For many gaming and fintech operators, AML/CFT compliance becomes concrete when a payment processor asks who owns the program and where the policy and operating evidence are. The exact request depends on the business model and provider, but missing documentation or unclear responsibility can delay approval. It is better to define the program before an onboarding review begins.

The good news is that this is a solvable problem, and solving it well does more than unblock a processor. It protects the business from the real regulatory exposure that comes with moving other people’s money.

Why money in and out triggers AML/CFT in the first place

Money laundering is the act of moving illicit funds through legitimate-looking transactions until the money looks clean, and the same controls also help counter the financing of terrorism, which is why the field is usually called AML/CFT. Any platform where funds flow in and back out, deposits and payouts, entry fees and prizes, is a potential channel for that, whether the operator intends it or not. Whether a federal AML program rule applies depends on what the operator is. Casinos above the regulatory revenue threshold, money services businesses, and other defined financial institutions are directly covered, while many sweepstakes, skill-gaming, and fintech platforms are not automatically covered but may still be required or asked to maintain AML/CFT-style controls by banks, payment processors, state regulators, or other partners. The applicable duties and reviewer expectations depend on the operator. Casino and gaming AML practices have also been the subject of federal and state enforcement when required programs or controls fell short.

The operator remains responsible for the program and for the accuracy of information supplied to processors, regulators, and other reviewers. An outside advisor or officer does not transfer that responsibility.

The five pillars, in plain English

Strip away the jargon and a credible AML/CFT program comes down to five things that regulators and processors look for, where a program is expected:

• A written policy. A real document that describes how your platform handles identity and money, not a template with someone else’s name still in it.
• A designated compliance officer. A named person with the experience and authority to own the program and answer for it.
• Internal controls and monitoring. Customer identification, due diligence, sanctions screening, and watching transactions for activity that does not add up.
• Training. The people running the platform need to know what to look for and what to do when they see it.
• Independent testing. A periodic, outside-eyes check that the controls actually work, which is also what partners often ask to see.

What this looks like for gaming and sweepstakes specifically

In gaming, sweepstakes, and similar platforms, AML/CFT controls may include identity and age verification, geolocation, sanctions screening, transaction monitoring, account controls, and documented funds flows. The required combination depends on the operator, jurisdiction, and payment model. A written policy should assign responsibility, explain how each control operates, and identify the evidence retained for review.

When Outsourced Compliance Officer Support Can Fit

Some operators use an outsourced or fractional compliance officer when applicable law, the regulator, and commercial counterparties permit it. Other regimes may require an employee, licensed individual, local presence, or different reporting line. The operator remains responsible in every case. A written engagement should define the officer’s authority, hours, duties, access to records, reporting line, and escalation obligations.

How BCA fits

BCA helps operators establish and maintain AML/CFT programs. That can include policy drafting, control documentation, processor or regulator review support, and named compliance-officer services under a retainer agreement. When a review is needed, BCA can run technical control and readiness reviews of your KYC, geolocation, AML/CFT, and financial controls and document the findings in a technical certification letter for your partners. A formal independent AML/CFT test is kept separate: where one is required, BCA coordinates with or prepares materials for an independent reviewer rather than testing a program it runs or wrote.

This is built on hands-on experience: more than two decades designing, building, and auditing the KYC, AML, and geolocation systems that gaming and fintech platforms depend on, including data review for anti-money-laundering purposes at the Bahamas Gaming Board and oversight of casino gaming reporting as a tribal gaming CIO. BCA is a compliance and business advisory firm, not a law firm, so when a question needs a legal opinion it goes to attorney Rich Newman of Newman Law, of counsel to BCA, who also serves as Nevada registered agent for operators incorporated in the state. For tax and accounting questions that go beyond general guidance, BCA draws on the licensed tax professionals and advisors associated with the firm. Legal advice comes from Newman Law through BCA, alongside BCA’s compliance and technical work, so the engagement stays coordinated.

If a processor or partner has asked you who your compliance officer is, or if you would rather answer that question before anyone asks it, that is the right time to talk.

Educational information only, not licensed legal, tax, or financial advice. BCA coordinates with licensed professionals when personalized advice is needed. Laws change; no warranty of accuracy or timeliness.

Sources

• FFIEC BSA/AML Examination Manual
• 31 CFR 1010.100, Bank Secrecy Act definitions, including the casino and card club threshold
• 31 CFR 1021.210, anti-money-laundering program requirements for casinos and card clubs
• 31 CFR 1022.210, anti-money-laundering program requirements for money services businesses
• IRS, reporting requirements for casinos (Title 31, CTR and SAR thresholds)
• Thomson Reuters, Building a Gaming Compliance Program
• Brownstein Hyatt Farber Schreck, Federal and State Regulators Increase Scrutiny of Casino AML Practices (2024)