For seventeen years the FATF’s reference point on gambling was a 2009 study of land-based casinos. On 9 September 2026 it published a replacement: Risks of Gaming and Gambling, with red flag risk indicators, and for the first time it looks hard at online and illegal gambling. If you run an iGaming platform, a sweepstakes or social casino, or you process their money, this paper is now the yardstick your regulator, sponsor bank and auditor will hold you to.
What the FATF found
The report draws on questionnaire responses from 80 jurisdictions, written input from 29 more, and consultation with industry. Its headline findings for online operators are plain:
- Where the risk sits. Land-based and online casinos and sports betting carry the highest money laundering exposure; lotteries and scratchcards carry less. Online gaming also shows more documented terrorist financing activity than gambling.
- Illegal operators are everywhere. The FATF says illegal operators were prevalent across jurisdictions regardless of whether gambling is legal there, and in some countries the illicit market matches or exceeds the regulated one. Unlicensed offshore sites are described as attractive gateways for fraudsters, professional money launderers and organised crime.
- Payments are the weak point. Cash, e-wallets, mobile money and virtual assets are the most exposed channels, especially where deposits are structured below reporting thresholds.
- Ownership is opaque. Complex cross-border ownership, white-label arrangements with little oversight and commercially questionable third-party contracts all conceal who really controls a platform.
123 indicators in five groups
The practical core of the paper is its set of 123 red flag indicators, organised into customer behaviour and profile, online accounts, betting patterns, payment methods and transactions, and product and platform features. Several will be familiar to any online operator, which is exactly the point: the FATF is describing what your data already shows.
- Several accounts opened under different names from the same IP address or device, and frequent VPN use.
- Deposits followed by withdrawals with minimal or no wagering, and winnings collected just below identification thresholds.
- Third-party deposits and payments from mismatched accounts or instruments.
- Betting on all outcomes to reduce loss and move value rather than win it.
- Business-to-business cross-border flows unrelated to regulated gambling, sham merchants posing as domestic retailers, and sudden ownership transfers or inflated purchases of weak gambling businesses.
Why this matters beyond the operator
The indicators are not only about players. Several are corporate indicators aimed at merchants, white-label partners and affiliates, which means a bank or payment processor serving gaming clients is expected to apply them to its own customer, not just to the end user. Regulators have already said the indicators are relevant to the operators they license. Expect examiner and sponsor bank questions to be framed in the FATF’s language from here on.
Sweepstakes and social casino platforms should read the paper with particular care. A model that sells virtual currency for real money and redeems prizes through cards, e-wallets or crypto is running the same payment rails the FATF describes, and minimal play followed by redemption is the typology it names first.
The paper also calls for stronger licensing, closer international cooperation and better information sharing between regulators and law enforcement. For operators that means more scrutiny of licensing jurisdiction, more questions about who owns the platform and its suppliers, and less tolerance for the argument that AML belongs to someone else in the chain.
FinCheck’s perspective and way forward
Our view is that the paper turns a general expectation into a testable standard. An indicator you cannot show is covered by a rule, a review step or a documented reason is a gap an examiner can point to. Here is the 30-day plan we recommend:
- Map every indicator. Build a control map of all 123 against live rules, manual reviews or a written rationale for why one does not apply.
- Link identity across data. Connect device, IP, email, phone and payment instrument so one person holding several accounts becomes visible.
- Monitor deposit-to-wagering ratios. Set thresholds for deposit-withdraw cycles with minimal play and review the exceptions weekly.
- Test funding instruments. Check that every card, wallet or crypto address belongs to the account holder and alert on third-party funding.
- Apply the corporate indicators. Re-verify beneficial ownership of merchants, white-label partners and affiliates and review the commercial logic of each contract.
- Refresh your risk assessment and brief your board and sponsor bank, with the changes documented.
Talk to FinCheck
FinCheck supports iGaming, sweepstakes and social casino operators, MSBs, crypto and FinTech firms with Fractional CCO services, AML Independent Audit, AML Program Build, Compliance Outsourcing and Staffing, and MTL Licensing Support. If you would like an indicator gap assessment against the FATF paper, message us on LinkedIn.