Photo by Jack Hamilton on Unsplash - Thanks.
FATF published its updated assessment of gaming and gambling this month, its first since 2009 and its first to properly address the online and illegal gambling landscape.
The report itself is short. The red-flag indicator list attached to it is not.
For operators, that list is probably the more interesting document. It gives a detailed picture of the behaviours, transactions, relationships and control weaknesses that should prompt closer examination.
And it points to a problem that is bigger than any individual AML rule.
The risk is in the correlation.
The short version
FATF is clear that the indicators only make sense when read together. A single indicator is not necessarily evidence of money laundering, terrorist financing or proliferation financing. Several indicators appearing together are what warrant further examination.
Those indicators span identity, devices, payments, betting behaviour, screening and responsible gambling.
Operationally, however, those signals often still sit in separate systems watched by separate teams: identity in one place, payments in another, fraud somewhere else, affordability and safer gambling in a fourth, gameplay in a fifth.
Each system may be doing its own job perfectly well.
The problem is what happens between them.
A customer logging in from several devices. A deposit from a third party. A dormant account suddenly funded. A sharp change in betting behaviour.
Each of these, on its own, might be unremarkable. Together, they can point to a mule account, an account takeover or structured activity.
The signals don't tell you which. The correlation tells you where to look.
FATF's wider finding is that gaming and gambling have become an interconnected value-transfer ecosystem: online, cross-border, multi-product and multi-payment, involving cash, cards, bank transfers, e-wallets, mobile money, virtual assets and third-party intermediaries. Some of the participants in that ecosystem sit outside national AML/CFT frameworks.
An operator cannot control that ecosystem.
What it can control is whether it can see its own customer risk across it.
That doesn't necessarily mean replacing every system already in the stack. It means having an architecture capable of bringing those signals together.
This is where architecture matters
The answer to a more complex risk environment isn't necessarily another specialist tool.
For an operator that already has strong KYC, payment, fraud, gameplay and safer-gambling systems, the question may simply be whether those systems can share the information needed to identify the patterns FATF is describing.
For another operator, consolidation may make more sense.
And for some, the right answer will be a combination of technology and operational support.
That is why Endida is built around an open-architecture Financial Crime Platform, built for iGaming, rather than a single prescribed operating model.
Endida brings identity, AML, fraud, safer gambling and financial risk into a unified risk surface. Operators can deploy the platform within their existing technology environment and operate it themselves, use Endida's operational capability where they need additional capacity, or take a hybrid approach.
The architecture adapts to the operator.
The underlying objective doesn't change: make the relationships between signals visible.
The FATF indicators and fraud indicators also overlap heavily. Shared devices, multiple accounts, third-party deposits, structured withdrawals and unusual payment patterns can be relevant to money laundering while also appearing in bonus abuse, multi-accounting, account takeover and stolen-instrument fraud.
The same data can therefore answer more than one risk question, and protect more than one part of the P&L. The same signals that help identify financial crime can also help operators prevent fraud, abuse and avoidable leakage from NGR.
What this looks like in practice
One customer view. Identity, payments, devices, gameplay, screening and safer-gambling signals can be brought together rather than assessed in isolation.
Cross-domain detection. FATF indicators can be incorporated into behavioural profiles and gambling typologies that surface patterns across accounts, payments and gameplay rather than judging individual transactions in isolation.
Network intelligence. Customers, accounts, devices, IP addresses and payment instruments can be analysed as relationships rather than isolated records. An account can look clean on its own. Its network may tell a different story.
Screening and enhanced due diligence. Sanctions, PEP and adverse-media screening can feed into the same customer-risk picture, with workflows for the human investigation required to resolve hits and assess source of wealth and source of funds questions.
Virtual-asset screening. FATF specifically identifies virtual assets among the payment methods vulnerable to a range of money laundering risks.
Affordability, limits and self-exclusion. Safer-gambling signals can sit alongside the AML view of the customer. FATF explicitly recognises that indicators of illicit activity and problem gambling can co-exist.
Open integration. Operators don't have to choose between the platform and the systems they already rely on. Endida can provide a central risk layer across an existing technology estate, or provide more of the underlying capability where consolidation is the better option.
Operational capability. Where an operator wants additional capacity, Endida can provide operational support alongside the platform. Where the operator has its own teams, the same architecture can support them directly. The MLRO, RGO and other appointments and legal responsibilities remain with the operator.
Infrastructure and deployment. The platform can be deployed according to the operator's regulatory, security and architectural requirements, including in jurisdiction dedicated infrastructure, the operator's own cloud tenancy or on-premise environments.
Auditability. FATF identifies gaps in record-keeping as a risk indicator. A modern risk architecture should therefore make decisions reconstructable: when a supervisor asks why a customer was treated in a particular way on a particular date, the answer should be a query rather than an investigation.
That is the difference between having more alerts and having more visibility.
See how Endida Financial Crime Platform, built for iGaming, brings these capabilities together
What FATF found
The sector FATF describes is no longer a collection of individual venues. It is an interconnected value-transfer ecosystem: online, cross-border, multi-product and multi-payment, with numerous actors involved and some sitting outside national AML/CFT frameworks.
FATF identifies brick-and-mortar and online casinos and sports betting as particularly exposed to money laundering risks. It also notes that, based on currently available evidence, money laundering through gaming appears to take place on a smaller scale, or with less sophistication and frequency, than through gambling.
Payment methods are a particular pressure point.
FATF identifies cash, e-wallets, mobile money and virtual assets as vulnerable to a range of money-laundering risks. The variety of payment methods available to online gaming and gambling operators can enable rapid, anonymous, cross-border transactions and the conversion of value between different forms.
The report also links abuse of gambling operators with corruption, cyber-enabled fraud, professional money laundering networks and organised crime.
Social media is part of that threat surface too, with FATF identifying its use for activities including competition manipulation, illegal or unlicensed gambling, recruitment of money mules and terrorist-financing activity.
Illegal and unlicensed offshore gambling is another significant risk. FATF notes that the illegal gambling market rivals or exceeds the legal market in some countries and continues to proliferate.
The indicators include activity linked to unlicensed operators and virtual-asset wallets used on unlicensed platforms. The challenges FATF identifies are equally familiar: regulatory differences between jurisdictions, limited information sharing between public and private sectors, difficulties in international co-operation and the pace of technological change.
Its recommendations are primarily directed at jurisdictions and regulators: improve risk awareness, strengthen licensing and registration, raise awareness of illegal and offshore gambling, strengthen international co-operation and consider public-private partnerships.
The operational consequences land with operators.
Denmark is already turning this into action
And this is not just a future regulatory question.
In Denmark, the latest AML changes come into force on 15 September 2026. Gambling operators must now prepare risk assessments covering proliferation financing, establish written policies, procedures and controls covering proliferation financing and financial sanctions, and introduce an independent audit function for their AML policies, procedures and controls. The Danish Gambling Authority says the changes are intended to strengthen Denmark's compliance with FATF recommendations.
That sits alongside a series of recent enforcement actions. The direction is clear.
The question is not simply whether an operator has AML controls.
It is whether those controls can identify, investigate, document and evidence risk across the customer relationship.
That brings the Danish experience very close to the issue FATF has now put on the table.
Three things worth noticing in the indicators
1. They are deliberately cross-domain
The online indicators cover identity and location: VPN use, multiple devices, discrepancies between IP address and stated residence and reluctance to complete verification.
They cover account behaviour: frequent transfers, dormant accounts suddenly funded, repeated failed deposits, several accounts sharing a device and IP changes that may indicate account takeover.
They cover betting patterns: structuring, betting on all outcomes, short-odds play used to justify withdrawals, deposits followed by withdrawals with little play, automated betting, insider betting and competition-integrity flags.
They cover payments: multiple methods in different names, third-party deposits, withdrawals to accounts other than the source, chargebacks across several cards, pooled deposits and mule accounts.
And they cover screening: sanctions, PEPs, adverse media and higher-risk jurisdictions.
FATF is careful to say that none of these, by itself, necessarily indicates illicit activity.
The combination is what warrants examination.
That is exactly the difficulty.
The KYC provider sees the document. The payment processor sees the card. The fraud system sees the device. The trading team sees the bet. The MLRO sees the case.
Each system may do its own job well.
The correlation falls between them.
2. Problem gambling and illicit finance can look similar
This is perhaps one of the more interesting aspects of the report.
FATF explicitly notes that some indicators can be indicators of problem gambling rather than intentional illicit conduct, and that indicators of illicit activity and problem gambling may co-exist.
Frequent attempts to bypass responsible gambling limits appear in the indicators. So do deposits that repeatedly reach daily limits and sudden changes in spending or betting behaviour.
If the same customer signals matter to AML and safer gambling, then keeping the MLRO and the RGO in completely separate data environments is a design decision worth examining.
The disciplines are not the same.
The customer risk is not necessarily separate.
3. The operator's own control environment is on the list
Under product and platform features, FATF identifies variations in CDD quality, weak ongoing monitoring, inadequate thresholds, insufficient staffing, limited training, gaps in record-keeping and dependence on third-party or white-label providers without robust oversight.
Capacity gaps are now a written risk indicator.
That matters particularly for B2B platforms and white-label arrangements. FATF specifically identifies dependence on third parties and white-label providers without robust oversight as a risk.
If you provide the platform, you need to understand what is happening on top of it.
If you operate the brand, you need to understand what is happening underneath it.
Either way, visibility matters.
Where this goes
FATF has done the sector a genuine favour.
It has published a detailed set of indicators showing the behaviours, transactions and control weaknesses that deserve attention across gaming and gambling.
The wrong response is to add another isolated layer of rules to an already fragmented technology stack.
The problem FATF describes is not simply one of coverage.
It is one of correlation, visibility and capacity.
Nor is the answer necessarily to rip out everything that already works.
For some operators, the answer will be a central risk layer across the existing stack. For others, it will be consolidation. For others again, it will be technology combined with additional operational capability.
The architecture should accommodate those choices.
What shouldn't change is the need to see the customer as a whole.
Because FATF has shown the cards.
The question now is how many of them you can actually see.
Sandeep is Head of AML Advisory at Endida, a cyber resilience, anti-fraud and financial crime firm working with iGaming and financial services operators across the UK, Europe and the Middle East.
Learn more about Endida Financial Crime Platform, built for iGaming
Sources: FATF (2026), Risks of Gaming and Gambling, Paris. Danish Gambling Authority, Amendments to the Danish Anti-Money Laundering Act (10 September 2026), and recent AML enforcement publications.