome can be influenced by the customer, such as in the case of poker, operators need to monitor for signs of individual misuse or collusion.”

In general it confirms: “Transfer of funds between the accounts of different players within the same operator presents a risk factor, which must be considered due to the peer-to-peer nature.”

The organization of illegal lotteries is another example of irregularities, this time in the entire game. However, illegal lotteries have as their main objective the generation of profits through the provision of gambling services without having obtained a license.

In both cases the funds generated are the proceeds of crime and those involved may have committed a money laundering offence. That said, these types of funds do not need to be laundered in the traditional sense as they are already part of the financial system (a core objective of money launderers). Having been staked and been part of a gambling game they can be withdrawn unhindered.

The second category is externally derived funds, that is funds which are the product of crimes carried out elsewhere. These subdivide broadly into two: organized criminal gangs using gambling to recycle funds from drug dealing, fraud etc. and those using illicit money to fund their gambling habit. It is immediately obvious that the two groups have very different motivations. As the SNRA itself says, “the criminal economy remains overwhelmingly cash-based” giving organized crime groups the challenge of turning large amounts of banknotes into funds which can be used legitimately. By contrast, the problem gambler has no interest in money laundering per se, but may have committed a money laundering offence by using stolen money to gamble.

What is the risk of money laundering actually taking place?

Having identified the two groups at risk of being involved in money laundering through online gambling, we will now try to assess the levels of risk in both cases. This is relevant as most advice is to take a risk-based approach to resourcing AML.

Suspicious Activity Reports (SARs) are the only proxy data available to try to understand the size of the potential criminal activity channeled through gambling. In 2021/2 over 901,000 SARs were received by the UK National Crime Agency (NCA) resulting in the denial of £305.7m.10 However, only 6,352 SARs were made by the gaming/leisure sector (which includes both physical and online casinos), accounting for 0.7 percent of the total. The data is not broken down further, but if this translated perfectly into the proportion of funds denied, the total in 2021/2 would have been £2.14m.

The kind of criminality uncovered by SARs is also interesting. John Lewell-Clarke, Financial Intelligence Officer at the Gambling Commission told SARs in Action magazine that: “SARs provide us with typologies and are sources of information to increase our understanding of how criminals may be exploiting the gambling sector. This usually entails people acting as unlicensed bookmakers, taking bets or acting as a betting intermediary.

He goes on to say that “The Commission identified an increasing offering of illegal lotteries where no gambling license was held.” As we have already seen, these internally derived funds may be criminal but they do not require money laundering in the traditional sense of the term.

Looking at consecutive SAR Annual Reports there is a clear increase in the number of SARs submitted from the gaming and leisure sectors growing from 2,154 in 2018 to 5,150 in 2020; and from bookmakers growing from just 872 in 2018 to 1,984 in 2020.12 Again the data is tantalizingly broad brush, but the reasons behind the increase have at least as much to do with engagement by the NCA as they do with an increase in suspicious activity. As Keith Bristow, independent chair of the Gambling Anti-Money Laundering Group says “It was noted by the NCA that the number of SARs submitted by the gambling industry [in 2016] was low and the quality submitted variable. The industry has since worked to improve the quality and number of SARs submitted.”

If the quantity of reported suspicious activity is low and mainly related to illegal gambling, what is the likelihood that a large amount of dirty money is washing through the industry undetected? Without the data this is impossible to answer with any certainty but a look at the modus operandi of organized criminal gangs may be instructive.

Criminal activity that generates large volumes of cash creates a challenge for the criminal, one which a brick-and-mortar casino may help to solve. The Cullen Commission Report into money laundering in British Columbia published in June 2022 highlighted the role of the province’s casinos and the BC Lottery in turning hundreds of millions of dollars from cash into a bankable form.13 In over 460 pages of often brutal assessment of the failures of land-based gambling there was not a single reference to the digital space as a conduit for illegal cash. This could be because there is only one legal online gaming operator, but the thoroughness with which investigations were conducted into other sectors strongly suggests that the Commission did not consider online gambling was at high risk of money laundering.

In order for cash to be deposited with an online gambling operator it first has to be converted to digital form. There could be a risk of cash being deposited at those establishments with both retail and online operations, but they are likely to be the larger operators with due diligence procedures in place. In any event, if cash is successfully converted into chips or slot credits it would seem more likely that it would be cashed out at the casino where it was deposited. At relatively low levels, pre-paid vouchers or a pre-loaded card used to deposit money into a player’s account methods are much more vulnerable to criminal exploitation because they provide customers with the possibility to mask their identity and their source of funding.”

When it comes to organized criminal gangs, however, the challenge of cash seems unlikely to be best solved through online gambling. Large amounts of cash can be washed through cash-intensive businesses, smuggled to jurisdictions with weak AML or high corruption where it can be deposited, or cash mules can be used to deposit smaller amounts at multiple banks etc. In all these cases, assuming it is successful, the money ends up in a useable form. It may be further disguised by layering through a complex series of financial transactions. This will disguise the audit trail and provide anonymity, but it is no more likely to involve a digital casino or other online gambling company than any other type of business. At lower levels, a gambling win can be used to explain source of funds being used in another transaction, but this is not a practical solution where criminal activity continues to generate significant cash profits.

Online criminal activities such as hacking and ransomware, drug dealing via darkweb markets etc. are more likely to show up in online gambling, in theory at least. In his 2018 paper, Sex, drugs, and bitcoin: How much illegal activity is financed through cryptocurrencies? Sean Foley of the University of Sydney found that approximately one-quarter of bitcoin users and one-half of all bitcoin transactions were associated with illegal activity. He estimated that around US$72 billion of illegal activity per year involves bitcoin. The figures are disputed, but the age of the data suggests that, if anything, they could be under- rather than overstated. Revelations from the closure of the Silk Road and Hydra marketplaces showed high levels of criminality associated with bitcoin use and there were US$8.2 trillion worth of bitcoin transactions in 2022. This evidence and more besides supports the European Commission assessment in its SNRA that the risk profile of crypto currencies should be raised.

The number of transactions linked to online gambling is unknown although data from Satoshi Dice suggests it is likely to be significant. Whether these are evidence of money laundering is a completely different question, however. At lower levels there are now many more places to spend crypto and for larger sums there are well-trodden routes to turn crypto into fiat currency. Again, online gambling could be used to further disguise the origin of funds but there is nothing inherent in, or particularly efficient about online gambling as a method to achieve this aim.

On the other hand, where a customer transfers funds from a bank account or a card linked to a bank account held in their name with an institution established in a reputable jurisdiction, the ML/TF risk is theoretically low. However, this did not prevent the UKGC from citing over confidence that funds coming through Financial Conduct Authority (FCA) regulated firms mitigated/removed proceeds of crime risk. It is interesting that proceeds of crime is highlighted here as there is no suggestion that money used to gamble, with all the accompanying risks of losing, is evidence of organized criminals laundering their ill-gotten gains. Criminals may accept losses as the price of turning cash into bankable funds and payout rates in online gambling are high. However, the biggest risk, according to BBC specialist journalist Geoff White, is identity theft.

“I’d say online gambling businesses are potentially at more at risk than other [land based] ones because online identity validation is so much harder to do than in physical establishments, and online fraud can be carried out at scale. For example, you might be able to trick a casino with a fake ID, but if 100 of you turn up and try it, you’ll likely fail. By contrast, if you make 100 automated account creation attempts online, how many will the automated fraud tools detect? We’ve seen fraudulent account creation inflicted en masse on challenger banks. We’ve also seen North Korean hackers duping identity verification systems at crypto businesses so it seems logical they’d try the same tricks with online gambling. Money laundering is a crime of opportunity and criminals are always changing their tactics.”

In 2016, White reported on the attempt by North Korea’s Lazarus Group of hackers to steal US$1 billion from the Bank of Bangladesh. Despite the heist being a digital one, the audacious scale of the sums involved was enough to mobilise law enforcement authorities around the world. This meant that, not only was most of the money recovered, but the methods used try to launder it were also revealed. One of these was the infamous episode in the Manila Solaire and Midas casinos where US$50 million was deposited. Men sat and played at the tables for weeks betting against each other before exchanging their chips for cash making it practically impossible for investigators to trace.

White investigated a similar North Korean attack on Malta’s Bank of Valetta in February 2019. That investigation yielded the only evidence of stolen money being laundered through online sports betting company, Tipico. Conversations between the launderers emerged in an FBI report showing that EUR500,000 of the stolen money had been moved through the company. Although there is no suggestion that Tipico was knowingly involved, they were still used to launder money. One of two possibilities seems likely: either the criminals had an accomplice within Tipico or they used a fake ID to set up an account there.

In a more recent case reported in The Times, a financier known as Opel confessed to having been involved the laundering of £200 million for the notorious Kinahan family crime cartel. He recounts using “investments in art, wine, crypto, whisky and stocks around the world’. He mentions numerous “offshore accounts, trust funds, companies and investment schemes” and “trading platforms in tax havens”. Opel says: “How do billionaires that demand discretion make shrewd investments? They diversify splitting their investments by purchasing wine, fine art and cryptocurrencies.” The money “had to pass all the know-your-customer (KYC) and anti-money laundering (AML) requirements, which were very thorough. But once this was achieved, it would be impenetrable to law enforcement and could be maintained for generations.”19 At no point in the interview does Opel mention using online gambling to launder his client’s cash.

Whilst the reported instances of traditional money laundering through online gambling are rare, the fact that it can happen and that enterprising criminals will try to exploit any weaknesses indicates that the SNRA is right to raise the possibility. Asking operators to take a risk-based approach, however, is hard without evidence of actual sums being funnelled through online gambling platforms.

Beyond the world of organized crime, there are numerous examples of individuals using money that they have stolen from their employers, from charities or family and friends to feed a gambling habit. As already noted, these are not people interested in laundering money and certainly cannot have been on the minds of the European Commission in its SNRA who are most worried about “the use of anonymous e-money and virtual currencies and the emergence of unauthorised online gambling operators”. The EGBA also identifies “categories of customers whose activities may indicate a higher risk include PEPs, high risk occupations, high spenders, disproportionate spenders, etc.”

Does AML prevent money laundering?

Given the amount of effort being expended by online gambling operators on AML compliance, it is reasonable to ask whether or not it is making a difference. The answer very much depends on the kinds of money laundering we are talking about. Whilst criminal gangs may target online gambling, there is no overwhelming evidence or logic that they will. The Moneyval assessment from 2013 remains valid today: identity and traceability are the keys and if there are strong checks on customers and source of funds then the EGBA should be correct that risk can be mitigated to an acceptable level.

Jurisdictions with weak AML regulations, weak enforcement of regulations or high levels of corruption will always be attractive to money launderers. Some have suggested that organized crime gangs may create entire fake online gambling companies as a front to launder money. This may indeed be the case but no AML checks by legitimate operators will prevent such an activity.

The SNRA is right to focus on the tightening up of systems and education of staff but there is very little a regulator can do to prevent an employee of an online gambling company who is being threatened by launderers from colluding with them. As other methods of money laundering become more difficult, the attractiveness of online gambling may increase but the industry is not the only one that can be targeted. The North Korean hackers diverted funds through a Sri Lankan charity paying ten percent “commission” for the organization to wash US$ several million through its accounts.

In March 2023, the Gambling Commission announced enforcement action against Kindred brands 32Red and Platinum Gaming making the following points about AML failures:

• 32Red failed to thoroughly implement the measures described by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer Regulations 2017).
• The customer account reviews identified that financial triggers for Anti-Money Laundering reviews at 32Red were too high and not appropriate to effectively manage money laundering and terrorist financing risks. Inappropriate controls allowed significant levels of gambling to take place within a short space of time without the operator knowing anything about customers’ financial situations.
• 32Red customers subject to a Source of Funds (SOF) / Source of Wealth (SOW) request were, in most cases, not restricted from depositing and gambling during the two-week period allowed by the operator to respond to the request. This resulted in further significant depositing and loss activity occurring.
• In relation to 32 Red, there was an over reliance on confidence that funds coming through Financial Conduct Authority (FCA) regulated firms mitigated/removed proceeds of crime risk.
• One 32Red account was not deposit blocked, in line with its own policy and procedures, after an information request deadline had expired. This allowed the customer to continue depositing, gambling £16,280 in total and losing £8,321 for a further two weeks until their account was blocked.
• Platinum Gaming’s policies, procedures and controls in relation to AML were not appropriate.

Platinum Gaming failed to ensure that its policies, procedures and controls were kept under review and revised appropriately to ensure that they remained effective.23

There is no suggestion in any of the points that any actual money laundering of the traditional kind has taken place. As Duncan and Lord say, there is a greater focus on identifying non-compliance than in understanding how organized criminals may use online gambling to launder large amounts of money.24

In the William Hill case later in the same month, AML failures included allowing customers to deposit large amounts without carrying out appropriate checks – one customer was able to spend and lose £70,134 in a month, another to lose £38,000 in five weeks, and another to lose £36,000 in four days. The sums involved, whilst large, are not evidence of organized money laundering. Andrew Rhodes, CEO of UKGC, admitted as much when he spoke to the BBC.

“What we found were serious non-compliance failures. I’m not saying this money was from criminal enterprise, but we must have safeguards and checks in place.”

Pathological gamblers’ technical breach of money laundering rules, i.e. gambling with the proceeds of crime, has provided cover for the UKGC to use greater powers under AML regulations to penalise operators. No one is denying or condoning the egregious examples of individuals being allowed unchecked to gamble sums which are way beyond any reasonable assessment of what they can afford. But to lump them in with international crime gangs or give the impression that operators are in some way colluding with money launders feels disingenuous.