Emerging money laundering and terrorist financing risks
As part of your commitment to ensuring compliance with anti-money laundering and counter-terrorist financing legislation, you will need to ensure that you keep up to date with any emerging risks that the Commission publishes (as required under Licence Condition 12.1.1(3) of the Licence Conditions and Codes of Practice LCCP).
Emerging money laundering and terrorist financing risks from May 2021
28 May 2021
Our latest emerging risks bulletin looks at innovations in cryptoassets, the quality of suspicious activity report (SAR) submissions, insufficient due diligence checks, the threat of organised crime and the latest podcast from the UK’s Financial Intelligence Unit.
Innovations in the cryptoasset market
The Commission is reiterating the importance of operators’ responsibilities under Licence Condition 12.1.1 (1) of The LCCP which requires licensees to conduct an assessment of the risks their businesses face from money laundering and terrorist financing upon the introduction of new products or technology or new methods of customer payment.
The cryptoasset market is constantly evolving due to increasing popularity and product innovations e.g., ‘non-fungible tokens’†. Licence Condition 12.1.1.(3) requires operators to take account of any applicable learning or guidelines published by the Commission on this subject. Cryptoasset payments have been rated high risk in our current publication of the money laundering and terrorist financing risks within Great Britain’s gambling industry (2020 version). Operators are also required to submit a Key Event to the Commission under Licence Condition 15.2.1(8) wherever there are changes in payment methods.
The UK's Crown Prosecution Service (CPS) (opens in new tab) expects to see an increase in the number of Bitcoin and cryptoasset related scams in the coming years and the Commission encourages operators to remain vigilant to such changes and update their money laundering and terrorist financing risk assessments accordingly.
Also, to assist with implementing a risk-based approach, the Financial Action Task Force (FATF), the inter-governmental watchdog that establishes standards for anti-money laundering and know-your-customer requirements, has published both new standards for implementation of a risk-based approach (opens in new tab) and new draft guidance (opens in new tab) for decentralised platforms. Operators must familiarise themselves with FATF’s guidance to help combat money laundering and terrorist financing and implement such learning into their business.
Quality of suspicious activity report (SAR) submissions
The National Crime Agency (NCA) has published guidance (opens in new tab) providing information on submitting quality SARs. The guidance acts as a useful checklist for what information should be included in a SAR to ensure the maximum impact from the information provided. During the COVID-19 pandemic, the NCA has seen an increase in SAR submissions and it is vital that operators submit a SAR to the United Kingdom’s Financial Intelligence Unit (UKFIU) whenever there is knowledge or suspicion of money laundering or terrorist financing (as required under The Proceeds of Crime Act 2002 (opens in new tab) (‘PoCA’) and The Terrorism Act 2000 (opens in new tab) (‘TACT’)). Failure to do so can result in committing a criminal offence.
Furthermore, operators are also reminded of the need to submit quality SARs as this will aid the UKFIU if further investigations need to be carried out i.e., with other law enforcement agencies. Operators are also reminded that failure to submit a Defence Against Money Laundering (DAML) SAR to the UKFIU (when needing to commit a prohibited act) could be a criminal offence under PoCA and TACT. Examples of prohibited acts include:
- Transferring customer balances when a suspicion has been formed
- Retaining customer’s account balance once a suspicion has been formed
- Moving a customer’s account balance within your business to a different account, once a suspicion has been formed.
Operators are also reminded that a corresponding SAR Key Event which includes the SAR’s unique reference number (URN) must also be submitted under Licence Condition 15 of The LCCP.
Insufficient due diligence measures, the threat of organised crime and customers from high risk third jurisdictions
The Commission has come across various examples of operators failing to sufficiently scrutinise the source of customer funds. It is becoming increasingly important for operators to carry out sufficient due diligence checks as the threat of serious and organised crime increases globally. Failure to conduct sufficient due diligence checks becomes even more problematic (for example) as:
- The threat from organised crime infiltrating businesses remains significant.This year’s EU Serious Organized Crime Threat Assessment 2021 (opens in new tab) states that trade in illegal drugs continues to ‘dominate’ the world of organised crime in the EU accounting for a large portion of criminal profits, money laundering and violence linked to organised crime
- If a customer is from a high-risk third country.
The UK government has added Pakistan to the list of undesirable 21 high-risk countries with unsatisfactory money laundering and terrorist financing controls. This list of 21 countries replicates the list of countries named by FATF as high-risk or under increased monitoring.
The full list of high-risk third countries under Schedule 3ZA of The Money Laundering and Terrorist Financing (Amendment) (High-Risk Countries) Regulations 2021 (opens in new tab) (‘MLTFR 2021’) includes (in order):
- Burkina Faso
- Cayman Islands
- Democratic People’s Republic of Korea
According to the UK government, the nations in this category pose a threat because of weak tax controls and lack of check and balance on terrorism financing and money laundering.
The MLTFR 2021 came into force on March 26th, 2021 after the definition of a high-risk third country identified in a new Schedule 3ZA and updates The Money Laundering Regulations 2017.
All operators are required to take a risk-based approach in order to mitigate the risk of money laundering and terrorist financing. Both our casino guidance and guidance for non-casino operators makes clear that, ‘higher risk customers should be subjected to a frequency and depth of scrutiny greater than may be appropriate for lower risk customers’.
Casino businesses are also required under The Money Laundering Regulations 2017 (opens in new tab) to carry out enhanced customer due diligence measures (ECDD) wherever there is a higher risk of money laundering or terrorist financing. Please refer to our comprehensive casino guidance for further information on the circumstances in which ECDD measures must be applied.
† The risks associated with cryptoasset payments have been previously discussed in the Commission’s April 2020 emerging risks ebulletin. Please refer to this further below for more information.
Emerging money laundering and terrorist financing risks from July 2020
13 July 2020
Customer use of informal value transfer systems, Money Service Businesses, licensees’ reliance on third parties and conducting affordability checks.
The Commission is highlighting to gambling businesses that their policies, procedures and controls must be effective in establishing customers’ source of funds as well as the need to undertake sufficient ‘Know Your Customer’ (KYC) checks.
Increased use of informal value transfer systems (IVTS)
IVTS are used in some parts of the world to conduct legitimate remittances (most often by individuals seeking to send money to and from family members in their country of origin). However, IVTS (also known as ‘underground banking’) are attractive for money laundering (ML) and terrorist financing (TF) purposes for some of the following reasons:
- there is no audit trail left behind of any transactions made
- availability to de-banked or unbanked customers
- senders are not required to provide identification documents
- avoidance of high banking fees.
Poor implementation of policies, procedures, and controls for KYC makes the use of IVTS easier and there is increased use of IVTS such as, ‘Hawala’ (a traditional system of money lending originating in South Asia); today it is used around the world to conduct legitimate remittances outside of the banking system. Increasing evidence of the risk that gambling businesses may be accepting customer funds that have been obtained through IVTS being exploited by criminals is emerging where criminals use IVTS for the purpose of transmitting illicit finance.
Our guidance for both casino and other operators highlight that customer monitoring is an ongoing process. Licence Condition 12 of The LCCP states that, ‘licensees must conduct an assessment of the risks of their business being used for money laundering and terrorist financing’.
Money Service Businesses (MSBs)
All casinos are required to comply with The Money Laundering Regulations 2017 (opens in new tab) in respect of MSBs and HMRC’s guidance for foreign currency exchange, cheque cashing and money transfer to minimise the risk of ML and TF. All casinos offering MSBs are required to have effective risk assessments, policies, procedures and controls in place to prevent ML and TF and continue to raise standards in this regard.
During COVID-19 there has been an increased use of MSBs in the wider economy and, for those online casinos offering foreign exchange and third party money transfer, awareness and compliance with The Regulations is a continued requirement.
Some of the ML and TF risks associated with MSBs are:
- MSB activities (such as foreign currency exchange) not being implemented correctly or effectively may result in overseas criminally derived funds infiltrating the UK’s financial system and businesses, potentially committing criminal offences by circumventing other jurisdictions’ ML legislation and controls.
- Money transmitters can be used by persons not allowed to work in the UK to send the proceeds of illegal working to other countries.
The use of MSBs has been recognised as high risk in both Her Majesty’s Treasury’s National Risk Assessment (opens in new tab) and our Risk Assessment (PDF) of the money laundering and terrorist financing risks within the British gambling industry (2019 version). Casinos must effectively scrutinise source of funds and source of wealth, and (whilst online casinos continue to offer MSB facilities) mitigations to combat the use of MSB facilities for the acceptance, processing and transfer illicit finance remains a priority.
Reliance on third parties
Gambling businesses are ultimately responsible for compliance with the conditions of their licence. This includes ensuring sufficient customer checks are carried out and that reliance is not placed on any third parties to conduct customer checks.
This includes (for example) relying on banks or any third party payment processors to conduct ‘KYC’ checks or reliance on other gambling businesses to establish source of funds (without further scrutiny) where a customer states that funds are winnings from another gambling business.
Carrying out sufficient customer checks become even more vital where there is a high risk of ML and TF in cases where (for example) a customer is from a high risk jurisdiction, as this will impact on the risk profile of the customer.
Operators should also give due consideration to the ML and TF risks posed by their business to business relations (including any third parties they contract with). Social Responsibility Code Provision 1.1.2 of The LCCP state that:
‘Licensees must ensure that the terms on which they contract with such third parties: require the third party to conduct themselves in so far as they carry out activities on behalf of the licensee as if they were bound by the same licence conditions and subject to the same codes of practice as the licensee’.
Importance of conducting affordability checks and customers occupation
Failure to conduct sufficient customer affordability checks offers opportunities for illicit finance to infiltrate licensees’ financial systems.
Licensees are reminded of the importance of assessing customer affordability when determining risk levels. Disposable income levels must be a starting point for assessing financial benchmark triggers and knowing a customer’s occupation is an important factor in determining income levels and compliments businesses ‘KYC’ knowledge.
Emerging money laundering and terrorist financing risks from June 2020
15 June 2020
Our latest emerging risks bulletin looks at the re-opening of land-based gambling businesses, the new £20 notes; new list of high-risk jurisdictions; increased levels of theft/fraud linked to gambling; vulnerable gamblers; online ID verification and Financial Action Task Force Advice.
Scheduled re-opening of land-based betting shops and arcades on 15th June and the new £20 notes
The recent government announcement of the re-opening of ‘non-essential’ shops on 15th June 2020 includes land-based betting shops.
Gambling businesses are reminded of their mandatory responsibilities under The Gambling Act 2005 (opens in new tab), The Licence Condition and Codes of Practice (‘LCCP’), The Proceeds of Crime Act 2002 (opens in new tab) (‘PoCA’), The Terrorism Act 2000 (opens in new tab) (‘TACT’) and other applicable laws in order to keep crime out of gambling.
Linked to the above point (regarding the re-opening of some land-based businesses), on the 20th February 2020, the Bank of England launched the new polymer £20 note. Although the old paper £20 note continues to be accepted as legal tender, it will eventually be removed from circulation.
During the transition from the paper note to the polymer note, individuals with quantities of the paper £20 note (including notes that may be the proceeds of crime) are likely to try to exchange them before they are removed from circulation.
Where gambling businesses and their frontline staff have knowledge or suspicion of money laundering or terrorist financing involving the old paper £20 note, they must submit suspicious activity reports (SARs) to the UKFIU in the normal way.
More information about the new polymer £20 note can be found on the Bank of England’s website (opens in new tab).
New list of high-risk jurisdictions available
On the 7th May 2020, the European Commission (EC) amended its list containing high risk third jurisdictions with strategic anti-money laundering deficiencies in their regime to include the following:
- The Bahamas
Customers that are associated with high risk third countries (because of citizenship, country of business or country of residence) may present a higher money laundering risk to your business. Licensees are reminded to ensure they have adequate ‘Know Your Customer’ (KYC) and/or customer due diligence checks in place. Additionally, casino businesses are required to conduct mandatory enhanced due diligence (EDD) checks where a customer resides or is situated in a high risk third country. This includes undertaking source of funds and source of wealth checks on the customer as required under The Money Laundering Regulations 2017 (opens in new tab). Please see our guidance for casino and other operators for further information regarding gambling businesses’ legal duties.
Increase in card fraud/theft
There has been a reported increase in card fraud/theft which has then been used for gambling purposes which are the proceeds of crime.
Gambling businesses are reminded to be vigilant on affordability and source of funds for their customers. Where there is knowledge or suspicion of money laundering (including criminal spend) or terrorist financing, a suspicious activity report (SAR) must be submitted to the United Kingdom’s Financial Intelligence Unit (UKFIU) as required under PoCA and TACT. Also, a Key Event must be submitted to the Commission (as required under Licence Condition 15.2.1 (15) of The LCCP) referencing the SAR’s unique reference number (URN).
Vulnerable gamblers seeking to increase self-imposed gambling limits
Licensees must remain vigilant to the increased risk that vulnerable gamblers may seek to break their self-imposed gambling limits because of the current pandemic. Gambling businesses should consider affordability as a starting point for benchmarking customer interaction triggers. Licensees should be vigilant that a customer attempting to spend criminal proceeds or launder money could also be a problem gambler. Patterns of increased spending or spend inconsistent with apparent source of income could be indicative of money laundering but also equally of problem gambling, or both. Licensees are directed towards the Commission’s recently published guidance for online and land-based gambling businesses which shows how they should conduct customer interaction.
Licence Condition 17 of The LCCP and Online ID Verification
Licence Condition 17 of The LCCP came into effect on 7th May 2019 and covers age and verification procedures for online gambling businesses†. The change means that online gambling businesses are not permitted to allow a customer to gamble before they have verified the customer’s identity. This Licence Condition was implemented to improve industry standards by ensuring that ID checks are carried out at the start of the customer relationship and not only at a later stage. This revision is also consistent with The Money Laundering Regulations 2017 (opens in new tab) which requires ongoing monitoring of customer relationships (Regulation 28(11)) and our published guidance which states that risks should be considered at all stages of the customer relationship.
The Commission is reminding online businesses that only verifying a customer’s identity at the point of withdrawal is a high risk policy from a money laundering and terrorist financing perspective and may be in breach of Licence Condition 17, as it means that CDD or EDD checks (if required and applicable only to casinos) or KYC checks (applicable to all other operators) are carried out too late in the customer journey. This poses a risk to the Licensing Objective, ‘keeping crime out of gambling’ along with potential breaches of TACT (Part 3) and PoCA (Part 7) which requires that a SAR is submitted to the UKFIU where there is knowledge or suspicion of money laundering (including criminal spend) or terrorist financing. Failure to do so amounts to a criminal offence carrying a maximum penalty of up to 5 years imprisonment (s.330 and s.331 PoCA).
† With the exception of low frequency or subscription lotteries, gaming machine technical, gambling software, host, ancillary remote casino and ancillary remote bingo.
Advice from the Financial Action Task Force (FATF)
FATF (the global standard-setter for combating money laundering and the financing of terrorism and proliferation) has published a paper (opens in new tab) which identifies the challenges, good practices and policy responses to new money laundering and terrorist financing threats and vulnerabilities arising from the coronavirus crisis.
The Commission is drawing licensees’ attention to this advice paper, advising (where necessary) to revise their ML/TF risk assessment, policies, procedures, and controls in order to mitigate all relevant identifiable risks within their business, as set out by FATF in this paper.
Emerging money laundering and terrorist financing risks from April 2020
COVID-19 emerging risks bulletin - April 2020
Our latest emerging risks bulletin looks at the impact of coronavirus, the importance of checking digital identification and increases in online scams and fraud attempts.
Reminder to all licensed operators: impact of the coronavirus pandemic, and heightened money laundering and terrorist financing risks
The Gambling Commission recognises the major impact the current unprecedented coronavirus crisis is having on affected gambling sectors, including the closure of premises, employees furloughed and loss of business. To assist you in managing the risks this presents to your business, customers and employees, we will continue to advise you about emerging risks that we identify. Businesses will need to consider whether their money laundering and terrorist financing risk assessment needs updating as a result.
Operators are reminded to remain vigilant and comply with the LCCP, The Gambling Act 2005 (opens in new tab) and other relevant laws, i.e. the Proceeds of Crime Act 2002 (opens in new tab), the Terrorism Act 2000 (opens in new tab) and the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (opens in new tab). The Gambling Commission’s guidance to both casino and other operators along with our latest Risk Assessment of The Money Laundering and Terrorist Financing risks within the British Gambling industry (2019 version) will assist licensed operators in mitigating the emerging risks identified below.
Digital ID checks: emerging money laundering and terrorist financing risk
The associated shift to online gambling during the crisis makes it more vital for online gambling businesses to ensure they are carrying out robust digital ID checks upon customer registration. It is therefore even more essential that all operators conduct thorough ‘Know Your Customer’ checks, and customer due diligence checks in the case of the casino sector, to ensure they are not dealing with illicit funds.
Operators also need to have adequate customer risk profiles in place to ensure all potential money laundering and terrorist financing risks have been considered, and that operators consider making suspicious activity reports to the National Crime Agency in the following cases:
- Organised Crime Groups have sought to exploit the current situation through finding new ways to obtain money or monetary equivalents e.g. through the sale of essential healthcare equipment, the proceeds of which could be used for gambling purposes. Source of fund and ‘Know Your Customer’ checks (as well as customer due diligence checks for casinos), will be vital in detecting suspicion or knowledge of money laundering or terrorist financing; and
- There have been reported increases in ‘illegal money lending’ and fraud, with the risk that problem gamblers could resort to funding their gambling activities through these mechanisms, making affordability and source of funds checks of paramount importance in identifying increased risk of money laundering and terrorist financing.
There is evidence suggesting gambling affiliates are exploiting the coronavirus pandemic to encourage gamblers to spend more money on gambling activities. Operators are reminded:
- To have robust social responsibility provisions in place, as problem gambling and the use of the proceeds of crime (i.e. stolen money) to gamble can in some cases be co-dependent risk factors;
- To conduct due diligence checks on any third-party companies being used in reliance on an operator’s licence (LCCP Code Provision 1.1.2; and
- That all marketing must be undertaken in a socially responsible manner and must not encourage customers to spend more than they can afford, and therefore discourage proceeds of crime being spent by customers (LCCP Code Provision 5.1.6).
In addition to customer checks, operators are reminded that it is important to carry out sufficiently robust background checks on employees, referred to as ‘Know Your Employee’ checks.
Cryptoassets and prepaid cards: emerging money laundering and terrorist financing risk
The coronavirus crisis has seen criminals seeking to exploit the situation with an increase in cyber-attacks, along with the increased use of digital payments (such as cryptoassets and online prepaid cards, also known as vouchers). There are reports of more online scams and fraud targeting vulnerable people. This presents a high money laundering and terrorist financing risk to the gambling industry, as criminals will seek different ways to dispose of and use illicit funds from this fraudulent activity.
The current situation has also seen increased use of digital methods, such as cryptoassets and prepaid cards, as a form of customer payment. Cryptoasset transactions are attractive to criminals as they are fast, convenient and can be carried out anonymously. Evidence shows there is a high risk of ‘smurfing’ with the use of prepaid cards, and there is evidence that this money has then been used for gambling.
Both methods of payment (cryptoassets and prepaid cards) are viewed as high risk from a money laundering and terrorist financing perspective, and operators are reminded of the need to conduct thorough source of funds and source of wealth checks (where applicable), in order to keep crime out of gambling. Operators are reminded that it is even more vital that they should also submit suspicious activity reports (SARs) where there is knowledge or suspicion of money laundering (including criminal spend) or terrorist financing. When submitting a SAR, a Key Event should also be made to the Gambling Commission in accordance with Licence Condition 15 of the LCCP.
Operators are reminded of their responsibilities under Licence Condition 12.1.1 (1), which requires licensees to review their money laundering and terrorist financing risk assessments upon the introduction of new products or technology or new methods of customer payment.
Operators are also reminded that it is mandatory to submit a key event to the Commission under Licence Condition 15.2.1(8) where there are any changes to the methods by which, and/or the payment processors through which, the licensee accepts payment from customers using their gambling facilities. When notifying the Commission under Licence Condition 15, we expect the following information to be provided as a minimum:
- the type of payment method;
- the provider; and
- how the payment method was assessed in the operator’s money laundering and terrorist financing risk assessment.
If the payment method relates to cryptoassets:
- are cryptoassets being accepted directly or through a third party, if so who?
If cryptoassets are being accepted directly:
- how fluctuations compared to fiat currency will be dealt with (with regards to responsible gambling tools, AML triggers, etc);
- what information has been provided to consumers to ensure they are aware of the risks associated with using cryptoassets as a payment method and;
- how the funds will be treated in the event of insolvency and how customers will be informed of this.
‘Money mules’: emerging money laundering and terrorist financing risk
An increase in online scams and fraud targeting vulnerable people has seen illicit funds being transferred through third party bank accounts (‘mule’ accounts), to break the audit trail of transactions and complicate any investigation. There is evidence that ‘mule’ accounts have been used for gambling purposes by money mules, with mainly vulnerable individuals targeted.
Operators are reminded to be alert to this. A red flag indicator for this activity is the opening of a gambling account with a minimal deposit initially, which is soon followed by several larger deposits and withdrawn to an increased amount of accounts. This makes it even more vital for operators to conduct thorough source of funds and source of wealth checks (where applicable), as well as customer ID checks upon customer registration, as required under Licence Condition 17 (applicable to remote operators only).
Where appropriate, licensees should consider obtaining their own legal advice regarding the emerging risks discussed here.
For any further assistance please contact us.