Online Casino Money Laundering
Gambling Commission January 2018 letter to all online casino operators
New anti-money laundering provisions relating to casinos were brought in by the Money Laundering Regulations 2017 (MLR 2017) on 26 June 2017. A key change is that all casino operators, both remote.
Following a review of the online casino sector to consider how well operators are meeting their current obligations, the Gambling Commission has written (January 2018) to all online casino operators expressing concerns about the sector’s approach to anti-money laundering and social responsibility. In the letter the Commission sets out how it expects operators to review all of their processes aimed at tackling money laundering and meeting their social responsibility obligations.
Due to the serious nature of the Commission’s findings, it has already begun investigations into 17 online operators, and is considering whether five of these require a licence review. None of the operators under investigation has been named by the regulator.
The following is an overview of a casino operator’s responsibilities under The Proceeds of Crime Act 2002 (“POCA”), The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“The 2017 Regulations”), and the money laundering guidance and advice issued by the Gambling Commission. Unless otherwise stated, it is relevant to all casino operators, terrestrial and on line. It is an introductory overview only, and should not be taken as an alternative short-cut to becoming familiar with the Act itself and the Regulations and the Commission’s various publications, which must be read in full and re-read as they are amended or updated.
Casinos and Money Laundering: an overview
Introduction
The Gambling Commission has identified three stages in a typical laundering of criminal proceeds:
placement – this is the initial placing of the money (such as the cash proceeds of a drugs deal) into the financial system.
layering – this is when the source of the criminal proceeds is disguised by creating complex layers of financial transactions which obscure the audit trail.
integration – this is when the laundered money (now looking clean) is integrated into the legitimate financial system, and assimilated with other assets.
Casinos are amongst those businesses in which there is said to be the highest risk of money laundering taking place. The Gambling Commission points out: “the land – based gambling industry is particularly vulnerable during the placement stage as the use of cash is prevalent and the provenance of such cash is not always easy to determine“. On the other hand, online casinos could be said to carry their own particular risks arising from the ease with which transactions may be conducted with anonymity.
POCA and the 2017 Regulations place a miscellany of duties on casino operators (and those employed by them) with the aim of preventing and/or detecting attempts by customers to launder money. Upon the detection or reasonable suspicion of money laundering, there are various reporting requirements. Broadly speaking, for every statutory duty there is a corresponding criminal offence for failure to discharge that duty.
In addition to his statutory duties, a casino operator is bound by the LCCP (to which the operating licence is subject) to act in accordance with the Gambling Commission’s guidance on anti money laundering: “The Prevention of Money Laundering and Combating the Financing of Terrorism”:September 2017.
Definitions of ‘money laundering’
The popular understanding of ‘Money Laundering’ is that it is the means by which the proceeds of criminal conduct are made to appear to have derived from a legitimate source. The position in law, however, is that ‘money laundering’ is a much broader concept.
The anti money laundering regime created by POCA and developed in the 2017 Regulations defines ‘money laundering’ by reference to certain criminal offences that may be committed in relation to the proceeds of crime: sections 327-329 of POCA create the offences –
(a) concealing, disguising, or converting the proceeds of crime, or transferring or removing them out of the jurisdiction;
(b) entering into or becoming concerned in an arrangement which a person knows or suspects facilitates the acquisition, retention, use or control of the proceeds of crime;
(c) acquiring, using or possessing the proceeds of crime.
By way of examples, it will readily be seen that wagering ‘dirty money’ (which includes the direct or indirect benefit from the proceeds of crime) in a casino, in the hope of winning and converting the money into ‘clean money’, would fall within (a) above; whereas the wagering, merely, of ‘dirty money’ for recreational purposes only, would fall within (c): (a common instance is someone who steals to support his gaming habit). If a casino operator (righty) suspects that the money being wagered is the proceeds of crime, and allows the wager, then that most obviously would fall within (b), but might also fall within (a) or (c).
A failure to report known money laundering by a casino customer might be thought to amount to an offence under (b) above in its own right: but POCA and the 2017 Regulations create discrete offences –
Where a person working in the ‘regulated sector’ (which includes casinos) knows, suspects or has reasonable grounds for knowing or suspecting that another person in engaged in money laundering (i.e. the three areas of offending in paragraph 6 above) but fails to disclose that knowledge or suspicion to a relevant officer, that is a “failure to disclose” offence.
Where a person working in the ‘regulated sector’ knows or suspects that another person’s suspected involvement with money laundering has been disclosed to a relevant UK investigatory authority, or that an investigation is in contemplation or is being carried out, it is an offence to make any further disclosure to any other person which is likely to prejudice any investigation: that is a “tipping off” offence.
Where any person, whether working in the ‘regulated sector’ or not, knows or suspects that an investigation is in contemplation or is being carried out by an appropriate officer, it is an offence to make a disclosure to any other person which is likely to prejudice the investigation, or to interfere with material which is likely to be relevant to such an investigation: that is the offence of “prejudicing an investigation”.
Summary of casino operators’ obligations
In this section I will deal with what a casino operator is obliged to do and also what it is prudent he should do in order to protect himself against inadvertent offending.
General recommendations
The following is a list of recommended actions: it is should not be taken as exhaustive.
A casino operator should understand the broad scope of money laundering, as defined by POCA and explained by the Gambling Commission Guidance, and summarised above.
That understanding should, by training, be given to all staff working in the casino, at all levels. Although the 2007 Regulations excluded ‘ancillary employees’ such as bar staff from the training obligations it created, I take the view that the broad definition of “relevant employee” in regulation 24 of the 2017 Regulations is capable of bringing certain bar-staff into the class of employees who must receive training. In any event, it would be prudent to give bar staff some training, specific to the tasks they perform. Extravagant spending, indicative of money laundering, could occur in the restaurant or bar, every bit as much as on the gaming floor.
Whilst ultimate responsibility for anti money laundering procedures in a casino rests with senior management, the operator should encourage a culture (again, throughout all levels of staff) of alertness as to the indicators of money laundering, and of a commitment to prevent and/or detect it and report it.
The money laundering risks relevant to the particular casino operator should be identified. All casinos are vulnerable to attempted money laundering; but the risks of it, and the likely methods used, will not be identical in all casinos. As has already been suggested, the risks associated with land-based casinos are not identical to the risks associated with online casinos. The nature, spending power, etc., of a casino’s average or expected customers will be relevant. As with most of these recommendations, risk assessment should be an on-going process. The Commission advises that risk assessments should be reviewed and revised at least annually.
Policies and procedures to manage and mitigate the identified risks should be designed. The expectation is that measures should be proportionate to the identified risks. As perceived risks change in nature or extent, so will the policies and procedures. Of particular importance will be policies relating to the handling of cash and/or cash equivalents – where the risk of money laundering is all-too apparent.
The policies and procedures need to be effectively implemented. Again, the training of staff (appropriate to their functions) on the implementation of the policies and procedures is essential, and should be on-going.
Monitoring of the effectiveness of implemented policies and procedures should also be on-going, and amendments made, and re-training of staff undertaken, as necessary.
A written record should be kept of every relevant action taken (in accordance with the above or otherwise); when it was taken, by whom, and why. I recommend a dedicated and secure filing system for the keeping of such records, as well as a regular review by senior management of those files – which review itself should be recorded in writing.
Specific Obligations: (1) Customer due diligence
Casino operators are required to identify and verify the identity of their customers. They may do so –
on a customer’s entry to the premises (or, presumably, his registering as an online customer); or
when a customer approaches the threshold given by the 2017 Regulations.
The operator identifies the customer by obtaining a range of information about the customer. The verification of the identity consists of the operator verifying some of this information against documents, data or information obtained from a re liable and independent source.
I am assuming that all casino operators are fully familiar with customer due diligence. I only add that (a) CDD is an on-going obligation and it may need to be updated if there is a change in a customer’s circumstances or behaviour, and (b) whilst the commercial attractions of the ‘threshold approach’ are self-evident, I tend to think that the ‘on entry’ approach is easier to implement and less liable to present problems further down the line. The Gambling Commission has given helpful and detailed guidance as to the steps that need to be taken if the threshold approach is adopted: see paragraphs 6-27 to 6-37 of the September 2017 Guidance. Where a casino operator is unable (for whatever reason) to carry out CDD on a customer, he must not establish or continue any business relationship with that customer, and should consider making a report to the relevant department of the National Crime Agency.
Specific Obligations: (2) Appointment of Nominated Officer
A casino operator must appoint a Nominated Officer, whose duties are
To receive internal disclosures under Part 7 of POCA (see below);
To decide if these should be reported to the National Crime Agency;
To report to the NCA if necessary; and
To ensure that the appropriate consent is given for what might otherwise be participation (etc.) in money laundering: one of the concerns is to avoid inadvertent “tipping off”, and ‘appropriate consent’ will be touched on below.
The role of Nominated Officer is a pivotal one, and carries great responsibility. It is of paramount importance that he/she is in a senior managerial position, and has the authority to perform the functions required of the position. The Gambling Commission recommend that a permanent deputy nominated officer be appointed, to provide cover when the Nominated Officer is absent (on leave, or ill).
I recommend that the Nominated Officer is deputed to make regular reference to the Gambling Commission’s web site, in order to keep up to date with the latest money laundering guidance available there, and ensure that that guidance is implemented – whether into the casino’s policies and procedures or training regimes or both.
Specific Obligations: (3) Reporting to Nominated Officer
I take the following paragraphs to represent some of the most difficult challenges to a casino operator and his staff. The areas touched upon below are those, in my opinion, upon which the most thorough and constantly updated training will be required.
Anyone working for a casino operator, who in the course of their employment comes into possession of information (or any other matter) as a result of which they know or suspect, or have reasonable grounds for knowing or suspecting, that a person is engaged in money laundering, must as soon as practicable make an internal report to their nominated officer.
A central question, which highlights perhaps the greatest vulnerability for casino operators and their staff, relates to the circumstances in which there might be said to be reasonable grounds for suspecting that a person is engaged in money laundering. Insofar as a reader might hope for an exhaustive check-list of reasonable grounds, I regret that neither this overview, nor any other advice, is capable of providing it. There is an infinite variety of circumstances and permutations of circumstances, which may, or may not, give rise to reasonable grounds for suspicion. Each case will depend on its own facts. What I hope may be of some assistance is to consider a short sequence, beginning with what would not amount to reasonable suspicion, and ending with what could not be described as anything else.
The Court of Appeal said (Da Silva [2006] EWCA 1654) –
“It seems to us that the essential element in the word “suspect” and its affiliates, in this context, is that the defendant must think that there is a possibility, which is more than fanciful, that the relevant facts exist. A vague feeling of unease would not suffice.”
A customer of apparently limited means buying an expensive bottle of champagne might cause a vague feeling of unease, but it would be fanciful to suggest that it could of itself give rise to reasonable grounds for suspecting money laundering. In my opinion it would be prudent to keep a watchful eye on such a customer: but there would be no need to report him to the Nominated Officer unless the signals were much stronger.
At the borderline of reasonable suspicion, perhaps, is “unease” (but no more) brought about by the first signs of unusually large spending on the gaming floor. I say “first signs” as distinct from a maintained course of unusually large spending. I would expect a member of staff who witnessed a single a-typical large wager, that could well indicate a higher than usual risk of money laundering, to conduct (at the very least) an enhanced due diligence check on the customer as a first step. On-going monitoring of his gambling activities would seem to me to be essential. Monitoring should be across all the customer’s known gambling platforms within the operator’s business, and not simply his activity in the particular casino where he has aroused suspicion.
If the single a-typical large spend were repeated, or if enhanced due diligence raised any doubts whatsoever as to the customer’s identity, or caused suspicion as to the customer’s having the legitimate means to afford to gamble in those amounts (because, for example, of his job description), then I have no doubt that the threshold of reasonable suspicion will have been crossed, and the matter would have to be reported to the Nominated Officer as soon as practicable.
In a recent Gambling Commission review, the customer was gambling significant amounts of cash over some three years, losing (as I understand it) a six-figure sum. In that period there was no evidence that he had a legitimate source of income. In my opinion, the threshold for reporting was passed by leagues.
There is no ‘right or wrong’ about an actual suspicion held by a member of staff: if he/she becomes suspicious, then (rightly or wrongly) it must be reported to the Nominated Officer.
More difficult is the situation where a member of staff is not suspicious, but on an objective assessment of things it can be said that a reasonable person in possession of the facts would or should have been suspicious. Training is a vital step in the protection of staff members against making honest but erroneous judgments. To my mind, there should be an emphasis on leaning in favour of suspicion – that is, not giving the customer the benefit of the doubt in any borderline case.
Casinos handle large amounts of cash, and the provenance of cash is not easy to determine. A casino’s business involves the constant recycling of cash for cash equivalents, and cash equivalents for cash. It is not difficult to see the attraction of casinos to money launderers, or the vulnerability of casinos. All casino staff should be made aware of the risks and trained to be vigilant as to the everyday possibilities of money laundering being attempted or taking place. Experience has shown that complacency amongst staff is a major threat to detection. The best policies and procedures imaginable are an insufficient guard against casino staff who fall into the belief that the ‘by the book’ implementation of procedures, merely, discharges their duty of watchfulness. I am sometimes asked to identify the ‘triggers’ that might alert casino staff to money laundering. With the caveat repeated, and underlined, that there is no definitive list of suspicious circumstances, the following examples (mostly drawn from the Commission’s guidance) may prove helpful.
Staff members cannot rely on ignorance of the circumstances that should have aroused suspicion if that ignorance comes as a result of their failure to ask questions which any reasonable person would have asked.
Although knowledge which comes to a member of staff otherwise than in the course of the casino business does not (or is unlikely to) create an obligation to make a report, I cannot help but feel that it would be most unwise to ignore or turn a blind eye to that knowledge. I think that if a member of staff, outside the course of the casino business, came into possession of knowledge giving rise to suspicion that a customer was engaged in money laundering, then (subject to a legal duty of confidentiality or other imperative reasons for non-disclosure) it is difficult to see why the Nominated Officer should not be told. To my mind, the fact that a failure to report in those circumstances may not be an offence is hardly determinative of what the right course of action should be.
‘Reasonable grounds for suspecting’ does not equate to ‘belief’. The benchmark is not that high. Unusual patterns of spending, or anything unusual about a customer’s behaviour in the casino, which after investigation of the surrounding circumstances does not make commercial (or even un-commercial) sense, can all point to reasonable grounds for suspecting that the customer is engaged in money laundering. A combination of common sense, and shared experiences promulgated through training, together with a thorough familiarity with Gambling Commission advice, should go a long way towards a confident judgment being made: but there is no hard and fast formula to apply, nor any clear borderline between a right decision and a wrong one. The key is in the word ‘reasonable’. No one is expected to have second-sight: nor should they turn a blind eye, however.
An example frequently given is that of a customer who places a cash bet on an event that entails a high likelihood of his winning, but at a particularly low return. The amount staked, the repetition of such a wager, whether he has made similar wagers on different platforms within the operator’s business, will all be relevant. It is unlikely that a single, modest, bet of this nature will give rise to “reasonable suspicion” – although I would think that it should sound warning bells and spur increased monitoring.
Another example – which in my view will almost always cause “reasonable suspicion” – is the gambler who finances his gamble from one fund, but selects another (say) bank account into which the winnings are to be paid. A casino should mitigate against this risk by always linking pay-out to the same means by which a gambler finances his gambling transactions. But the fact of a request that winnings be paid into a different account from that providing the funds to gamble, to my mind should arouse “reasonable suspicion” whether or not it is compiled with.
Redemption of chips after little or no play may not always be money laundering (the customer may be called away urgently), but it is likely to be. Subject to the customer’s profile giving a contra-indication, and what, if anything, is known about his reasons for cashing-in without playing, I think that in most instances an internal report should be made.
Any sign of customers transferring money among themselves should alert staff to the possibility of money laundering. For example, customers playing against each other should be monitored carefully. The risk is that one deliberately loses to the other, and effectively launders whatever he has staked.
A customer who regularly changes his bank account should sound alarm bells. The combination of other factors, such as the nature and extent of his gambling, (e.g. multi-platform, large amounts) could, without more in my opinion, mean that an internal report should be made.
It should be remembered that all casino customers should be monitored as to their spending and general behaviour, to some extent. There should, it goes without saying, be greater monitoring of high-spending customers than low-spending customers.
Because the variety of circumstances capable of giving rise to ‘reasonable suspicion’ is so great, I would recommend regular (say quarterly) meetings of those most likely to be having to make this judgment, in which experiences could be shared (to the obvious benefit of those attending), together with discussion as to whether or not the threshold had been passed in any given case. The reasons for whatever conclusions were reached on that issue should be clearly identified, recorded and reviewed by senior management, who should intervene if necessary. (Care should be obviously taken not to discuss current reported incidents and by so doing prejudice an investigation or inadvertently commit a tipping-off offence: see above.) The records of these meetings (together with any intervention by senior management) could be incorporated into the training regimes of all staff. I think that to have such regular meetings would itself be a valuable training exercise, as well as emphasising the importance of anti money laundering measures and encouraging a culture of watchfulness.
Section 2 of the Gambling Commission’s 2017 Guidance, “Risk Based Approach”, is substantially more detailed than the equivalent section in the 2013 Guidance. I think that the advice offered is invaluable, both as to the specific examples given and also by way of spurring thought as to what might be additional examples. What I draw from this guidance by way of general principles are the following:
The risks of money laundering cannot be understood unless the wide meaning of money laundering is appreciated, as well as the multitude of ways it manifests itself in casinos.
How a casino manages the risks and mitigates against them should be written into the casino’s policies and procedures, on which there should be comprehensive staff training. Those policies need to be kept under review, and casino operators should be prepared to be critical as to their effectiveness and re-work them as appropriate.
The recognition of money laundering, or the possibility of it (giving rise to reasonable suspicion) is dependent on a combination of awareness, vigilance, prudence, objective analysis, common sense, and experience. Regular training and re-training is essential.
The sharing of information (and maybe ideas) among casino staff, and even with other casinos, is encouraged.
Art the heart of the matter are: assessment of the risks, development of policies and procedures, staff training, customer due diligence and regular, on-going, monitoring.
The benefit of any doubt should never be given to the customer (for example, to the commercial advantage of the casino). Judgments as to “reasonable suspicion” should lean towards caution.
Specific Obligations: (4) Reporting to National Crime Agency
When a Nominated Officer is in possession of an internal report raising a suspicion that a customer is engaged in money laundering, he/she has (perhaps obviously) a duty immediately to consider such report, and obtain all other relevant and available information held about the customer’s personal circumstances. The customer’s other transactions in the casino need to be reviewed, the patterns and volumes of them, as well as the length of the customer’s relationship with the casino. A decision then has to be taken by the Nominated Officer whether or not to make a ‘Suspicious Activity Report’ to the NCA.
Again, an exhaustive list of the circumstances that might, or might not, give rise to a reportable suspicion cannot sensibly be catalogued. They are no different in kind from those discussed above. The difference, so it seems to me, lies in the fact that the Nominated Officer in receipt of an internal report makes a decision in light of further, and much more targeted, inquiries of his/her own; and those inquiries must be comprehensive. Enquiries of the customer himself need to be undertaken sensitively, so as not to alert the customer that an SAR is being considered. The Gambling Commission recommends that the customer should be approached by someone already known to him.
Casino Money Laundering Cases
The Nominated officer is bound to act expeditiously and if of the opinion that there is suspicious activity, must make an Suspicious Activity Report to the NCA as soon as practicable. It cannot be over-emphasised that prompt action is in the casino’s interest, as well as in the broader interests of crime-prevention.
The NCA has published ‘preferred forms’ on which to make reports. I always encourage casino operators to use these forms, should it become necessary to make a report, because they can be completed on-line, at any time of the day or night, and they give a clear indication of the information required by the NCA.
A question which can often follow in the wake of an SAR is: how to manage the relationship between the casino and the customer who has given rise to suspicion and has been reported? On the one hand, it might be all-too-easy to break-off relations with him, and risk “tipping-off”. On the other hand, to continue as normal might well expose the casino to liability for knowingly entering into a money laundering arrangement with the customer. In reporting a recent investigation, the Gambling Commission was critical of a casino operator for continuing in a business relationship with the suspected money launderer, because the operator focussed only on the risk of “tipping off”.
Obtaining the consent of the NCA to continue in a relationship which might otherwise be the commission of a substantive money laundering offence is a (partial) solution to this dilemma; but because it is not, strictly, an ‘obligation of the casino operator’ I will deal with it briefly under its own discrete heading later in this advice.
Specific Obligations: (5) Record keeping, policies and procedures
Part 4 of the 2017 Regulations makes specific requirements with regard to record keeping and the establishment and maintenance of policies and procedures.
Part 7 of the Commission’s 2017 guidance explains the statutory requirements relating to record-keeping in language more accessible than that of the 2017 Regulations, and should be studied and applied by every casino operator. I take it as unnecessary to repeat or summarise either the Regulations or the Commission’s guidance here.
Recurring themes of both the Regulations and the Commission’s guidance are the need for policies and procedures to be developed – not just as to record-keeping, but as to every other limb of a casino’s anti money laundering protocols; and ‘induction’ and ‘top-up’ training of all staff involved in the creation and implementation of those policies
I strongly recommend that in addition to the specific record-keeping requirements of the Regulations and Gambling Commission, there is a ‘rule of thumb’ that every action taken with regard to money laundering (including a decision to take no action), and the reasons for it, should be recorded in writing and filed in a secure filing system that is regularly reviewed by senior management (as discussed above).
Appropriate consent
As has been mentioned, once a Nominated Officer has made a ‘suspicious activity report’ to the NCA, it is more than possible that any further dealings with the customer in question will involve the casino and/or its staff in the commission one of the substantive money laundering offences. It is a defence to such an allegation that an SAR has been made, an application for appropriate consent has also been made, and either the NCA has agreed to the business relationship (or the transaction in question) going ahead, or has not refused consent within 7 working days. When making a suspicious activity report it is imperative that any ‘consent to proceed’ being sought from the NCA is realistic (so as to cover the likely business dealings that will take place) and particularised.
Home Office Circular 029/2008 “Proceeds of Crime Act 2002: Obligations to report money laundering – the consent regime” gives further information and guidance on the process of applying for appropriate consent.
Conclusions
This is a complex area of law and practice. The demands made on casino operators are challenging and by no means always self-evident. I have given only a bird’s-eye-view of the principal issues as I see them, which is to be read as an introduction to, or outline-map of, what is a vast and ever-expanding area. As indicated at the beginning of this overview, there is no substitute for a thorough understanding of the relevant law (POCA and the 2017 Regulations) and the Gambling Commission’s various advice notes and guidance.