FATF Gambling Report: 123 Red Flags After 17 Years

The Financial Action Task Force has not written a dedicated gambling report since March 2009. On September 9 it published 123 reasons why it should have done so sooner. The new FATF gambling report, titled Risks of Gaming and Gambling, hands regulators, casinos, betting operators and payment firms across FATF’s network of more than 200 jurisdictions a list of red-flag indicators for money laundering, terrorist financing and proliferation financing. It also tells them that the illegal market they compete with is, in some countries, now bigger than they are.

What FATF published, and what it kept back

The public document is a 13-page PDF dated September 2026, with 10 numbered pages of content. It opens with 18 numbered key findings, adds five recommendations to jurisdictions, and then lists the indicators under five headings. FATF calls the work its “first detailed examination of risks associated with online and illegal gambling.” The only predecessor is Vulnerabilities of Casinos and Gaming Sector, a joint report with the Asia/Pacific Group on Money Laundering dated March 30, 2009, which dealt with casinos that have a physical floor.

The evidence base is larger than the page count suggests. Questionnaire responses came from 80 jurisdictions, written comments from a further 29, and industry bodies, researchers and private-sector firms were consulted over about a year. The case studies those jurisdictions supplied did not make the public version. FATF’s release says additional operational material and case studies are available to public authorities through its secure platform. Operators get the list. Supervisors get the worked examples.

“Without robust safeguards, these sectors can be attractive gateways for fraudsters, professional money launderers and organised criminal networks. I urge all governments to take note of the risk indicators we have set out today, and put in place appropriate risk-based responses – from strengthening oversight and cracking down on illegal and offshore operators, to boosting international co-operation, and deepening public-private collaboration.”

— Giles Thomson, FATF President, September 9, 2026

FATF does not license or fine anyone. Its standards reach operators through national regulators, which fold FATF findings into their own risk assessments, supervisory reviews and enforcement. That transmission has already started. The Danish Gambling Authority, Spillemyndigheden, which sat on FATF’s working group for the project, told its licensees within two days of publication that many of the indicators apply to them.

The 123 red flags, by category

FATF does not put a number on its list. Dyutam counted the bullet points in the public PDF: 123 indicators across five headings. The largest group, customer behavior and profile, holds 39, split into eight that apply only to land-based venues, nine that apply only online, and 22 that apply to both. Payment methods and transactions follow with 27, product and platform features with 26, betting patterns with 19 and online accounts with 12.

The land-based customer flags read like a floor supervisor’s notebook. Attempts to bribe or influence venue staff, insisting on dealing with one employee, using third parties to feed cash redemption terminals or buy chips, asking for winnings in cash up to the reporting threshold and never returning for the balance, and buying another customer’s winning ticket or ticket-in-ticket-out voucher to present as one’s own are all listed. Online, the flags shift to identity: repeated VPN use, multiple devices, a mismatch between the customer’s claimed residence and detected location, refusal to appear on a video call, and attempts to re-register an account the operator has already closed.

The 22 flags that apply to both channels include a customer whose address is a post office box or business premises, a customer identified as a politically exposed person, and a customer whose source-of-wealth checks show income from trading dual-use goods with sanctioned states. One flag is a question. The customer asks whether the platform reports to government authorities, or shows unusual interest in transaction limits and internal controls.

The betting-pattern flags cover the mechanics of laundering through play. Betting on every outcome, red and black in roulette or both teams in a match, hedged bets, consistent losses to the same opponent in peer-to-peer games, chip dumping, structuring deposits below reporting thresholds, and short-odds bets placed to justify a withdrawal all appear. So do bets placed by people involved in the sport, such as officials, club staff and competitors, and unusually large or coordinated bets on events that integrity bodies have flagged for possible manipulation. The Turkish match-fixing investigation that reached 13 clubs earlier this year is the kind of case those last two flags describe.

Payment flags name the rails. Heavy use of cash, especially higher-denomination notes; cash deposits made seconds apart; a preference for virtual assets, prepaid cards, vouchers and e-wallets; multiple payment methods in different names on one account; deposits followed by withdrawals with minimal or no play; mule accounts; deposits pooled by several people into an operator’s bank account and then paid out to one customer; chargebacks against multiple cards; e-wallets held at foreign payment institutions; and virtual-asset wallets used on unlicensed platforms.

The product and platform list is addressed to licensing authorities more than to compliance desks. It flags complex, often cross-border ownership structures; nominees, trusts and foundations in the ownership chain; shareholdings structured to fall below the thresholds that trigger regulatory checks; white-label arrangements without robust oversight; contracts for software, marketing or consultancy that lack commercial sense; beneficial owners who hold citizenship by investment; frequent changes of website address or brand name; a license followed by a long period of inactivity; and “sham merchants,” where an illicit operator disguises gambling transactions as ordinary retail payments. The message to regulators is to read the ownership chart before the customer file.

The flags that describe ordinary players

A reader who plays regularly will recognize some of these indicators from their own habits. Using a VPN, logging in from a new device, updating a phone number or bank account, hitting a daily deposit limit, playing low-volatility games with small returns, cashing out just below an identification threshold, or covering both sides of a market all sit on the list. FATF is explicit that the list is not a verdict.

“A single risk indicator alone is not necessarily a clear indication of money laundering, terrorist financing or proliferation financing (ML/TF/PF) activity, but it can prompt further monitoring and examination as appropriate.”

— FATF, Risks of Gaming and Gambling, red-flag risk indicators, paragraph 1

The same paragraph says that several indicators together warrant examination, and that some indicators “may also be indicators of problem gambling behaviours, rather than intentional attempts to engage in illicit conduct.” Frequent attempts to bypass responsible-gambling limits appear in the payments list for that reason. An operator cannot tell from the transaction alone whether it is looking at a launderer or a player in trouble.

For the player, the practical consequence is not an accusation but a request. A flagged account gets asked for identification, proof of address and evidence of source of funds, and withdrawals wait until the file is complete. Operators do this because their license depends on being able to show the check was done, not because the flag proves anything. Choosing a licensed operator makes that process predictable, and our guide to checking whether an online casino is licensed covers what a genuine license looks like.

Illegal markets that rival the legal ones

The finding FATF put at the top of its own release concerns operators that will never read the list. “The illegal gambling market rivals or even exceeds the legal market in some countries and continues to proliferate, attracting players through promotions and greater levels of confidentiality,” the report says in paragraph 13. The press release goes further and says illegal markets rival or exceed legal ones “in many jurisdictions.” Illegal operators, FATF adds, are prevalent regardless of whether gambling is legal or how it is regulated, and unlicensed offshore operators often present themselves as legitimate businesses while offering anonymity and incentives that attract both consumers and criminals.

The scale has been measured before. An industry report covered here earlier this year put unregulated online gambling at $5.9 trillion in 2025, leaving regulators with 22% of the market. The mechanics show up case by case: Germany’s black market grew out of restrictions meant to protect players, and an Iranian illegal gambling network routed $4 billion through Dubai crypto channels.

Denmark shows what enforcement against that market looks like. Spillemyndigheden, which contributed to the FATF project, secured a court order last year blocking 178 unlicensed sites, the largest action in its history, according to iGaming Business, which reported that the blocked list contained dozens of variations of the same brand. Frequent changes of platform URL or brand name is one of FATF’s 123 flags.

FATF also ties the illegal market to platforms outside gambling regulation. Social media, it says, is used to advertise illegal or unlicensed gambling, recruit money mules and coordinate competition manipulation, and gambling platforms depend on marketplaces, software developers and payment firms that may fall outside anti-money-laundering rules entirely. The report’s “sham merchant” flag describes the payment end of the same problem: gambling transactions dressed up as ordinary retail purchases so that a bank never sees a casino on the statement.

Where FATF puts the risk

The key findings rank the sectors in plain terms. Money laundering through gambling is “an established risk across many jurisdictions,” and brick-and-mortar casinos, online casinos and sports betting are “considered to be particularly exposed.” Lotteries, scratch cards and some other non-casino products may be considered less exposed. Money laundering through video gaming, on the available evidence, “appears to take place on a smaller scale, or with less sophistication and frequency, than through gambling.”

Terrorist financing runs the other way. FATF found such risks in gambling “limited and less frequently reported,” while online gaming showed more observable and documented misuse, influenced by social and technological factors. Proliferation financing risk is described as very limited in both. Junkets, the credit and travel intermediaries of Asian VIP play, are “on the decline and subject to increasingly strict regulations” but still pose risks through player anonymity and obscured ownership of the junket operator.

On payments, the report does not single out crypto. Cash, e-wallets, mobile money and virtual assets are named together as vulnerable, because the mix of methods accepted by online operators “increasingly allows rapid, anonymous, cross-border transactions, and the conversion of value into different forms.” Virtual assets then reappear in specific flags: wallets used on unlicensed platforms, business-to-business transactions settled in crypto, and customers combining fiat and crypto on one account.

Land-based casinos keep their place at the top of the exposure list for a reason the enforcement record already shows. In the United States, casino fines tied to the Mathew Bowyer case have reached $34 million, with the Venetian alone paying $7.2 million.

What regulators are told to do next

The report’s five recommendations to jurisdictions are broad by design, since FATF writes for more than 200 of them at once. They ask governments to improve risk awareness and apply the risk-based approach of FATF Recommendation 1; to strengthen licensing and registration so criminals cannot control gambling operators; to raise public awareness of illegal and unlicensed offshore gambling; to strengthen formal and informal international cooperation, especially on online and cross-border activity; and to build public-private partnerships that share information quickly.

The UK’s regulator moved before FATF did. The Gambling Commission’s 2026 money laundering and terrorist financing risk assessment, published July 30, keeps remote casino at high risk overall and rates third-party use of customer accounts, including mule accounts, at the maximum of high likelihood and high impact. A new entry for 2026, the lack of adequate checks on customers who are not physically present, receives the same top rating, and the Commission notes that false or stolen identity documents now include documents and videos generated with AI tools. The only sector whose rating changed was gambling software, raised from low to medium.

The project itself was steered from the Isle of Man. The Isle of Man Gambling Supervision Commission co-led the work with Australia, and the GSC’s Alivija Golubeva presented it to FATF’s Risk, Trends and Methods Group before the June plenary adopted it. “I am proud to see the Isle of Man GSC co-leading outstanding work that promotes understanding of the gambling sector on an international stage,” GSC chief executive Mark Rutherford said, according to Isle of Man Today.

Seventeen years between reports

The timeline explains why the report reads as a reset rather than an update. FATF adopted its risk-based guidance for casinos on October 23, 2008, and published the joint casino report with the Asia/Pacific Group on March 30, 2009, when its scope was casinos with a physical floor. The plenary that adopted the new report, held in Paris from June 17 to 19, 2026, was the last under Mexican president Elisa de Anda Madrazo. Publication fell to her successor, Giles Thomson, and came six days after FATF’s report on underground banking and hawala listed illegal gaming and gambling among the criminal economies those networks launder.

What comes next is national. FATF’s release asks governments to strengthen oversight, crack down on illegal and offshore operators, and deepen cooperation between public and private bodies. The indicators will show up in supervisory guidance, suspicious-activity reporting templates and license reviews at the pace each regulator chooses. Denmark took two days.

FAQs

---

Sources

• FATF warns of emerging risks in gaming and gambling and publishes new risk indicators — Financial Action Task Force, news release, September 9, 2026
• Risks of Gaming and Gambling: Red Flag Risk Indicators (PDF) — Financial Action Task Force, September 2026
• Outcomes FATF Plenary, 17-19 June 2026 — Financial Action Task Force
• Vulnerabilities of Casinos and Gaming Sector (March 2009) — Financial Action Task Force and Asia/Pacific Group on Money Laundering
• New FATF report finds underground banking and hawala are key channels for professional money launderers — Financial Action Task Force, September 3, 2026
• The 2026 money laundering and terrorist financing risks within the British gambling industry: Casino (remote) — Gambling Commission
• The 2026 money laundering and terrorist financing risks within the British gambling industry — Gambling Commission, July 30, 2026
• FATF udgiver rapport om risikoindikatorer for hvidvask på spilområdet — Spillemyndigheden (Danish Gambling Authority)
• Isle of Man presents key report at Financial Action Task Force plenary — Isle of Man Today, July 13, 2026
• FATF publishes new risk indicators for gaming and gambling sectors — iGaming Business
• Denmark regulator wins court order to block record 178 illegal gambling websites — iGaming Business