Casino Money Laundering Risk
A U.S. casino industry group this month updated its guidance on anti-money laundering (AML) obligations to take account of developments that include the expansion of the U.S. sports betting market, interactive mobile gaming, and customers with potential ties to marijuana-related businesses.
The newest version of the American Gaming Association’s (AGA’s) “Best Practices for Anti-Money Laundering Compliance” reflects “takeaways” from enforcement actions and guidance from the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN), the U.S. National Money Laundering Risk Assessment, as well as updated compliance guidelines from the Treasury’s Office of Foreign Assets Control, an association spokeswoman told Thomson Reuters Regulatory Intelligence.
For more on casinos’ compliance with Title 31, see our previous blog series.
“The most significant money laundering vulnerability at US casinos is the potential for individuals to access foreign funds of questionable origin through US casinos,” it concludes, “and to use the. New anti-money laundering provisions relating to casinos were brought in by the Money Laundering Regulations 2017 (MLR 2017) on 26 June 2017. A key change is that all casino operators, both remote. Casino operators can ensure they have effective anti-money-laundering and counter-terrorist financing measures in place by taking the following steps: Risk assessment: review and revise the risk assessment, covering issues such as customer profile, premises and remote sites and incidents of actual or suspected attempted money laundering.
The stated goal of the document is to provide a resource for the gaming industry and other financial sectors that are required to comply with the Bank Secrecy Act (BSA), the primary U.S. anti-money laundering law. It also aims to serve as a tool for government and law enforcement “to help guide their efforts to protect the gaming industry and the broader financial system from money launderers and others involved in illegal activity.”
Changes in the Guide include:
- An emphasis on a strong culture of compliance and the importance of industry engagement with government and law enforcement;
- A deepened analysis and updated recommendations covering new and emerging forms of gaming, including the expanding U.S. sports betting market and interactive mobile gaming;
- A strengthened and expanded Know Your Customer / Customer Due Diligence section;
- An emphasis on the importance of participating in the PATRIOT Act 314(b) industry information-sharing program;
- A more robust risk assessment section, with recommendations on evaluating whether a patron may have ties to a marijuana-related business; and
- A focus on the importance of including all readily available patron information for BSA reporting.
When it comes to the development and maintenance of a compliance culture, there “is no more effective way to foster a positive culture” than to have the casino’s senior leadership and board of directors “engaged in the AML compliance effort,” the document states.
The AGA Guide states further that such individuals should receive periodic updates on regulatory developments, changes to the program, resources, and audit findings by regulators and others. The document also states that many casinos have opted to engage in voluntary information-sharing with other financial institutions pursuant to Section 314(b) of the USA PATRIOT Act. “This program, and other formal and informal information sharing mechanisms, is a FinCEN priority and is a vital way to ensure casinos and other financial institutions can obtain necessary information about their patrons and customers,” the Guide states.
The document also addresses the need for ample risk assessment. For instance, it suggests that casinos probe whether a patron has ties to a state-licensed and regulated cannabis business and update their compliance programs to include a policy outlining how to address such individuals. When such concerns arise, casinos should consider reviewing any previous transactions involving the customer that may appear suspicious in light of the additional information, and should determine how to review future activity, the document adds.
Country risks also should be taken into account, the report states. Customers with casino accounts “may be deemed to present a higher risk if the casino learns that they are non-resident aliens or foreign nationals or residents of countries that have been defined by the United States as jurisdictions of concern for narcotics trafficking, human trafficking, money laundering, terrorism, or other forms of illicit finance,” the Guide states, adding that the risk is especially noteworthy if the foreign nation has been identified as non-cooperative by the international AML-standard-setting Financial Action Task Force, or if the country has been identified by Transparency International or “a similar reputable organization” as having a high level of public corruption.
Addressing the Rise of Interactive Gaming
With regard to interactive gaming, casinos may rely on third parties for verification of certain information such as Social Security numbers and player age, the document states. It adds, however, that casinos “cannot delegate their BSA / AML responsibilities” and notes that contracts with third parties should clearly identify BSA / AML responsibilities and allow the casino to perform periodic reviews to ensure compliance with the law.
It also identities red flags that may be associated with interactive gaming, such as multiple gaming accounts being set up from the same IP address or physical address, or unusual patron behaviors based on geo-location data, such as traveling between jurisdictions in a relatively short period of time.
Casinos have been defined as “financial institutions” under the BSA since 1985. They must file Currency Transaction Reports (CTRs) when a patron either provides the casino with or takes away from the casino more than $10,000 in currency during a 24-hour gaming day. Casinos also must file Suspicious Activity Reports (SARs) when a casino knows, suspects, or has reason to suspect that a transaction or attempted transaction is linked to illicit activity, or when it is simply inexplicable.
FinCEN shook up the casino industry under the leadership of Director Jennifer Shasky Calvery, who after taking the Treasury bureau’s reins in 2012, prioritized a high-profile push to force the casino industry to more rigorously comply with the BSA.
The AGA released its first AML best practices document in December 2014; and the second iteration came at the end of 2015, a year in which FinCEN levied civil penalties totaling $93 million against casinos accused of operating with anti-money laundering weaknesses.
In the fight against money laundering, the U.S. casino industry just got a passing grade.
In its December report, the global Financial Action Task Force applauded the stateside industry for its “increased focus on raising awareness and improving compliance” and for “mitigating measures above the requirements” of the 2007 Bank Secrecy Act.
Casino Money Laundering Risk
But money laundering is still big business, here and abroad. The 2016 Basel AML Index, which ranks countries for their money laundering risk, put Iran at No. 1, at greatest risk among 149 countries. Finland came in last—or best—with the least risk. The U.S. ranked 97th, leaving room for improvement.
China came in 39th and the United Kingdom 121st. And the Philippines—at the center of a multimillion-dollar international money laundering scandal last year—ranked 55th. Only now are lawmakers considering making casinos subject to the Philippines’ anti-money laundering (AML) laws.
According to the index, more countries have worked to improve their rankings, “but the effectiveness in fighting money laundering remains weak.” And though a majority of countries legally comply with international standards, they “fall short in the implementation and enforcement of their laws,” the agency said.
Despite increasing oversight by bodies like the U.S. Financial Crimes Enforcement Network, the flourishing underground will probably never be eliminated because criminals—like other entrepreneurs—are adaptable and highly motivated. Lock the front door, and they’ll come in through the window. In the internet age, the threat is likely to increase.
Cashing Out
As 24/7, cash-intensive operations, casinos are natural targets for money launderers. The goal is to ensure they’re not easy targets.
Like banks, U.S. gaming operations are required to file Currency Transaction Reports whenever patrons pass more than $10,000 over 24 hours, and Suspicious Activity Reports when the property “knows, suspects or has reason to suspect” that a transaction aggregating at least $5,000 involves funds derived from illegal activity. (By contrast, in Macau the reporting threshold is MOP500,000, or $62,570.)
Arguably, the rules can be boiled down to an axiom that’s already well-known in the casino business.
“Know your customer—that’s the byword,” says former casino executive Jeff Silver, a onetime chairman of the Nevada Gaming Control Board and now a gaming attorney at the Las Vegas-based firm Dickinson Wright. “In the early days of the gaming industry, money could come into the casino with burn marks, like someone had just blown up a safe in the bank, and nobody would ask questions. Today, when a patron requests a lot of credit or transacts large sums of cash, he’ll face a background check to see if the money he earns can support the kind of play he’s engaging in.”
Front-line employees can be the eyes and ears of the property, says Hal Crawford, managing director of regulatory compliance at K2 Intelligence, a compliance and cybersecurity firm in New York. “So many SARs come from employees just seeing something. It’s your people on the floor—the dealers and cage operators and ticket writers—who may first notice shady dealings and send out the alert.
“SAR doesn’t stand for Suspicious Activity Report,” says Crawford. “It stands for, ‘Something ain’t right.’”
When it comes to maintaining a paper trail—or the electronic equivalent—the industry is on its toes. Between 2011 and 2014, the number of SARs filed with the federal government increased 164 percent.
The reports are “investigated in a real-time, online basis,” says Silver. “When you file a report, within 24 hours, someone in the IRS has their hands on it, is looking at it, and decides if they want to send an agent over to the property to do more work.”
Other seemingly simple money-changing measures have made an impact—such as the choice by operators including MGM Resorts International to banish cash at the poker table. Among the most effective deterrents may be the increasing use of player cards, not just for VIPs but for patrons at all levels.
Full Disclosure
“Player card data is critical to effective surveillance,” says Crawford. “If the industry as a whole gets the information up front, there will be less putting out fires. Casinos will be able to profile their customers and answer a fundamental question: Is a customer’s play consistent with the capacity of the individual? In the near future, my guess is if you want to play, you’re going to have to have a player card.”
“It’s like applying for a car loan,” says former FBI forensic accountant Kerry Myers, who now teaches graduate classes on white-collar crime, fraud and money laundering at the University of South Florida. “You put in an application. They run a credit report, verify your address and verify that you’re employed. Then they know who you are. The advantage of player cards for the casino is it’s more efficient, it’s cheaper and they can control it. And that, in and of itself, really cuts down on money laundering.”
Perhaps surprisingly, Crawford has found some resistance to the idea of universal player cards. “What I’m hearing in the industry is, ‘If I ask for all that information, they’ll go across the street and not come back—I’ll lose that player.’ But look at the level of capital reinvestment they put in on a regular basis for hotel rooms and so forth. I think the government, regulators and law enforcement expect the same thinking in the capital reinvestment space of AML surveillance.”
This investment is not without return, he says. “If companies demonstrate that they’re willing to reinvest in their technology, their training, their effective data-gathering and reporting, they’re going to keep the risk of money laundering down. The regulators, the IRS and FinCEN are going to acknowledge their level of effort. Then they’re going to attract a more sophisticated level of financial institutions to provide the capital investment they want. It’s money well-spent.”
“The price of compliance is eternal vigilance,” Silver agrees. “It used to be that not everyone had a compliance officer. Now it’s considered a dereliction if you don’t have a compliance department to look into the background of your customers.” He cites one major U.S. property that spends $20 million a year on compliance. “With the risk of fines or loss of license, this is part of an organization that’s well worth it.”
For proof, look no further than Tinian Dynasty, a casino resort that once operated in the Northern Marianas Islands, a U.S.-controlled commonwealth. In June 2015, FinCEN levied a $75 million fine against the property—a new record—for “willful and egregious violations” of AML laws. By September of the same year, the place was forced to close, leaving hundreds of people out of work and decimating the island economy.
Structuring, Smurfing and Other Dirty Tricks
Criminals continue to fly under the radar, scrubbing an estimated $300 billion per year in the U.S. alone in an enterprise that can be used to fund terrorism. Is the gaming industry doing a good enough job of curtailing money laundering?
“That’s like asking if there’s an acceptable level of loss,” says Crawford. “The answer is no. There’s a much higher level of awareness and wanting to implement AML programs, but I think the gaming industry needs to spend more time and effort building out the right technologies.”
Asked to grade the gaming industry as a whole on its AML compliance, Myers says, “There was a six-month period between April and October 2016 in which FinCEN levied fines of about $16 million against three casinos for failure to comply with money-laundering requirements. In my opinion, that says there’s still work to do.”
Despite greater attention to the problem, bad guys can still sidestep the rules.
“Casinos must report any transaction involving $10,000 or more, but how many casinos are on the Las Vegas Strip?” asks Myers. “If I want to launder money, I just go from one casino to another,” exchanging lesser amounts for chips and cashing out. “If I do that five days in a row, I can turn a lot of money.”
That form of minimal gambling comprises about 14 percent of SARs, according to the U.S. Treasury’s 2015 Money Laundering Risk Assessment. An additional 28 percent of reports are filed for suspected structuring, where players deliberately stay under the $10,000 reportable threshold. Then there’s a common practice known as “smurfing,” in which groups of people go into casinos or other businesses to exchange illicit funds in small amounts for legitimate, liquid currencies.
To detect possible money laundering, Crawford advises that casinos look at players and patterns of activity over the long haul. “The industry should look not only at a 24-hour window but over a multiple-day period, and at the end of 30 days do a full analysis to see if suspicious people are coming in and out.”
‘Where the Money Is’
To keep ahead of money launderers, the American Gaming Association just released its updated list of best practices for AML compliance, says Elizabeth Cronan, the AGA’s senior director of gaming policy. Among its most important tenets: “to ensure that internally there’s a culture of compliance, without silos, so that critical information is being shared across departments.”
“It’s a huge priority for the AGA when you look at the wider implications,” says Cronan. “Ultimately, our industry is serving the government with information that’s going to protect the integrity of the wider U.S. financial system. It’s of critical importance in the age of terror threats, and something we take very seriously.”
No matter how tight the controls, criminal syndicates, cartels and garden-variety crooks will always be working on new ways to clean dirty money from drug trafficking, human trafficking, Medicare fraud, ID theft, mortgage fraud or other nefarious activities—including illegal gambling. Once the origins are obscured, the tainted profits re-enter the economy, and money launderers make out like the bandits they are.
“A new slot machine can’t come out without finding its way into the garage of some criminal who tries to reverse-engineer it so it can be cheated,” says Silver. “Of course with the internet, there are more sophisticated ways of laundering money. Every time you plug a hole, the ingenuity among the criminals also occurs.”
“The ways to launder money are limited only by the imagination of the person doing it,” says Myers. “In fairness to the gaming industry, money launderers are drawn to any business that’s heavily involved in cash. It could be a restaurant, a taxi cab company—any industry out there that has a lot of cash moving. But frankly, the biggest cash-based business is casino gaming.”
He recalls the words of legendary bank robber Willie Sutton, who stole a reported $2 million during his career in the 1930s. Asked why he robbed banks, Sutton famously replied, “Because that’s where the money is.”
The Building Blocks of an Effective AML Compliance Program
A Q&A with Mark Clayton and Carl A. Fornaris, gaming attorneys, Greenberg Traurig LLP
GGB: What are the basics of an effective AML compliance program?
Fornaris: It consists of four key “pillars:” internal controls, such as policies and procedures; a compliance officer; employee training; and an annual independent audit that tests the effectiveness of the AML compliance program. At the heart of the compliance program is the ability to monitor for suspicious transactions and, as appropriate, to report suspicious transactions to regulatory authorities. Enforcement actions against casinos typically result because of the existence of systemic breakdowns in one or more of these pillars.
Clayton: It’s a comprehensive program that is risk-based, meaning the requirements of the program are designed to reasonably detect potential money laundering based on the risk the particular casino could be used for money laundering. A small regional casino with slot machines and a few low-dollar table games is much different than a high-end casino on Las Vegas Boulevard. The two programs would be vastly different, as the risks of money laundering are vastly different.
Further, the program should be able to collect all information regarding a patron, regardless of the source, within the casino, to provide a comprehensive collection of data/transactions that can be used for currency transaction reporting and suspicious activity reporting purposes.
Front-line employees may be as important as or even more important than the bosses to the successful detection of money laundering. How vital is it to have a formal training program for the rank and file?
Clayton: FinCEN has made it clear that training from the top down is important. Everyone in a casino must be educated on anti-money laundering requirements, tailored to the person’s job functions. Of course, any employee who interacts with a customer or has information on a patron, regardless of how, is vitally important to the casino’s AML efforts.
Casino Money Laundering Risk Assessment
Do you ever encounter resistance from gaming organizations on investing in a strong prevention effort? And what do you say to them?
Clayton: One simply has to look at the amount of the recent fines and penalties for Bank Secrecy Act and anti-money laundering violations to demonstrate the importance of compliance. Given the amount of fines and potential reputational damage, it’s more prudent and cost-effective to spend the money up front on compliance efforts rather than on the back end after violations of the program have occurred.