UK casinos sit under two separate AML regimes at once. Licence condition 12.1.1 binds every gambling operator, while the Money Laundering Regulations 2017 apply to casinos alone, supervised by the Gambling Commission. Customer due diligence bites at £2,000, and the Regulations changed again on 30 June 2026.
Key takeaways
- Casinos are the only gambling sector named as relevant persons in the Money Laundering Regulations 2017. Betting, bingo and arcade operators are not.
- Customer due diligence is triggered at £2,000 of stakes wagered or winnings collected, in single or linked transactions.
- Proliferation financing became a statutory risk assessment obligation on 1 September 2022 and entered Commission casino guidance on 7 June 2023.
- Amendments taking effect on 30 June 2026 narrow the complex-transaction trigger and restate the euro thresholds in sterling.
- Section 121 of the Gambling Act 2005 carries no statutory ceiling on a financial penalty, and Evolution Malta Holding paid £4.75 million on 23 July 2026 over a money laundering risk assessment that missed third party risk.
Which rules bind every operator, and which bind only casinos?
This distinction decides what an inspector can hold you to. Licence condition 12.1.1 applies to all operating licences except gaming machine technical and gambling software licences. It requires a money laundering and terrorist financing risk assessment reviewed at least annually and on any material change, appropriate policies, procedures and controls flowing from it, and effective implementation of those controls.
The Money Laundering Regulations 2017 are narrower. Regulation 7 names the Gambling Commission as supervisory authority for casinos only, and no other gambling sector appears in the list of relevant persons.
| Obligation | Casinos, remote and non-remote | Other gambling operators |
|---|---|---|
| Licence condition 12.1.1 risk assessment and controls | Applies | Applies |
| Money Laundering Regulations 2017 | Applies in full | Does not apply |
| Proceeds of Crime Act 2002 Part 7 and Terrorism Act 2000 Part 3 | Applies | Applies |
| Ordinary code provision | 2.1.1, act in line with Commission AML guidance | 2.1.2, take account of Commission POCA advice |
| Guidance document | Fifth edition, revision 5 | Fourth edition POCA advice |
An operator running a casino licence and a betting licence in the same group therefore runs two different AML standards side by side. The Commission's casino responsibilities page sets out the casino side.
When must a UK casino apply customer due diligence?
Regulation 27 sets a casino-specific occasional transaction trigger that is far below the general one. Where most relevant persons apply CDD at £12,000, a casino applies it when a customer wagers stakes or collects winnings of £2,000 or more, whether in a single transaction or in linked transactions.
| Trigger | Threshold | Notes |
|---|---|---|
| Wager of stakes or collection of winnings | £2,000 or more | Single or linked transactions |
| Establishing a business relationship | No threshold | Applies on account opening |
| Transfer of funds | More than £800 | Applies to all relevant persons |
| Suspicion of money laundering or terrorist financing | No threshold | Overrides every monetary trigger |
| Doubt about the veracity of identity evidence | No threshold | Requires re-verification |
Two operational points follow. Linked transactions mean a customer cannot be kept below the trigger by splitting play across sessions or tables, so aggregation logic has to run across the whole relationship rather than per visit. And because suspicion carries no threshold, a low-value customer with an implausible source of funds is in scope from the first hand.
What changed in the Regulations on 30 June 2026?
The Commission's notice of 9 June 2026 sets out upcoming changes to the Money Laundering Regulations 2017, with the majority taking effect on 30 June 2026. These are drafting-level changes with real operational consequences.
Enhanced due diligence for high-risk countries is now anchored to the FATF call for action list rather than to a UK schedule. Schedule 3ZA of the Regulations, which had carried the UK's own list of high-risk third countries, was omitted on 23 January 2024, and the reference point has moved since.
The requirement to apply extra scrutiny to complex transactions narrows to unusually complex transactions, though operators still have to weigh geographic, product and customer risk factors in the round. Euro thresholds are restated in sterling, so the casino trigger now reads as £2,000 rather than 2,000 euros.
The Commission has said it expects operators to update risk assessments, policies, procedures and controls to match, and that its own casino guidance will be revised after the changes take effect. A firm that treats this as a redraft of existing text rather than a control change will fail the next casework review on the mismatch between the two.
When did proliferation financing become a casino obligation?
Earlier than most operators remember. Regulation 18A was inserted by the Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 and took effect on 1 September 2022. It requires a relevant person to take appropriate steps to identify and assess the risks of proliferation financing to which its business is subject, to keep a written record of that assessment, and to hand it to the supervisor on request.
The Gambling Commission carried the obligation into its casino guidance on 7 June 2023 in revision 3 of the fifth edition. That revision required a proliferation financing risk assessment, policies and controls to manage the risk, staff training covering it alongside money laundering and terrorist financing, and internal reporting of suspected proliferation financing to the nominated officer.
Proliferation financing is the funding of weapons of mass destruction activity, and in practice the assessment is a sanctions and geography question rather than a transaction-typology question. The controls that answer it are jurisdiction screening, ownership screening on corporate customers and sanctions and PEP screening that resolves to a current list rather than a stale extract.
What does the Commission expect of the nominated officer?
The nominated officer is not a post-hoc reviewer. Revision 3 of the guidance requires the role to be involved in establishing the casino's risk-based approach to money laundering, terrorist financing and proliferation financing, and employees must make an internal report where they know or suspect, or have reasonable grounds to suspect, any of the three.
That internal report is the gateway to the external one. Section 330 of the Proceeds of Crime Act 2002 makes failure to disclose in the regulated sector a criminal offence carrying up to five years imprisonment, and the defence for an employee is that they told the nominated officer.
The Commission's casework has repeatedly found personal management licence holders who did not supervise AML controls closely enough or test whether policies were working. A nominated officer who cannot evidence a decision trail, taken contemporaneously rather than reconstructed at inspection, is the single most common finding in a casino licence review.
Where does casino AML casework actually fail?
The Commission published casino casework trends in October 2025, and the failings are consistent enough to use as a self-assessment checklist.
| Finding | Provision cited |
|---|---|
| Risk assessment missed risks named in Commission publications and emerging risk bulletins | Licence condition 12.1.1(1), regulation 18(1) |
| Policies and controls did not match the risks the assessment had identified | Licence condition 12.1.1(2) |
| Customer risk factors identified too late in the relationship | Regulation 28(12) |
| Profiling deferred until a spending threshold was reached, ignoring non-financial indicators | Regulation 33 |
| Red flags in documents, including third party deposits and false identification, not scrutinised | Regulation 33(6) |
| Training not delivered on the operator's own policies or on how to report | Regulation 24 |
| White label partners and investors not treated as high risk third party relationships | SRCP 1.1.2 |
| Algorithms deployed without the operator understanding what they escalated | Licence condition 12.1.1(3) |
The threshold-deferral finding deserves particular attention. Waiting for a customer to reach a monetary trigger before profiling them is not a risk-based approach, because the non-financial indicators were visible at account opening.
What can the Gambling Commission actually do, and what can it not?
Precision matters here, because the Commission is often described as fining operators when the mechanism is more varied. Under section 121 of the Gambling Act 2005 it may require a licence holder to pay a financial penalty where it believes a licence condition has been breached. The Act sets no ceiling, but obliges the Commission to publish a statement of principles and to have regard to the seriousness of the breach, whether the licensee knew or should have known, and the licensee's financial resources.
Separately, under section 116 it can review an operating licence with a view to suspension or revocation, and it can attach new conditions. Many published outcomes are regulatory settlements in which an operator pays a sum in lieu of a financial penalty, which is a negotiated resolution rather than a penalty notice.
What the Commission cannot do is prosecute money laundering. That sits with prosecuting authorities and the courts under the Proceeds of Crime Act 2002, where the principal offences carry up to 14 years. Recent Commission action includes Evolution Malta Holding, which paid £4.75 million on 23 July 2026 after its 2024 money laundering risk assessment failed to assess third party risk and did not detect that two of its customers were supplying its games to Great Britain without a licence.
What should a casino operator fix before the next inspection?
Start with the risk assessment, because every other finding traces back to it. It has to name your actual products, payment methods, customer types and geographies, cover proliferation financing under regulation 18A, and carry a review date inside the last twelve months. The Commission's 2026 risk assessment for the British gambling industry, published on 30 July 2026, is the reference point it expects you to have read.
Then test the join between assessment and controls. Take three risks the assessment identifies and trace each to a named control, a system rule and a training module. If any of the three stops at a policy sentence, that is the gap the casework trends describe.
Finally, treat aggregation and enhanced due diligence as automated workflows rather than manual escalations, and keep the training records regulation 24 requires in writing. The wider UK framework these obligations sit inside is set out in the state of AML regulations in the United Kingdom, sector detail sits on our betting and gaming industry page and United Kingdom coverage page, and further jurisdiction guides are collected under jurisdictions and regulation.
