For an online gaming operator, the obligations set forth at AML-CFT apply from the moment a relationship is established and throughout its duration: identification and verification of the player’s identity, monitoring of transactions, screening for sanctions and asset freezing measures, and identification of politically exposed persons (PEP).
AML-CFT compliance, however, faces a challenge that few other sectors encounter: the registration process is a major competitive factor, and every additional verification step increases the risk of users dropping out. The effectiveness of the system is therefore measured not only by its rigor, but also by its ability to trigger the right verification at the right time: during registration for essential checks, and then through ongoing monitoring for those that can be performed without complicating the onboarding process.
Added to this requirement is the issue of volume. The number of players and transactions requires a detection engine that is sufficiently accurate to limit false positives; otherwise, the teams responsible for handling alerts risk becoming overwhelmed. The system must also ensure full traceability of the checks performed, the decisions made in response to an alert, and the time taken to process them, so that the operator can justify its system to the National Gaming Authority.
Why does the gaming industry pose a specific risk?
The Deposit-Play-Withdrawal Process
A gambling account allows funds to be deposited into and withdrawn from the same account. The gambler deposits, bets, and withdraws from the same account, sometimes all within the same day. A game with a low expected loss can be used to move funds around and provide a legitimate source for them.
The most useful checkpoints are therefore located at the intersection of deposits, wagers, and withdrawals. Any inconsistency among these three points indicates activity that does not conform to the expected logic of a recreational game. Article L561-2 of the Monetary and Financial Code classifies licensed online gaming and betting operators as regulated professionals. They are subject to the supervision of theNational Gaming Authority, which monitors their compliance with their obligations.
How the volume affects the device
An authorized operator can manage several hundred thousand active accounts. The sheer volume shifts the focus to the accuracy of the screening engine. Once the number of alerts exceeds a certain threshold, they are processed only superficially, and an overloaded system is ill-equipped to withstand an audit. Portfolio turnover also requires continuous re-screening, since a designation may occur after registration.
The system therefore cannot rely on a manual review of each piece of correspondence. It must reduce noise without sacrificing coverage and keep a record of every decision to flag an anomaly.
When should you verify a player's identity?
This is verified during registration
The operator must identify the player and verify his or her identity before opening an account. The verification process covers several aspects:
- first and last name;
- date of birth;
- country of residence;
- depending on the situation, a form of identification.
This verification may trigger an alert if the player appears on a sanctions list or a list of politically exposed persons. The decision concerns how to allocate these checks between the registration process and subsequent stages. Some verifications are required to open the account, while others are triggered when a certain activity or deposit threshold is reached.
What is triggered at a certain threshold
Additional verification or enhanced due diligence measures may be required depending on the level of risk, the player’s behavior, or the circumstances of the transaction, in accordance with the terms set forth in the regulations. The applicable threshold and conditions must be verified in the current official source and vary depending on the gaming channel. A withdrawal exceeding a certain amount, unusual activity, or a partial match with a sanctions list may trigger a request for additional supporting documentation.
Continuous monitoring then takes over. The account remains open, but the player's behavior is continuously analyzed.
Multiple Accounts and Accounts Held on Behalf of a Third Party
A player may hold only one account per operator. Multiple accounts are prohibited, and they are detected by cross-referencing identity information, bank account details, and IP addresses. Holding an account on behalf of a third party refers to a situation in which a player places bets on behalf of another person.
This practice severs the link between the account holder and the beneficial owner of the proceeds. These situations constitute red flags that must be analyzed and may—when they give rise to suspicion under the conditions set forth in the regulations—lead to a report to Tracfin.
How do you screen a pool of players?
Engine displacement and precision
A player base of several hundred thousand requires automated screening. The system checks international sanctions lists, databases of politically exposed persons, and gambling exclusion registries. An exact match between a first and last name is rare. Most alerts result from partial matches or variations in spelling.
A search engine that flags any phonetic similarity generates several thousand matches per day. Conversely, a search engine that requires a perfect match overlooks variations. The right balance is achieved by configuring the matching logic, weighting the matching criteria, and keeping a record of every decision to exclude a result.
Continuous screening
A designation may occur after registration. A player registered in January may appear on a sanctions list in March. The system must therefore resubmit the portfolio for screening each time the lists are updated. The sources used for screening and identifying PEP change regularly, which requires a system capable of incorporating these updates throughout the course of the business relationship.
The frequency of reclassification depends on portfolio turnover and risk sensitivity. A trader who performs this check only once a quarter would be in violation as soon as the first interim designation occurs.
Reduce noise without sacrificing coverage
An engine that generates too many alerts overwhelms the processing system, while one that generates too few lets genuine matches slip through. Noise reduction relies on three key factors: the accuracy of the match, the weighting of criteria, and the logging of each discrepancy.
A system that reduces noise without explaining how it does so cannot stand up to scrutiny. The Glass Box Augmented Intelligence system is based on fuzzy logic that is explainable and auditable, as opposed to opaque engines that produce a decision without providing a rationale. Each rejected match retains its reason for rejection, and each accepted match carries its relevance score. AP Scan offers a configurable engine for reducing false positives, based on more than 90 criteria, and generates a relevance score for each match.
How can you monitor deposit, betting, and withdrawal activity?
Deposit/Withdrawal Consistency
A player who deposits 1,000 euros, bets 50 euros, and withdraws 950 euros does not conform to the expected pattern of recreational gambling. The system monitors consistency between the amount deposited, betting activity, and the amount withdrawn. An inconsistency may indicate money laundering.
Monitoring also covers the frequency of deposits and withdrawals, the source and destination of funds, and the payment method used. The use of multiple payment methods or any inconsistencies between deposit and withdrawal methods constitutes a red flag that requires analysis and may warrant further verification based on the player’s profile and the characteristics of the transactions.
Prioritizing Alerts
A transaction monitoring system generates several types of alerts, including alerts regarding the consistency of deposits and withdrawals, alerts for threshold exceedances, and alerts for matches with a sanctions list. Not all of these alerts pose the same level of risk. The system must prioritize them based on their criticality and direct processing toward those that require immediate analysis.
AP Monitoring allows you to monitor operations in real time, prioritize alerts based on their risk level, and keep a record of every analysis performed. The response time for alerts is one of the checkpoints reviewed by the supervisor.
What must an operator be able to produce during an inspection?
The National Gaming Authority monitors compliance with the requirements set forth at AML-CFT. It may request that the operator provide various documents:
- a risk classification system tailored to the games offered;
- a record of the identity checks performed;
- time-stamped screening logs;
- the written reason for the rejected correspondence;
- a history of the anomalies identified in the data streams;
- the response time for alerts;
- the process for reporting suspicions, including analyses that did not result in a report.
Time Limits as a Subject of Oversight
The response time for alerts is not measured in calendar days. The response time must be tailored to the nature and severity of the alert. Situations that may involve a freeze order or another requirement necessitating immediate action must be treated as a priority, while other alerts must be reviewed within a timeframe consistent with the identified risk level.
An operator that does not have any time-stamp indicators cannot demonstrate that it processed the alerts within a timeframe consistent with the duty of care. The supervisor expects the system to record the date and time of each alert, the date and time of each analysis, and the reason for each decision.
What a well-equipped system changes on this scale
Screening and Monitoring at Scale
A specialized system automates the screening of a large portfolio, repeats checks according to the criteria defined by the operator, and maintains a record of detected matches and their handling. Real-time transaction monitoring allows alerts to be prioritized based on their criticality and directs processing toward those requiring immediate analysis.
The system records the date and time of each alert, each analysis, and the reason for each decision. It allows you to classify relationships by risk level according to a framework tailored to the games offered and to generate the logs required by the supervisor.
Integration into the registration process
A feature built into the registration process allows the player’s identity to be verified without interrupting their experience. A feature built into the registration process automates some of the checks and limits manual intervention to steps that require supporting documentation or further review. It thus helps balance compliance requirements with a seamless player experience.
The integration is based on an open architecture. AP Solutions IO offers integration via REST/JSON API, a hybrid API + portal model, and compatibility with ISO 20022 and MT formats. The solution integrates with your existing information system without requiring any infrastructure replacement. To discuss your solution, you can request a technical demo.
Frequently Asked Questions
Are online gaming operators subject to the " AML-CFT "?
Yes. Licensed online gaming and betting operators are among the regulated professionals and fall under the jurisdiction of the National Gaming Authority. They must identify players and verify their identities, apply risk-based due diligence, screen against sanctions lists and lists of politically exposed persons, monitor transaction flows, and report any suspicions.
When should you verify a player's identity?
The arbitration concerns the distribution of checks between the registration process and subsequent stages. Certain checks are required to open an account, while others are triggered when a certain activity or deposit threshold is reached. Continuous monitoring then takes over. The applicable thresholds must be verified in the current official source and vary depending on the gaming channel.
Why does the gaming industry pose a specific money laundering risk?
A gaming account allows funds to be deposited and withdrawn through the same channel, with a high volume of small individual transactions. A game with a low expected loss can be used to move funds around and provide a legitimate source for them. The most useful control points are therefore at the intersection of deposits, betting activity, and withdrawals.
How do you screen a portfolio of several hundred thousand players?
Volume shifts the focus to the engine’s accuracy. Once a certain number of alerts is exceeded, they are processed superficially, and an overloaded system is ill-equipped to defend itself during an audit. Portfolio rotation also requires continuous re-screening, since a designation may occur after registration. Any reduction in noise must remain justifiable, decision by decision.
What must an operator be able to produce during an inspection?
It must generally be able to provide a risk classification tailored to the games offered, a record of identity verifications performed, time-stamped screening logs, a written explanation for rejected transactions, a history of anomalies reviewed in transaction flows, the response time for alerts, and the escalation process for suspicious activity, including analyses that did not result in a report.
