Our algorithm does not accuse any licensed operator of laundering money — that determination belongs to regulators and courts. What it does is quantify exposure: it cross-references public enforcement registers, licensing conditions and the risk indicators published by bodies like the Financial Action Task Force (FATF) to flag operators whose compliance history, ownership structure or payment stack resembles the patterns regulators have already penalized. In 2025–2026 alone, UK and US regulators issued tens of millions of dollars in anti-money laundering (AML) fines against licensed casinos, which gives the model a growing, verifiable dataset to score against.
Key takeaways
- FATF’s September 2026 Risks of Gaming and Gambling report names casinos, online casinos and sports betting as the segments with the highest money-laundering exposure in the gambling sector.
- The UK Gambling Commission’s 2026 sector risk assessment found that only 3% of remote casino operators are registered as money service businesses, compared with 56% of land-based casinos, a gap our algorithm treats as a structural weak point.
- Public UK enforcement data shows AML-linked penalties against licensed operators running into millions of pounds in a single year, including a £5 million settlement against Rank Group’s casino brands and a £4.75 million penalty against Evolution Malta Holding.
- In the US, Nevada’s Gaming Control Board issued four separate multi-million-dollar AML fines against major Strip operators between March and November 2025.
- Our scoring model treats AML signals as inputs, not verdicts — it adjusts an operator’s trust score based on the frequency and severity of regulatory findings, not on marketing claims about “bank-level security.”
Table of contents
What counts as an AML red flag in online gambling
AML red flags fall into two categories that our algorithm tracks separately: behavioral indicators (patterns a regulator or compliance team would see in individual player activity) and structural indicators (features of the operator itself that correlate with weaker controls). Most public commentary focuses on the first category — large cash-outs, rapid deposit-withdraw cycles, third-party funding — because that is what front-line compliance teams are trained to spot. FATF’s own briefing gives the example of a customer moving small sums onto a betting site and then repeatedly withdrawing much larger amounts to their bank account, a mismatch that any transaction-monitoring system should catch.
Our algorithm cannot see individual player transactions — no public scraper can — so it scores the second category: whether an operator’s public compliance record, licensing footprint and corporate structure resemble those of operators that regulators have already penalized for exactly these failures. This is a proxy, not a direct measurement, and we say so plainly in every score breakdown.
The FATF signals our algorithm tracks
In September 2026, FATF published its first detailed update to its 2009 casino vulnerabilities report, drawing on contributions from more than 80 jurisdictions over a year-long project. The report concluded that payment systems used in gaming and gambling — cash, e-wallets, mobile money and virtual assets — are vulnerable to a range of money laundering risks, and that illegal, unlicensed operators represent one of the sector’s most significant structural risks because in many jurisdictions illegal markets now rival or exceed the size of legal ones.
Several of the operator-level indicators FATF lists are things our scraper can actually observe from the outside:
- Rapid expansion into virtual-asset or payment-service activity unrelated to the operator’s core licence, which FATF flags as a red flag alongside unexplained spikes in revenue or customer activity.
- Significant cross-border business-to-business financial flows unrelated to regulated gambling activity.
- Acceptance of multiple payment methods under different account names, third-party deposits, and rapid withdrawals routed to different payees — patterns FATF’s indicator list associates with layering.
None of these, on their own, proves wrongdoing — FATF is explicit that a single indicator cannot establish that laundering has occurred. Our algorithm uses the same logic: each signal nudges a risk score, and only an accumulation of correlated signals meaningfully moves an operator’s AML rating.
Enforcement data as a scoring input
The most reliable, verifiable AML signal available to an outside observer is a regulator’s own public enforcement record. The UK Gambling Commission and Nevada’s Gaming Control Board both publish searchable registers, and both have been active through 2025–2026.
On the UK side, the Commission’s October 2026 settlement with three Rank Group-owned casino brands totaled £5 million after an investigation into AML and social responsibility failures across 51 venues, with the operators also required to undergo a third-party audit of their controls. Earlier the same year, Evolution Malta Holding Limited was ordered to pay £4.75 million, and law firm analysis of the Commission’s 2025 caseload lists a further run of settlements: Spreadex fined just over £2 million in May 2025, ProgressPlay fined £1 million in August 2025, and Maple (operator of Lottomart) settling for £360,000 in September 2025, all for AML and counter-terrorist-financing deficiencies alongside social responsibility failings. The same review found that the Commission took regulatory action against 13 operators between May and December 2025 for AML, CTF, social responsibility, technical and hosting failings.
In the United States, Nevada regulators have been equally active. Between March and November 2025, the Nevada Gaming Control Board issued a string of multi-million-dollar penalties against Strip operators: Resorts World Las Vegas paid $10.5 million for allowing high-stakes betting by individuals with prior convictions for illegal gaming and money laundering and for failing to identify a high-risk customer’s source of funds, while MGM Resorts International, Wynn Las Vegas and Caesars Entertainment received comparable penalties for related AML control failures.
| Operator | Regulator | Penalty | Date | Core finding |
|---|---|---|---|---|
| Rank Group casino brands | UK Gambling Commission | £5,000,000 | Oct 2026 | AML and social responsibility failures across 51 casinos |
| Evolution Malta Holding | UK Gambling Commission | £4,750,000 | Jul 2026 | Money laundering risk assessment missed third-party risk |
| Spreadex | UK Gambling Commission | £2,022,000 | May 2025 | AML and social responsibility failings |
| ProgressPlay | UK Gambling Commission | £1,000,000 | Aug 2025 | Breaches of AML requirements |
| Resorts World Las Vegas | Nevada Gaming Control Board | $10,500,000 | Mar 2025 | Failure to verify source of funds for high-risk customer |
| MGM Resorts International | Nevada Gaming Control Board | $8,500,000 | Apr 2025 | High-stakes betting by convicted individuals; AML deficiencies |
| Wynn Las Vegas | Nevada Gaming Control Board | $5,500,000 | May 2025 | Improper fund transfers and third-party wagering |
| Caesars Entertainment | Nevada Gaming Control Board | $7,800,000 | Nov 2025 | Long-running AML failures tied to an illegal bookmaker |
These figures feed directly into our scoring model. An operator (or its parent group) appearing more than once on a regulator’s register within a rolling period triggers a heavier penalty than a single, older infraction — recency and recurrence matter more than the raw fine amount, since fine size is partly a function of operator revenue rather than severity of harm.
Structural red flags: ownership, white labels and MSB status
Beyond individual fines, the Commission’s own 2026 sector risk assessment points to a structural gap that behavioral monitoring alone cannot fix. It found that only 3% of remote casino operators were registered as money service businesses, compared with 56% of non-remote casino operators, despite remote casino gross gambling yield reaching £5 billion in the period reviewed and money laundering activity linked to MSBs tied to casinos totaling £70 million. The same assessment named weak scrutiny of white-label partnerships as the sector’s primary vulnerability, alongside deficient AML/CTF policies, weak staff training and poor monitoring of linked accounts.
This matters because white-label arrangements — where one licence holder operates dozens of branded skins — can obscure who is actually responsible for a given customer’s due diligence. Our algorithm treats a high ratio of branded skins to visible compliance infrastructure as a moderate risk signal, consistent with the pattern the Commission itself describes.
Ownership opacity is scored the same way. Where corporate registries, licence filings or payment processor disclosures don’t let our scraper identify the ultimate beneficial owner of an operator, that gap is logged rather than ignored. It’s the same category of problem we examine from a different angle in our analysis of why smaller, thinly capitalized casinos are being forced out of regulated markets as compliance costs rise — the operators that survive consolidation are not automatically the safest, but they are typically easier to audit from the outside.
How the compliance score is built
Three categories of scraped and cross-referenced data feed the AML component of an operator’s overall trust score:
- Regulatory history: public enforcement actions, licence suspensions and settlement notices pulled from official registers such as the UK Gambling Commission’s public register of regulatory actions, weighted by recency, monetary size relative to the operator’s scale, and whether the finding was AML-specific versus a broader social-responsibility issue.
- KYC friction patterns: how early and how consistently an operator requests identity and source-of-funds documentation. Operators that only trigger enhanced due diligence at withdrawal — a pattern we cover in depth in our analysis of why some casinos wait until you win to ask for ID — score worse, because FATF and national regulators both treat delayed or inconsistent CDD as a structural weakness rather than a convenience feature.
- Corporate and licensing transparency: whether beneficial ownership, licence numbers and white-label relationships are publicly disclosed and verifiable against regulator registers, rather than relying on marketing copy.
We deliberately exclude signals that are easy to game but say little about laundering risk, such as the speed of identity approval. Fast onboarding is not inherently a red flag — our review of sub-60-second AI identity verification found that automated document checks can be both fast and rigorous — but speed without corresponding transaction monitoring and source-of-funds checks later in the customer lifecycle is scored as a gap, not a feature.
Limits of an algorithmic AML score
An outside-in AML score has real limits, and we think transparency about them matters more than a polished methodology page. First, it is lagging by design: a fine published in 2026 usually reflects conduct from 2024 or 2025, so the score reflects an operator’s history, not its current internal controls. Second, public enforcement data is jurisdiction-dependent — the UK and Nevada publish detailed, searchable registers; many offshore licensing hubs do not, which means operators licensed exclusively in low-disclosure jurisdictions are scored more conservatively by default, not because wrongdoing is assumed but because verification is impossible. Third, under both the Bank Secrecy Act framework that governs US casinos and the UK’s Money Laundering Regulations, the underlying compliance architecture — suspicious activity reports, currency transaction reports, and the Bank Secrecy Act classification of any casino with gross gaming revenue over $1 million as a financial institution — is confidential. We can see the output of enforcement, not the internal paper trail that led to it.
That is why our AML component is one input among several in the broader scoring system, not a standalone verdict. Readers who want the full breakdown of how different signals are weighted against each other can see the underlying logic on our scoring system and algorithmic weights hub, and the data-collection side is covered on our data scraping and technical engine hub.
Frequently asked questions
What is an AML red flag at an online casino?
It is any pattern — in a player’s transactions or in an operator’s structure — that resembles known money-laundering typologies, such as rapid deposit-and-withdraw cycles, third-party funding, or an operator expanding into payment services without matching compliance investment. A single indicator is not proof of laundering; regulators and our algorithm both treat it as a prompt for further scrutiny.
Can a player tell if a casino has weak AML controls?
Not directly, since internal monitoring systems are confidential. The most reliable public signals are a licence’s enforcement history, how early the operator requests identity verification, and whether beneficial ownership and licensing details are disclosed and checkable against a regulator’s public register.
Does a past AML fine mean a casino is currently unsafe?
Not necessarily. Several fined operators were also required to undergo independent audits and policy overhauls as part of their settlements, which can improve controls going forward. Our score treats a fine as a historical risk weight that fades over time if no further findings follow, rather than a permanent penalty.
What role does FATF play if it doesn’t regulate individual casinos?
FATF sets the global standards and risk indicators that national regulators and operators are expected to apply; it does not license or fine operators itself. Its September 2026 gaming and gambling report is used by national bodies, including the Danish Gambling Authority, to benchmark their own licensee expectations.
Methodology note
For this AML risk layer, GamblScout’s algorithm ingests public regulator enforcement registers (UK Gambling Commission, Nevada Gaming Control Board and equivalent bodies), FATF and national risk-indicator publications, scraped KYC-trigger timing from operator sign-up and withdrawal flows, and publicly disclosed licensing and beneficial-ownership data. Signals are weighted by recency, severity and corroboration across sources, and the resulting AML component feeds into the broader trust score described on our KYC and AML hub alongside our security and fair-play scoring work.
Gambling involves risk. Only play with money you can afford to lose and use the deposit limits and self-exclusion tools available in your jurisdiction.
