New regulations for gambling providers: What the industry needs to prepare for

The annual report of the gambling supervisory authorities puts the volume of gross gaming revenue generated in 2022 at 12.5 billion euros. Compared to the previous year, the gaming sector has thus grown by more than a third. A good 80 per cent of revenue was generated in stationary gaming. The industry is made up in roughly equal parts of the gaming machines, state lotteries, casinos, sports betting and other lotteries segments.

The National Risk Analysis of the Federal Republic of Germany rates the money laundering risk of the gaming sector as high. The assessment is based on the frequently high transaction amounts and the high speed at which funds are handled. In its 2009 report on vulnerabilities in the gambling sector, the Financial Action Task Force developed various typologies for terrestrial gambling with a focus on casinos. According to this, casinos per se carry out risky financial activities, such as accepting deposits on account and carrying out money transfers. The cash intensity of physical gaming operations poses a particular risk.

Since the new Interstate Gambling Treaty came into force on 1 July 2021, previously prohibited online games have been permitted under certain conditions. On this basis, 78 licences for virtual slot machines, online casino games and online poker had already been granted by October 2023. It can therefore be assumed that legal online gaming will gain in importance in the future. There are also risks in online gaming due to the wide range of payment options, including payment with crypto values. These methods are suitable for concealing the identity of the player and the origin of the assets used.

According to the FIU's annual report, around 1,550 gambling providers and brokers were registered in the reporting portal as at 31 December 2022. Less than 6 per cent of the registered companies were active during the period under review and submitted a total of 462 suspicious activity reports. This means that despite its relative size and prominent risk situation, the gambling sector only accounted for 0.1 per cent of the total number of SARs submitted. A positive development can only be seen in a period comparison: the reporting rate has more than doubled compared to the previous year.

The risk of abuse is not equally pronounced in all areas of the gambling sector. Games whose outcome can be determined by criminal activities are particularly susceptible. This includes targeted game manipulation such as hacking in the online sector or influencing the results of sporting events. The design of the security measures is another factor. For example, money launderers can circumvent existing controls by corrupting the gaming operator's employees. Whenever criminals can influence the risk of loss without directly manipulating the outcome of the game, games are suitable for money laundering. This is the case, for example, when money launderers make simultaneous bets or deliberately lose in direct competition with other players in favour of their co-conspirators.

In addition, the use of third-party player accounts, so-called straw man business, to launder incriminated assets is a common pattern. These straw men often do not participate in the game, or only to a limited extent, and then demand payment of the balance, which they declare as winnings from gambling. The money launderers deliberately accept minor losses. Alternatively, money launderers acquire a legally accrued payout claim from a regular player and use this process to legalise incriminated cash¹.

A specific risk also arises from the partial infiltration of the industry by criminal organisations, particularly in the area of so-called clan crime. Gambling establishments controlled by such structures offer the opportunity to channel incriminated funds directly into the legal economic cycle and to plan further criminal activities.

The Act on the Tracing of Profits from Serious Crimes (Money Laundering Act for short) obliges organisers and brokers of games of chance to take measures to prevent money laundering and terrorist financing. Gambling is defined as any game in which a player pays a fee to win a chance of winning and where the occurrence of a win or loss depends entirely or predominantly on chance. This currently excludes operators of gaming machines with a licence under commercial law² , operators of totalisers³ and lotteries that are licensed by the competent authority.

In principle, gambling operators must fully comply with the requirements set out in the Money Laundering Act. The legislator provides for a relaxation for low-threshold, terrestrial gaming operations. Accordingly, obliged entities only have to fulfil the general due diligence obligations for transactions in the form of winnings or stakes of a player from an amount of 2,000 euros. This does not apply to online-based games of chance.⁴ In practice, this requirement is met by controlling access to the gaming establishment. Due to the high risk of money laundering, gambling providers must update the documents, data and information about their contractual partners and the business relationship on an annual basis. The application of simplified due diligence obligations is generally not an option in the gambling sector.

In addition to the general requirements for all obligated parties, organisers and brokers of online games of chance are subject to more extensive regulations. These include setting up a named player account, the prohibition of accepting and paying interest on deposits and the restriction of permitted transaction types. In particular, this includes a ban on crypto transfers. Like credit institutions, gaming providers must operate and update a data processing system that enables them to recognise dubious or unusual business relationships as well as individual transactions in gaming operations or via a player account. However, according to the joint guidance issued by the supreme gambling supervisory authorities of the federal states (as of November 2020), casinos may waive this obligation under certain conditions.

The European Union adopted a comprehensive money laundering package on 30 May 2024. The core element of this amendment is the Money Laundering Regulation. As a result, the material requirements for the prevention of money laundering will be standardised and directly applicable throughout the Union for the first time without further national implementing acts. The regulation also applies to providers of gambling services, albeit with certain exceptions.

Accordingly, member states have the option of exempting providers of gambling services from money laundering requirements in whole or in part if the nature and scope of their activities pose a demonstrably low risk. This exemption does not apply to casinos, which must always take measures to prevent money laundering. Providers of online gambling may be exempted if they are state-operated or regulated. Prerequisite: A specific risk assessment must be carried out and the exemption must be notified to and authorised by the EU Commission.

The previous threshold value of EUR 2,000 for the application of the general due diligence obligations remains unchanged. In addition, the upstream identification of contractual partners in the form of access control is still possible. However, the previously existing additional requirements for IT monitoring and the special provisions for online gambling are missing from the text of the regulation. It remains to be seen whether this will result in a practical partial exemption for the industry or whether these additional requirements will be included in more extensive implementation acts. In any case, the existing measures must continue unchanged until the new regulation comes into force.

In addition to the requirements for the prevention of money laundering and terrorist financing, gambling providers will also have to take measures in future with regard to the non-implementation or circumvention of targeted financial sanctions.

To this end, the legislator is adding a sanction-specific component to the following obligations under money laundering law. These include

• Carrying out a company-wide risk analysis,
• Creating internal policies, procedures and controls,
• setting up a compliance function and
• auditing customers and beneficial owners.

In practice, companies can fulfil their new verification obligations by comparing data records that are recorded to identify players with relevant sanctions lists. This check should be carried out before the start of gaming operations and repeated periodically during the course of the business relationship as well as on an ad hoc basis, for example when new sanctions are imposed.

The Anti-Money Laundering Regulation will apply directly in all EU member states from 10 July 2027. At various points, the regulation refers to technical regulatory and implementation standards that are still to be developed by the new Anti-Money Laundering Authority (AMLA). These standards are intended to specify the obligations under money laundering law. In addition, a comprehensive revision of the administrative practice of the supreme supervisory authorities of the federal states for the gambling sector is to be expected.

Irrespective of these pending changes, gambling providers should familiarise themselves with the new regulations at an early stage and sound out their impact on their existing risk management system as part of a gap analysis.

The experts at KPMG will be happy to answer any questions you may have about preventing money laundering.

1 Cf. FIU typology paper, Special indications for the gambling industry (as at: March 2018).

2 Cf. section 33c of the Trade, Commerce and Industry Regulation Act.

3 Cf. section 1 of the Racing Betting and Lotteries Act.

4 Cf. section 10 (5) of the Money Laundering Act.