An Inside Look at the Challenges of Ensuring National and International AML Compliance within the Gaming Industry
Every industry faces unique challenges when it comes to maintaining compliance with anti-money laundering regulations. Joel Borsh, Vice President, North America of FinScan, the compliance brand of Innovative Systems, Inc. works with large gaming and financial institutions every day in the anti-money laundering (AML) and Know Your Customer (KYC) areas of compliance.
In a recent interview, Mr. Borsh broke down some of the compliance challenges faced by the gaming industry and how industry experts are working to solve them. Read on for:
- An overview of AML/KYC programs in today’s gaming market
- The greatest challenges facing the gaming industry
- Tools and strategies industry professionals are using to address these compliance challenges
Q: What factors should you consider in an AML program in today’s gaming market?
First, I think it’s important to recognize that there are several different levels of gaming institutions. There are freestanding, standalone, single state-oriented casinos and/or racetracks (“racinos,” as they’re sometimes called). There are also multi-state, multi-jurisdictional casinos — meaning a casino organization that owns multiple casinos across multiple state lines. And there are national and international casino organizations. There are also Indian or Native American Casinos that are regulated in the individual states that they operate in.
In the U.S., AML guidance comes from the Bank Secrecy Act (BSA) and Department of Treasury, but there is no overriding national body of gaming regulations because each state has the authority to issue its own gaming licenses.
When you look at smaller, single-operator casinos, there are regulations they have to look at that other types of gaming institutions may not need to consider. For example, they need to contend with underage entrance on and off of the property, and they have to look at people who are on self-exclusion lists. At the next level, you have multi-jurisdictional state casinos looking to create AML programs that transcend single operations in single states that are taking into account each one of the individual state rules as well as the overall guidance from the federal government. At the national level, you have large organizations that stretch from a single city like Las Vegas to multiple states, or even internationally into the Far East or Europe.
Each one is trying to deal with creating their own AML program that meets the requirements of the federal laws for the BSA. Any organization doing aggregated transactions of $5,000 or more with a client falls into this category.
The casinos have to observe these players for any type of unusual behavior. That unusual behavior could be anything, like cashing in or cashing out large quantities of money without an associated amount of gaming play. If someone walked in off the street and bought $20,000 worth of chips and then gambled for 10 minutes and tried to cash out those chips and leave, that would be deemed as an unusual, limited amount of play and could be viewed as an attempt to clean money through gambling.
There’s also what is called “chip walking,” which is when someone with a large amount of money buys casino chips. Let’s say they buy $20,000 worth of casino chips. They gamble, but they only cash out $1,000. They take the rest of those casino chips, and they walk out the door and try to use them as currency for purchasing other things.
The casinos have a requirement as well as right to reclaim chips without cashing them out if they deem any behavior to be atypical. In this instance, the chips can be collected and deemed to be non-cash-redeemable due of any type of observable infraction.
Some of the other challenges gaming institutions face when building AML programs is finding reliable ways to identify players. Players are required to provide a driver’s license and international players are asked to provide multiple forms of identification such as a passport.
Casinos have recognized that being able to build a marketing clientele for return players is very important to them. That’s why most casinos today have players clubs, which issue players an ID card after they have presented a driver’s license or passport. Not only do these programs allow players to accrue points and cash them in for free play, free nights at the hotel, and other benefits, they also help casinos more easily collect identification from players and validate those IDs.
Player identification is usually validated via ID scanners, and those ID scanners can be attached to different systems, such as a compliance system, which allows casinos to complete compliance checks and ensure that an individual player isn’t on any type of exclusion lists, including:
- Sanctions lists
- Self-exclusion lists
- Politically Exposed Persons (PEPs)
- Internal blacklists
By collecting and validating those IDs, casinos can build a compliance program that satisfies state and local laws, national BSA/Title 31 laws, and any other regulations necessary. Identifying and observing player activity over time also helps gaming institutions recognize suspicious activity so that they can file the appropriate suspicious activity reports (SARS).
Those SARs are reported to the federal government and are evaluated, and that information is available to other casinos as well to make sure they’re not doing business with people who have been observed in the past attempting to launder money in casinos, making the industry as a whole more secure.
Q: Know Your Customer (KYC) requirements are pretty stringent. How does having a strong KYC program enhance fraud investigative units (FIUs) and lower the risk of fraud?
Fraud is a major concern of the casinos. Obviously fraud extends into multiple different risk factors. It could be identity fraud, which happens more often than people recognize or know. Identity fraud happens when people fraudulently open credit cards with the banks that partner with casinos or fraudulently create an account in a players club. Being able to know your customer and identify your customer at the time of account opening — that is, doing your due diligence and background checks — are what allow gaming institutions to minimize the fraud that is being attempted.
Another type of fraud to consider is chargeback fraud, which is when a client comes on property and spends a large sum of money on a credit card or with an account that has been established in-house, and then they deny that they were there or try to cancel the credit card. You can imagine that someone going into a large casino and spending a lot of money that they don’t really have — maybe in a VIP area that might cost $1,000 or $2,000 just to get in and then spending $20,000 or $30,000 gambling — could realize their predicament afterward. So they go back to their hotel room, call the credit card company, and try to cancel that card, claiming that it was stolen or that they were not at the casino at that time.
Patrons may also engage in fraud by attempting to open an account at a casino with a line of credit attached to it or attempting to wire money to the casino from bank accounts. In these cases, the ability to identify customers and fulfill KYC requirements through hardware and software is critical so that the casino is not open for fraud. The ability to determine who these people are who walk into the casino with large cash amounts and ask for a credit line is a day-to-day task that technology helps casinos complete more effectively.
Knowing the customer through different identification checks at multiple entry points and floor spaces — whether it be at tables or slot machines — allows casinos to recognize people who are trying to avoid identification or engage in other suspicious activity and then to address these issues by developing and deploying a fraud plan.
Q: What are the challenges of online and mobile gaming compliance compared to those of casinos?
The challenges of online and mobile gaming are similar to the challenges faced by traditional brick and mortar casinos — identifying their customers and validating that identifying information. However, online and mobile gaming also presents the distinct challenge of accomplishing this task remotely.
Online and mobile gaming may or may not be associated with a brick and mortar casino. There are standalone online gaming companies worldwide that are not attached to brick and mortar casinos, although brick and mortar casinos have expanded into online and application gaming, determined by the state regulations that they happen to be in.
Once again this is all about being able to use technology to know your customer and fulfill your AML requirements at account opening. Each of these online gaming providers has a requirement to take in and validate identification to be able to comply with the BSA laws so that they know who they are doing business with, who opens the account, and to have a record of the identification and validation showing that it is a person they are compliant to do business with.
In 99% of cases when you’re talking about brick and mortar or land-based casinos, the person opening an account is standing in front of you, so you have a human interaction when trying to identify them. The online and mobile gaming space does not have this benefit, so verifying a patron is a bit challenging. However, there’s technology available in the online and mobile gaming areas that requires users to give multiple levels of identification, such as being able to validate an ID through a computer or a cell phone. The software identifies that piece of identification — that driver’s license— and the person opening the account is required to take multiple pictures of themselves to be able to be facially recognized through technology that it matches the ID. So if I try to open an account with my name and my ID, I would have to go through that process, utilizing the camera in my cell phone or my laptop computer, making sure I am not a different sex, a different person, etc.
Online gaming is also monitored by behavior algorithms to watch the amounts of money that are being gambled in certain settings over periods of time, to make sure there are bank accounts attached to those gaming accounts, and that the source of wealth is determined. Both brick and mortar casinos as well as online gaming have requirements to look at sources of wealth, to be able to provide information to law enforcement if they see someone who is a minimum wage, hourly employee of a company gambling millions of dollars. That would be suspicious activity.
Compliance technology plays a key part in ensuring casinos know who is on their floor and at their tables.
Q: How can technology help casinos keep up with increasing regulations and manage costs at the same time?
Casinos have recognized that technology has been able to help them expand their business and make them more competitive in many different areas. In particular, technology has played a huge role in security and compliance in the gaming industry. Cameras, eyes in the sky, security measures, hotel admissions, admission to property and off of property — technology has been core to casinos for many years.
Police and law enforcement often work hand in hand with the casinos to be able to determine suspicious activity and misaligned behavior patterns that someone coming to a casino in an attempt to launder money might be exhibiting. Being able to use technology and products like Finscan AML/KYC software and its ID validation capability enables those casinos to create audit trails of behavior and activity of play that they can provide to law enforcement at law enforcement’s request to help them pursue criminal cases.
Technology is able to help gaming institutions meet the requirements of AML/KYC regulations that weren’t necessarily designed with them in mind. Whereas the banks and financial institutions who inspired AML and compliance laws have long-term relationships with their clients, a casino may have a relationship that lasts only an hour. It’s the greatest challenge that casinos face because they deal in financial transactions that last minutes and seconds, whereas banks and insurance companies have a greater deal of time to do evaluations of the people they’re doing business with.
Implementing compliance technology to handle routine tasks frees casino staff to focus on serving and building relationships with a greater number of customers. By utilizing technology in the AML and compliance space to know their customers in an efficient and immediate manner, casinos can reduce their risk of fraud and possible loss, resulting in better risk management overall.
Q: What role can a technology vendor play in building ROI for a casino compliance program?
The value that a strong technology vendor brings to a casino is the ability to evaluate the overall workflow of the casino and to institute technology that enhances and complements the ability of employees, no matter what their position is. That means whether an employee is a part of the back-of-house staff, a cashier, in account opening, or a fraud investigator or compliance officer, the technology vendor is able to help them do their job more efficiently in an expanding regulatory environment. Giving employees tools in the form of compliance technologies allows for better workflow management and allows them to service more clients at a faster, more efficient rate.
A vendor that has that experience can come into a casino and do a true workflow analysis based upon the casino’s individual needs and desires for growth, and what their business case looking forward requires, showing the casino ways that they can increase each one of their employees’ capabilities while eliminating costs or increasing productivity.
The return on investment really comes through doing that workflow analysis because each casino is absolutely a different animal, and being able to tie existing hardware and software solutions together with new technologies improves efficiency and productivity as well as helps current employees do their jobs more effectively.
Many casinos also face the challenge of high employee turnover rates. Even though you may occasionally find an employee who has worked 10 years in the cage department, a great deal of turnover is more common. Utilizing technology not only ensures that the transactions worked on by all of these employees are compliant, but also helps train those new employees at a faster pace so that they live up to compliance and regulatory rules. This need, coupled with BSA requirements that all employees are continuously trained on regulatory AML laws, results in a constant need for efficient employee education on the compliance program, as well as on state and federal regulations, which is very costly if it’s not automated.
Technology vendors also build ROI for casinos by addressing the challenge of training employees by using automation to improve positions, productivity, and compliance across the employee base. This also maintains continuity in compliance and security efforts.
Q: What is the ultimate penalty for casinos that fail to comply with AML regulations? Is it just fines?
Yes, obviously there are regulatory fines casinos have to contend with — everything from allowing a minor to gamble or consume alcohol all the way up to multimillion dollar fines for being convicted of anti-money laundering violations. But the true risk non-compliant casinos face is the risk of being debanked.
Casinos have strong primary relationships with the banks that they do business with. If a casino is brought up on charges or fined by the federal government, they could lose their relationship with their bank. The bank could choose to drop them as a client, and a casino without a bank is not a casino.
The last time that I attended Casino Essentials, which is a regulatory convention attended by casino operators, there was a story told about a casino in California that received multiple fines and was de-risked by the bank. It took that casino an entire year to re-establish a relationship with a bank, and over 99 banks turned them down during that time.
When a casino maintains compliance, they not only avoid the financial loss of a fine and the reputational risk of being a casino that could have problems with their AML program — they also avoid extra reviews of their processes by the regulators, and they avoid being de-risked by their primary bank, which is as close to financial ruin that a casino can come. Because banks have to adhere to AML regulations as well, they can’t be seen as doing business with an entity that is non-compliant, or they will have their own regulatory issues and reviews to contend with.
Implementing the right anti-money laundering technology can save casinos money and help ensure their compliance with state and federal anti-money laundering laws.
FinScan is an advanced anti-money laundering solution that can provide a huge return on investment for casinos and financial institutions. To learn more about AML compliance in gaming, or to find out what FinScan can do for your business, go to www.finscan.com or email firstname.lastname@example.org.