AML Compliance in Online Gambling: A Plain-English Explainer
Anti-Money Laundering, or AML, is the network of rules that makes it harder for criminals to use casinos as laundromats. Here is what it actually means and how it works.
Words by Marco Ricci4 min read
Anti-Money Laundering, or AML, is the network of rules that makes it harder for criminals to use casinos as laundromats. It is the unglamorous machinery that sits behind the welcome page.
What Is Money Laundering?
Money laundering is the process of taking cash earned illegally and converting it into money that looks legitimate. A drug trafficker has 2 million in cash from cocaine sales. He cannot deposit it in a bank without triggering a Currency Transaction Report, a red flag the government uses to catch criminals. So instead, he breaks it into pieces under $10,000 and spreads the deposits across banks. Or he uses a casino. He buys chips with the cash, plays a few hands, and cashes out. On the surface, he has now "won" money from gambling and can claim it as income.
The numbers matter. According to the United Nations Office on Drugs and Crime, global money laundering is estimated between $800 billion and $2 trillion annually. That is 2 to 5% of global GDP. Casinos are convenient targets because cash exchanges hands constantly. This is why AML exists.
The United States created the primary AML law in 1970 with the Bank Secrecy Act.
The Regulatory Framework
The United States created the primary AML law in 1970 with the Bank Secrecy Act. It required banks to identify customers and report suspicious activity. In 2002, after September 11, Congress extended AML to casinos and card rooms through the Patriot Act.
The Malta Gaming Authority, which licenses online casinos serving Europe, has its own AML code. So does the UK Gambling Commission. So does Curaçao eGaming. Each jurisdiction has different thresholds and different penalties. An operator licensed in Malta must follow Malta's rules. An operator in Curaçao follows those rules instead.
How KYC Works
KYC stands for Know Your Customer. Before opening an account, an online casino must verify your identity. This means a photo ID, a recent utility bill, and increasingly, a photograph of you holding your ID.
They check multiple databases. The FinCEN (Financial Crimes Enforcement Network) database. The Office of Foreign Assets Control list. The databases of other casinos and sportsbooks. The purpose is to cross-reference you against sanctions, against known shell accounts, against patterns that look like layering.
A well-run operator takes 1 to 3 hours to verify a customer. Some operators claim 15 minutes. That speed, offered across thousands of daily signups, should make you skeptical.
Casinos file Suspicious Activity Reports, or SARs, when they notice behavior that does not fit.
Suspicious Activity Reports
Casinos file Suspicious Activity Reports, or SARs, when they notice behavior that does not fit. A player deposits $50 once a week but wins $100,000 and immediately withdraws. A new account trades 500 chips in 7 minutes then cashes out $50,000. A player from a country under U.S. sanctions appears in the system.
The casino files the report with FinCEN. FinCEN does not call the police. It does not freeze the account automatically. It files the report where law enforcement can access it.
How many SARs does an average casino file? A large operator with 200,000 active players might file between 500 and 2,000 per year. That is between 2 and 10 per thousand players. No operator has published aggregate data, so these are estimates from filings.
Transaction Monitoring
Once you open an account, the casino watches you. Software flags unusual patterns: deposits that are inconsistent with your playing history, transactions that accelerate suddenly, rapid deposits and withdrawals.
The software is imperfect. A high-variance poker player or a slots player on a lucky streak will trigger flags. But false positives are better than false negatives. A casino prefers 50 legitimate players flagged wrongly to 1 money launderer who gets through.
Withdrawal Holds and KYC Escalation
When you request a withdrawal above a certain threshold, usually around $10,000 or $15,000, the casino may ask questions. The staff may request additional documentation. Bank statements. Proof of the source of your deposit. This is called KYC escalation and it is required in most regulated jurisdictions.
A player on a vacation who won $20,000 at slots might not have prepared this documentation. They get frustrated. Many jurisdictions allow 5 to 10 business days for the casino to verify. Some operators stretch that timeline. Some push back only when necessary.
The Cost of Compliance
AML is expensive. A mid-sized operator pays $2 million to $5 million annually in compliance staff, software, and third-party verification services. A large operator pays significantly more. These costs are passed to the player through margin adjustments and reduced bonuses.
Regulators estimate that 5 to 10% of a casino's revenue goes to AML infrastructure, depending on jurisdiction. The MGA, which is one of the most stringent, requires most of that spending.
When AML Fails
It fails often. Between 2018 and 2024, multiple online casinos were fined for AML failures. Full Tilt Poker was shut down in 2011 partly due to AML violations. The charges alleged that the company failed to monitor suspicious activity effectively and moved money through multiple shell accounts.
These are not accusations of facilitating money laundering directly. They are allegations of negligence, of failure to build sufficient safeguards.
AML is the invisible wall between you and criminals. It is not perfect. It creates friction for legitimate players. But it works often enough to matter, and that is why every regulated casino is required to maintain it.