On 8 April 2025, the Gambling Commission released a publication on the emerging money laundering and terrorist financing (“ML/TF”) risks. Under licence condition 12.1.1 of the Licence Conditions and Codes of Practice (the “LCCP”), licensees must keep up-to-date with emerging risks information published by the Gambling Commission, and ensure their ML/TF risk assessments and related policies, procedures and controls are reviewed and revised appropriately to ensure that they remain effective.

The publication identifies the following 13 emerging risks and what licensees need to do.

1. Money service business activity in remote and non-remote casinos

Some remote and non-remote casinos offer money service business (“MSB”) facilities, which include foreign currency exchange, third-party cheque cashing and third-party money transfer (into and out of the casino).

The Gambling Commission is aware of casino customers attempting to deposit large denomination notes of foreign currencies (including €500 notes) into casinos. It is noted that the HMRC guidance on Understanding risks and taking action for money service businesses states the sale of high value notes, in any currency, entails a significant money laundering risk and any request to buy or sell €500 notes or quantities of other high denomination notes should be treated as high risk. Similarly, HM Treasury’s UK national risk assessment of money laundering and terrorist financing report states that criminals have been known to use currency exchange services to convert criminal cash into high denomination foreign currency notes.

The Gambling Commission surveyed the MSB activity offered by casinos and noted a reduction in the number of casinos offering MSB activity, as well as a reduction in the number and value of MSB transactions. However, numerous high-value transactions are still completed via MSB facilities in casinos, and the Gambling Commission’s ML/TF risk assessment (“Risk Assessment”) still rates MSB activity within casinos as high risk.

The Risk Assessment also identifies other risks linked to MSB activity, such as (i) payments received from politically exposed persons (“PEPs”) or persons appearing on financial sanction lists, (ii) customers buying in using a number of different payment methods, (iii) high reliance on due diligence information from third party due diligence providers, (iv) funds transferred into accounts from unknown sources, and (v) funds transferred from unlicensed MSBs.

What licensees need to do:

• Casino licensees must conduct an appropriate ML/TF risk assessment and, where MSB activity is offered, an assessment of the ML/TF risks associated with the MSB activity offered must be included. Licensees must implement appropriate controls to prevent ML/TF and review these regularly to ensure they remain effective.
• Where foreign currency exchange services are offered, licensees must have appropriate controls to address the risks associated with large denomination notes.
• Due to the risks associated with MSB activity, customers using MSB facilities offered by casino licensees are expected to be treated as high risk, and are subject to appropriate enhanced customer due diligence measures, as outlined in the Gambling Commission’s guidance on the prevention of money laundering and combating the financing of terrorism.
• Licensees offering MSB facilities must also review and consider HMRC’s MSB guidance.

2. Artificial intelligence used to bypass customer due diligence

The Gambling Commission notes the increase in the scale and sophistication of attempts to bypass customer due diligence checks using false documentation, deepfake videos and face swaps generated by artificial intelligence. As noted by the National Crime Agency (“NCA”) in issue 30 of their SARs in Action publication, accounts successfully created using AI are more likely to be used for criminality, such as money laundering or terrorist financing.

What licensees need to do:

• Consider all information they hold on a customer and, where documents are received from a customer, ensure that these documents are appropriately scrutinised.
• Ensure staff are appropriately trained to assess customer documentation, including how to identify false and AI generated documents.
• If a customer has submitted a false document, licensees should consider the Gambling Commission’s guidance about what licensees must do in that situation.
• When submitting a SAR in relation to AI generated documents, the NCA has requested that the reference 0752-NECC is included in the relevant field. Please see the SARs in Action publication for more information.

3. Money in exchange for personal details and gambling accounts

The Gambling Commission has been made aware of consumers being targeted by companies who offer money in exchange for personal details to open multiple gambling accounts in the customer’s name. Consumers are directed to upload their documentation which is then used by the third-party to open large numbers of gambling accounts. Customers are promised a financial reward in exchange for their personal details and documents, but there are reports of customers not receiving the money promised to them. Customers are also told that the documents will be treated securely, however, there is a concern that the documents may be used for other purposes or sold on.

The Gambling Commission identified the risk that those gaining access to other people’s information and using it to gamble may be acting as unlicensed betting intermediaries. The Gambling Commission is also concerned about the risk of illicit mule account activity with accounts opened in this way.

What licensees need to do:

• Proactively review their processes for ID verification on a regular basis to ensure they remain effective.
• Take immediate action when any gaps are identified or when learnings suggest improvements are required to tighten processes.
• Have robust customer due diligence and onboarding checks in place.
• Consider whether checks on ID documents are sufficient to identify false, stolen or ‘mule’ (third party) IDs, in accordance with LC 17.1.1.(1) and (4) of the LCCP which states that:

(1) Licensees must obtain and verify information in order to establish the identity of a customer before that customer is permitted to gamble. Information must include, but is not restricted to, the customer’s name, address and date of birth.

…

(4) Licensees must take reasonable steps to ensure that the information they hold on a customer’s identity remains accurate.

4. Third-party business relationships, including white-label partnerships and investments

The Gambling Commission is aware of licensees failing to apply sufficient due diligence measures in relation to their third-party business relationships, including white-label partnerships and monies coming into the business in the form of loans or other investments. White-label partnerships and business investments have both been noted as high risk within the Gambling Commission’s latest Risk Assessment.

What licensees need to do:

• Ensure that they have appropriately risk-assessed their dealings with third-parties, including white-label partners and any entities providing loans and/or investments.
• The assessment of these risks should include consideration of the risks posed by the jurisdictional location of their third-party, transactions and arrangements with business associates, and third-party suppliers such as payment providers and processors, including their beneficial ownership and source of funds. Effective management of third-party relationships should assure licensees that the relationship is a legitimate one, and that they can evidence why their confidence is justified.
• Consider risks to the licensing objectives in their due diligence on white-label partners. This would include giving consideration to any activity the third-party is involved in outside of GB that the Gambling Commission considers medium or high risk, as defined by the Gambling Commission’s Risk Assessment, as well as activity that is illegal in either Great Britain (“GB”) or the territory in which it is conducted.
• When accepting loans into their business, licensees are reminded of LC 15.2.1(3) of the LCCP (Reporting key events) and the licensing objective to prevent gambling from being a source of crime or disorder, being associated with crime and disorder or being used to support crime. The Gambling Commission is also able to request additional information about any loans or other money coming into the business, as per the Licensing, compliance and enforcement policy statement.

5. Open-loop payment processes

In the Gambling Commission’s latest Risk Assessment, it noted that a ‘lack of closed loop’ payment system is high risk. The Gambling Commission is aware of some licensees (particularly non-remote betting operators) still operating open-loop payment processes.

Open-loop payment systems are a known money laundering risk as they allow the transfer of funds from one payment method to another, which can be used to disguise the origin and/or destination of funds. There is also a risk that criminals use open-loop systems to gamble with fraudulent or stolen cards.

What licensees need to do:

• Closed-loop systems are strongly recommended and considered best practice for licensees.  Closed-loop systems mean licensees process customer withdrawals and winnings to the same payment method that was used for the deposit. 
• Where licensees continue to operate an open-loop payment system, they must include this risk within their ML/TF risk assessment and implement appropriate and effective controls to prevent ML/TF.

6. Licensed software providers’ games available on websites not licensed by the Gambling Commission

The Gambling Commission is aware of casino games that have been developed by software licensees becoming available on unlicensed websites, and accessible to British consumers illegally. As such, licensees conducting business (either directly, or indirectly through third-party resellers) with websites that are operating illegally are at risk of accepting funds derived from criminal activity.

What licensees need to do:

• Gambling software licensees must consider their obligations to uphold the licensing objectives, including preventing gambling from being a source of crime or disorder, being associated with crime and disorder or being used to support crime.
• Casino host licensees are additionally required to comply with LC 12.1.1. of the LCCP (including the requirement to conduct a ML/TF risk assessment and implement appropriate controls), as well as the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017  and the Gambling Commission’s guidance for casino operators.
• Licensees are advised to actively monitor their business relationships to ensure that partners are not offering illegal gambling facilities to the GB market. Where such non-compliance is identified, licensees must terminate these relationships immediately.
• It is crucial to also engage proactively with the Gambling Commission when such activity is detected, providing details of the preventative measures taken to ensure the activity ceases without delay. Actively notifying the Gambling Commission and presenting a clear and prompt plan to mitigate the issue is a minimum requirement. Licensees should also note the Gambling Commission’s Industry warning notice: licensed software appearing on illegal market.

7. Cryptoassets

The Gambling Commission is aware of an increasing interest in cryptoassets (also known as crypto currencies) within the licensed gambling industry, and rates cryptoassets as a high-risk payment method. As noted by HM Treasury in the UK national risk assessment of money laundering and terrorist financing report (chapter 8), cryptoassets present several vulnerabilities from a ML/TF perspective.

The Gambling Commission is also aware of a large theft of cryptoassets from the ByBit exchange which took place in February 2025. The group alleged to be responsible for the theft are suspected of using complex online money laundering systems which, in the past, have been thought to include remote gambling licensees around the world.

As cryptoassets potentially become more prevalent, the Gambling Commission expects that more payment providers will offer crypto payment facilities.

What licensees need to do:

• Have a full understanding of the services provided by their payment providers, as the use and/or acceptance of cryptoassets presents challenges.
• Pursuant to LC 12.1.1(1), ensure ML/TF risk assessments consider the risks their businesses face upon the introduction of new products or technology or new methods of customer payment.
• Submit a ‘Key Event’ to the Gambling Commission under LC 15.2.1(8) wherever there are changes in payment methods.
• When customers indicate their funds to gamble have come from cryptoasset trading or other means linked to cryptocurrencies, it is the Gambling Commission’s expectation that this feeds into a customer’s risk profile as a high-risk indicator, with completion of sufficient due diligence.
• Be mindful of the recent theft of cryptoassets (as mentioned above) and consider their vulnerabilities and controls in this area. Please see further information on the Gambling Commission’s position on crypto-assets here.

8. Terminals used to facilitate payments in non-remote casinos

The Gambling Commission is aware of several types of terminals used to facilitate customer deposits into non-remote casinos and has seen cases where funds received via this method are not scrutinised as closely as deposits via other methods.

What licensees need to do:

• Assess the risks of their businesses being used for ML/TF, including considerations of the different types of payment methods accepted by the business, including any payment terminals within the casino.
• Following this risk assessment, licensees must implement effective policies, procedures and controls to prevent ML/TF. In the case of payment terminals in the casino, licensees must ensure they are appropriately scrutinising funds received via this method, and not relying on the third-party terminal provider and/or payment processor to conduct checks on the funds being transferred.
• Where terminal providers provide the receiving casino with the details of the bank account where the money has been sent from, licensees should consider whether the account belongs to the customer, and whether it matches with other information known about the customer, including other bank accounts they have used.
• When money is received via terminals within the casinos, licensees must consider how the use of this payment method feeds into the rest of the customer’s risk profile and complete an appropriate level of customer due diligence, including enhanced customer due diligence for high-risk customers.

9. Changing customer demographics in the non-remote casino sector

The Gambling Commission recognises that some non-remote casinos have experienced changes in the demographics of their customer base, which has not been reflected in their risk assessment or policies, procedures and controls.

Prior to 2020, high-end non-remote casinos had many international ultra-high-net-worth individuals as customers. During the pandemic, casino premises in GB were closed, and many of the customers who previously came to GB to gamble in high-end casinos shifted their preference to other global gambling centres. This shift in behaviour was also thought to be consolidated by changes to VAT regulations in the UK.

It is believed that this caused some non-remote casinos to change their entry and membership criteria to attract a wider range of customers from within GB. However, the Gambling Commission has seen cases where licensees have not updated their risk assessment and policies to account for the changed customer base, which has meant the procedures in operation are insufficient in mitigating the risks present within the business.

What licensees need to do:

• As per LC 12.1.1 of the LCCP, licensees must ensure their ML/TF risk assessments are appropriate and reviewed in light of any changes of circumstances, including changes in the customer demographic. They must also have appropriate policies, procedures and controls to prevent ML/TF.

10. Adult gaming centre premises converting to licensed bingo premises

The Gambling Commission is aware of some adult gaming centre (“AGC”) premises licensees converting to bingo premises, and there is a concern that when preparing their ML/TF risk assessment, and reviewing the Gambling Commission’s risk assessment (as per LC 12.1.1(1) and (3) of the LCCP), they may not consider all relevant risks if they only consult the bingo section, and not the AGC section, of the Gambling Commission’s Risk Assessment. The Gambling Commission intends to update its Risk Assessment to reflect this industry trend.

What licensees need to do:

• Bingo licensees who operate AGC-style premises are urged to consider all relevant ML/TF risks to the premises, including those noted in the bingo and arcade sections of the Gambling Commission’s Risk Assessment.
• In addition the LC 12.1.1 of the LCCP, please note the following useful links:

1. Arcades: The 2023 money laundering and terrorist financing risks within the British gambling industry – Arcades.
2. Bingo: The 2023 money laundering and terrorist financing risks within the British gambling industry – Bingo (non-remote).
3. The Gambling Commission’s advice on Duties and responsibilities under the Proceeds of Crime Act 2002.

11. Crash games

Crash games have been offered within crypto casinos (which are not licensed by the Gambling Commission and are illegal if accessible via GB) for a number of years.

Crash games may have differing graphics and premises, but typically the mechanics of the games mean that, once the initial bet is made, the round begins with a starting multiplier, which grows as the game progresses. Customers have the option to cash out at any point, but if the game crashes before a customer has cashed out, they will lose the money from the multiplier as well as their stake. Rounds can last anywhere from a few seconds to a couple of minutes before either the game crashes or the customer cashes out. Crash games are highly volatile and can lead to significant losses for players.

The Gambling Commission is aware of an increased interest in crash games within the legal, licensed casino sector. There are concerns that products of this nature can allow criminals to camouflage the high-risk behaviour of cashing out quickly with limited gameplay within the context of the crash game (where these behaviours are inherently more common), and that transactional monitoring controls may not be effective in detecting suspicious activity.

What licensees need to do:

• When introducing any new products (including crash games) licensees must assess the risks of that product being used to launder money and ensure they have appropriate procedures and controls in place to prevent money laundering. In this case, this would include controls to identify and prevent suspicious wagering patterns, and processes to feed the use of crash games into a customer’s overall risk profile and commence appropriate due diligence.
• Where licensees know or suspect money laundering has occurred, they must submit a suspicious activity report (“SAR”).
• More information about appropriate policies, procedures and controls can be found in the Gambling Commissions guidance on the prevention of money laundering and combating the financing of terrorism.

12. Application Registration Cards (“ARCs”)

ARCs are issued by the Home Office to individuals who claim asylum. ARCs contain information about the holder but are not evidence of identity and must not be accepted as a form of identity documentation. Those presenting ARCs when attempting to open a gambling account, or access gambling premises, may also be at a higher risk of exploitation and mule account activity.

What licensees need to do:

• Have appropriate policies, procedures and controls in place to ensure the requirements for customer identification and verification are met. This includes detailing acceptable forms of identification documentation, which is not an ARC, in line with the Gambling Commission’s guidance for casinos (particularly, paragraphs 6.49 to 6.75) and the Government’s guidance (Application registration card (ARC) and How to prove and verify someone’s identity).
• Train their staff members and implement measures to ensure that policies and procedures in relation to customer identification and verification are followed.
• If a licensee believes that someone is being exploited, they can report it to the Modern Slavery and Exploitation Helpline on 08000 121 700 or via the online form but, if they think someone is in immediate danger, they should contact the police.
• For more information please see: LC 17.1.1 of the LCCP and How to report at Migrant Help.

13. Jurisdictions subject to increased monitoring by the Financial Action Task Force (“FATF”)

In February 2025, FATF updated its list of high-risk jurisdictions (the FATF “black list”) and the list of jurisdictions subject to increased monitoring (the FATF “grey list”). More information can be found on the FATF’s website about the following lists:

• “Black and grey” lists
• High-Risk Jurisdictions subject to a Call for Action
• Jurisdictions under Increased Monitoring.

What licensees need to do:

• Review the lists above and ensure they have effective policies, procedures and controls in place to identify customers and relationships with links to high-risk jurisdictions, including those subject to calls for action and enhanced monitoring.
• Conduct robust enhanced customer due diligence checks in relation to any customer relationships which are associated with high-risk jurisdictions, including those subject to enhanced monitoring by FATF in order to mitigate the risk of ML/TF, including proliferation financing.
• More information about managing geographical risk can be found in the Gambling Commission’s guidance: Anti-money laundering responsibilities for casino businesses.

In light of these 13 emerging risks identified by the Gambling Commission, we remind licensees to review their ML/TF risk assessments as soon as possible to take into account these emerging risks.

Please get in touch with us if you have any questions about these risks or require our assistance in reviewing ML/TF risk assessments.