AML for gaming operators: BSA duties, SARs, and monitoring

If you run a licensed casino or card club with more than $1 million in gross annual gaming revenue, the Bank Secrecy Act treats you as a financial institution. That means a written AML program, currency transaction reports on cash over $10,000 in a gaming day, suspicious activity reports on suspicious transactions of $5,000 or more, and records that let an examiner reconstruct what happened.

Coverage of online operators is less settled. FinCEN has said that sports betting and mobile gaming run through a casino carry the same AML obligations as anything else the casino does, but the casino definition was written for licensed properties, and not every online licensing model fits it neatly. This guide covers who is covered, what the rules require, the red flags in deposit and withdrawal patterns, and what a payment processor will ask to see. Wherever you land on coverage, processors expect controls that look like a BSA program.

Who the BSA treats as a casino or card club

The definitions sit in 31 CFR 1010.100(t). A casino is one that is duly licensed or authorized to do business as such in the United States, under state or territorial law or under the Indian Gaming Regulatory Act or other tribal law, and that has gross annual gaming revenue over $1 million. The card club definition applies the same licensing test and $1 million threshold to card clubs, gaming clubs, card rooms and similar establishments, with revenue measured by what customer gaming generates, such as table fees. The casino-specific rules are in 31 CFR part 1021.

Two details matter in practice. The revenue test looks at either the previous or the current business year, so a fast-growing operator becomes covered at the point in the current year when revenue passes $1 million. And unless a provision says otherwise, a reference to a casino in FinCEN's rules includes a card club.

The IRS examines casinos and card clubs for BSA compliance under authority delegated by FinCEN. The federal rules also anticipate state and tribal regulators that require licensees to comply with the BSA, so expect your gaming regulator to look at the same program. Casinos were first covered in 1985, and the expectations are mature.

How the casino definition applies to online operators

Online gaming raised a question the original rules never had to answer. FinCEN's clearest public statement came in an August 2019 speech by then-Director Kenneth Blanco, who told a Las Vegas anti-money laundering conference that sports betting and other mobile gaming services run through a casino are no different from its other products, and that AML obligations are the same whether sports betting is offered on or off premises. He said FinCEN expects casinos to monitor those programs, including mobile apps, for suspicious activity (FinCEN, prepared remarks).

The same speech said internet gaming sites that are not duly licensed or authorized as casinos are not casinos for BSA purposes, and that such sites are likely operating as money transmitters. Treasury's 2024 National Money Laundering Risk Assessment described the gray area in between. Most online sports betting runs either as a third-party operator under a licensing arrangement with a BSA-covered casino, or under an online license issued directly by a state without a casino affiliation. Treasury warned that platforms in either model may lack strong controls or may not know their BSA obligations, and that a casino partner may have limited visibility into what happens on the platform.

The industry has asked for clarity. In a June 2025 comment letter, the American Gaming Association asked FinCEN for guidance on which BSA requirements apply, and to whom, when a licensed casino partners with a separate operator that handles account opening, deposits and withdrawals, and bet acceptance. We have not found published FinCEN guidance resolving that question as of October 2026, so get counsel's view on your specific structure.

Treasury's 2026 assessment says fantasy sports and sweepstakes casinos generally fall outside casino and gambling regulation, that the lack of oversight raises illicit finance risk, and that FinCEN guidance has said certain gaming businesses may be regulated under the BSA as money transmitters. If you run one of those models, read our guides to daily fantasy and pick'em payments and sweepstakes casino payments.

What a casino AML program must include

Under 31 CFR 1021.210, each covered casino must have a written program reasonably designed to assure and monitor compliance with the BSA. At a minimum the program must provide for:

• A system of internal controls to assure ongoing compliance.
• Internal or external independent testing, with scope and frequency matched to the money laundering and terrorist financing risks of your products and services.
• Training of personnel, including how to identify unusual or suspicious transactions.
• An individual or individuals responsible for day-to-day compliance.
• Procedures for using all available information to verify identity where required, to find transactions or patterns that must be reported as suspicious, and to decide which records must be kept.
• For casinos with automated data processing systems, the use of automated programs to aid compliance.

On April 10, 2026, FinCEN published a proposed rule to rewrite AML program requirements across financial institutions, casinos included.

For casinos it would add an explicit requirement for a risk assessment process, which the current rule does not have, plus formal program approval and oversight requirements. It would also drop the sentence about automated data processing, while saying that removal is not meant to reduce any obligation. Comments closed June 9, 2026. As of October 2026 it is still a proposal, so watch for a final rule and its effective date. Either way, a written risk assessment is what explains why your monitoring thresholds sit where they do.

Currency transaction reports: cash over $10,000

Each covered casino must file a report of each transaction in currency, cash in or cash out, of more than $10,000 (31 CFR 1021.311). The rule's examples run from chip purchases, front money deposits and bills inserted into gaming machines on the cash-in side to chip redemptions, payments on bets, and tournament and contest payouts on the cash-out side.

Multiple currency transactions count as one when the casino knows they are by or on behalf of the same person and they total more than $10,000 in a gaming day (31 CFR 1021.313). Knowledge includes what the casino's own books, logs and electronic records show. Reports are due within 15 days of the transaction, and copies must be kept for five years (31 CFR 1010.306).

The key word is currency, which the rules define as coin and paper money. Card and ACH deposits are not currency, so an online-only operator funded by cards and bank transfers will rarely file CTRs. They come into play where cash touches the operation: deposits at a cage into an online wallet, retail sportsbook windows, and cash payouts. If cash and online activity share a wallet, the records that link them are exactly what the aggregation rule looks at.

Bills introduced in Congress in 2025 would raise the CTR threshold to $30,000. As of October 2026, the regulation still reads more than $10,000.

Suspicious activity reports: the $5,000 rule and the 30-day clock

A casino must file a SAR on a transaction conducted or attempted by, at, or through the casino that involves or aggregates at least $5,000, when the casino knows, suspects, or has reason to suspect that it (31 CFR 1021.320):

• involves funds from illegal activity, or is meant to hide or disguise such funds;
• is designed, through structuring or other means, to evade BSA requirements;
• has no business or apparent lawful purpose, or is not the sort of transaction the customer would normally engage in, and the casino knows of no reasonable explanation after examining the facts; or
• involves use of the casino to facilitate criminal activity.

Note the word attempted: a deposit you blocked can still be reportable. The SAR is due no later than 30 calendar days after initial detection of facts that may support a filing. If no suspect has been identified, the casino may take another 30 days to identify one, but never more than 60 days in total. Violations that need immediate attention, such as an ongoing laundering scheme, require an immediate phone call to law enforcement as well as a timely SAR.

Keep each SAR and its supporting documentation for five years. The rules also make SARs confidential: a casino may not disclose a SAR, or any information that would reveal one exists, except as the regulation allows, such as to FinCEN, law enforcement, and the regulators that examine the casino. The rule also gives filers a safe harbor from liability for making the report, to the extent the statute provides.

Structuring, and how it shows up

Structuring means conducting or attempting currency transactions, in any amount, at one or more institutions, on one or more days, in any manner, to evade the currency reporting requirements (31 CFR 1010.100(xx)). The transactions do not need to exceed $10,000 at any one institution on any one day for it to count.

FinCEN's 2008 red flag guidance for casinos and card clubs gives the classic land-based versions: a customer who reduces a cash-out below $10,000 when asked for identification, a customer who asks for several casino checks each under $10,000, and a winner who takes part of a payout in chips to keep the cash portion under the threshold. These patterns are common. In its 2025 letter to FinCEN, the American Gaming Association said casinos filed more than 62,000 SARs in 2024, and that nearly 28,000 of them related to structuring.

Online, cash structuring only appears where cash enters the system. The online analog is behavior shaped around your own review triggers: deposits held just under the amount that prompts a document check, or activity split across linked accounts. Whether a given pattern is reportable depends on the facts, but your monitoring should be able to see it.

Red flags in deposit and withdrawal patterns

Treasury's risk assessments and FinCEN's guidance describe a short list of patterns that matter most for gaming. The table maps them to a first response. None of these is proof of anything on its own; each is a reason to look.

Collusion deserves its own mention. Treasury's 2024 assessment notes that confederates can work together on one or a series of bets to hide where funds came from. In peer-to-peer games, the same idea shows up as one player deliberately losing to another. Pull wagering data into the same case as payment data so you can see both sides.

Source of funds and enhanced due diligence

The casino rules do not contain a bank-style customer due diligence rule, but FinCEN's April 2026 proposal notes that casinos already have similar requirements through the duty to determine and verify customer information. In practice, a risk-based program sets triggers for deeper review: cumulative deposits over a set amount, sudden changes in velocity or stake size, sanctions or adverse media hits, and activity that does not fit the player's stated occupation or income.

When a trigger fires, ask for what you need and no more: occupation, employer, and documents that support the source of funds, such as pay records or proof of a sale. Record what you asked, what you received, and what you decided. FinCEN's 2010 guidance on risk-based compliance indicators for casinos lists customer risk factors worth building into these triggers, including high spending levels and large transactions with minimal play.

Coordinate with your responsible gambling team. New Jersey's responsible gaming rule for online operators, announced in October 2026, makes deposits over $10,000 in 24 hours or over $100,000 in 90 days automatic triggers for a problem gaming review. That is a different purpose than AML, but it is the same data, and one review should not miss what the other found. Our post on responsible gambling payment controls covers those rules.

Screen against sanctions lists at onboarding and when the lists change. OFAC sanctions apply to every US business, whether or not it is a BSA casino, and screening is how you show you are not dealing with blocked persons.

Transaction monitoring that holds up in an exam

Monitoring holds up when every alert can be traced from the data that produced it to the decision that closed it. The casino rules point in that direction: the program must use all available information, and 31 CFR 1021.410 requires casinos to keep records prepared or used to monitor a customer's gaming activity. If a monitoring report shaped a decision, assume an examiner will want to see it.

1. Join the data. Deposits, withdrawals, declines, chargebacks, wagers, logins, devices, geolocation results and KYC outcomes, all keyed to one player ID.
2. Map rules to typologies. Each scenario should name the risk it targets, such as minimal play, mule accounts, or third-party funding.
3. Tune to your book. Set thresholds from your own player base, record why, and revisit them on a schedule.
4. Work cases, not alerts. Group related alerts and linked accounts into one case with one narrative and one decision.
5. Meet the clock. Track detection dates so SAR decisions land inside the 30-day window.
6. Test it. Independent testing should cover whether scenarios fire as designed, not only whether policies exist.

The cost of skipping this is real. Treasury's 2026 assessment cites a 2024 FinCEN penalty of $900,000 against a California card club for deficient controls, including inadequate internal controls, no independent testing, training failures, and failure to detect and report suspicious activity. Payment events belong in this data too. Chargebacks and refund requests often surface account takeover and mule activity before wagering data does, which is one more reason to read our guide to gaming chargebacks.

What your processor will ask

A processor and the banks behind it have their own AML obligations, so they underwrite your program as part of underwriting you. Expect requests for:

• Your written AML policy and the name of the person responsible for it.
• Your risk assessment and how it sets your monitoring thresholds.
• Training records and the most recent independent test, with how findings were fixed.
• A description of your monitoring scenarios and case process.
• Your SAR and CTR processes, described without disclosing any filing.
• Sanctions screening and record retention practices.
• If you operate under someone else's license, a written split of AML responsibilities between you and the licensee.

Our gaming payments guide covers the rest of a gaming application. The KYC, age and geolocation guide covers the identity controls that feed your AML program.

How Flux fits

Flux does not provide AML monitoring, SAR filing or sanctions screening services, and it does not run your BSA program. Those belong to you and your compliance vendors. Flux reviews gaming and betting businesses case by case, and approval depends on your licenses, where your players are, and your controls. Underwriting is done by people, and not every business qualifies.

What Flux can add is clean payment data for the program you run. Fraud detection scores each transaction in real time and flags or blocks risky ones before they settle, using rules you control.

The payments API sends signed webhooks, so payment events can flow into your monitoring and case records, and the real-time dashboard and reporting give your team a view of every transaction. Cards settle in 1-2 business days and ACH in 1-3 business days. Gaming and betting accounts are priced after underwriting.

This article is general information, not legal advice. When your program is documented and you want to talk about how your money moves, see our gaming and betting overview, apply here, or email sales@fluxpayments.com.