Key Takeaways
- US casinos and online gaming operators must comply with federal Bank Secrecy Act (BSA) rules and follow state-specific gaming mandates.
- Recent heavy enforcement from state regulators punishes weak identity protocols that allow multi-accounting, fake identity usage, or stolen payment methods.
- State regulatory frameworks are shifting toward personal executive liability, direct licensing for compliance officers, and zero anonymity for high-stakes funding sources.
- Manual onboarding can’t deliver 100% compliance across borders. Operators need automated technology stacks with biometrics, multi-factor document authentication, and dynamic geolocation verification to ensure full compliance.
Legal sports betting and online gaming are a multibillion-dollar enterprise, leaving the extremely lucrative industry a target for fraud and money laundering schemes. To stay above board, operators meet AML/KYC gambling regulations.
The gaming industry is unique because it answers to two authorities: state laws and federal agencies. Federal agencies track high-value transactions, but individual state gaming boards oversee day-to-day operations, account sign-ups, and regional restrictions.
The challenge is knowing which state and federal regulations to follow.
Give your business the boost of a fully automated, KYC process. No geographical limits and fast, frictionless onboarding verification processes enhance customer’s experience.
Why AML/KYC Compliance Matters for US Gaming Operators
Though potentially inconvenient at the outset, Anti-Money Laundering (AML) and Know Your Customer (KYC) protect operators from fines, shutdowns, and reputation damage. Compliance is both a legal requirement and a core component of risk management,, and looks different at the federal level vs. the state level.
At The Federal Level
At the federal level, the Bank Secrecy Act (BSA) classifies physical casinos and card clubs that generate over $1,000,000 annually as financial institutions. The BSA applies to high-volume chip transactions, digital wagering wallets, and markers with the same scrutiny as bank deposits, wires, and traditional loans.
Under federal law, all gaming businesses need to run (and have in writing) an AML program with specific core elements:
- Customer Identification Programs (CIP): Verifies the name, DOB, address, and SSN or taxpayer ID before high-value transactions, issuing credit, or opening wagering profiles
- Currency Transaction Reports (CTRs): Any physical currency transaction of more than $10,000 in one day (including cash deposits, chip redemptions, etc) must be reported
- Suspicious Activity Reports (SARs): If funds look structured in a way that could bypass reporting, or if transactions aren’t business-related, operators must file a SAR immediately
At The State Level
While federal law tracks financial crime at a high level, state gaming commissions oversee user onboarding, age verification, and initial funding access.
Translation: Operators must create programs that meet federal reporting standards and relevant state processes for onboarding and account monitoring.
If casinos operate in multiple states, they need to follow each state’s regulations and the federal guidelines.
Federal Baseline: BSA Requirements for Casinos and Online Gaming
Core State Compliance Requirements
Some regulations are up to the state, but other requirements are the same throughout the US, including:
- Age verification: Some states set the participation age to 18, but most states require players to be 21+. Operators must verify age during registration and conduct ongoing monitoring.
- Identity verification and KYC: Gaming entities must verify government IDs, match the person to the identity, and validate the information. Many states require biometric verification with selfie matching with liveness detection.
- AML compliance: Screening against sanctions lists, looking for suspicious transaction patterns, and reporting when thresholds exceed the limit are all part of AML compliance.
- Geolocation verification: Check that players are located within state boundaries using GPS, IP analysis, and other methods.
- Responsible gaming measures: Protects players with deposit limits, time-based restrictions, and access to gambling addiction resources.
- Self-exclusion programs: Integrates with state databases to prevent excluded individuals from creating accounts.
Give your business the boost of a fully automated, KYC process. No geographical limits and fast, frictionless onboarding verification processes enhance customer’s experience.
Federal Regulations and Industry Standards
States lead gaming regulation, but operators must also follow federal laws, such as:
- The Indian Gaming Regulatory Act (IGRA): A federal law that establishes the legal and regulatory framework for gaming on Native American lands. Its main purpose is to increase tribal economic development, self-sufficiency, and strong tribal governments.
- The Unlawful Internet Gambling Enforcement Act (UIGEA): Prohibits accepting payments connected to illegal internet gambling and other payments forbidden by UIGEA.
- The Bank Secrecy Act (BSA): Establishes federal AML requirements like customer due diligence, suspicious activity reporting, and recordkeeping.
- The Wire Act: Forbids certain betting activities over interstate wires. Operators must ensure all gaming activity occurs within individual state boundaries.
State-by-State AML/KYC Requirements for Gaming Commissions
Every state has its own regulations, creating a compliance environment patchwork across jurisdictions. Here’s a look at the key KYC/AML requirements, online gaming legality, notable enforcement actions, and recent rule changes.
New Jersey (Division of Gaming Enforcement)
- Regulator: New Jersey Division of Gaming Enforcement (DGE)
- What’s Legal: Online sports betting, online casinos (iGaming), and retail casinos
- Minimum Age: 21
- Key Requirements: Identity verification at registration, ongoing monitoring, AML screening, programs that track gambling addictions, and audit-ready recordkeeping.
- Notable Actions/Changes: The DGE created stricter rules around online payment methods to combat identity fraud.
Nevada (Nevada Gaming Control Board)
- Regulator: Nevada Gaming Control Board (NGCB) and Nevada Gaming Commission (NGC).
- What’s Legal: Retail casinos, retail sports betting, and mobile sports betting; online casinos (iGaming) are restricted.
- Minimum Age: 21
- Key Requirements: Nevada requires extensive personal history evaluations, detailed background checks, ongoing audits, identity verification for transactions, and AML compliance.
- Notable Actions/Changes: The Nevada Gaming Commission recently passed strict new anti-money laundering rules:
- The chief compliance officer needs an official license from the state that holds them accountable if things go wrong.
- The new laws completely ban fake companies, hidden organizations, and corporate bank accounts from giving money to players.
- Operators are expected to implement stronger source-of-funds due diligence and enhanced oversight of high-risk patron funding activity
- Licensees must notify the board within 10 business days if a gaming employee is terminated for intentional AML policy violations.
Pennsylvania (Pennsylvania Gaming Control Board)
- Regulator: Pennsylvania Gaming Control Board (PGCB)
- What’s Legal: Retail casinos, online sports betting, and online casinos (iGaming)
- Minimum Age: 21
- Key Requirements: Digital validation at registration and on an ongoing basis, multi-factor authentication for account access, immediate integration with state exclusion databases, financial transaction monitoring, and comprehensive audit trails
Michigan (Michigan Gaming Control Board)
- Regulator: Michigan Gaming Control Board (MGCB)
- What’s Legal: Retail casinos, online sports betting, and online casinos (iGaming)
- Minimum Age: 21
- Key Requirements: Automated checks for all remote registrations, identity verification with government-issued IDs, selfie, address, and geolocation verification, and AML compliance screening
- Notable Actions/Changes: Sweeping enforcement that eliminated 45 offshore gambling operators that have been illegally offering online casino games and sports wagering to Michigan residents
New York (New York State Gaming Commission)
- Regulator: New York State Gaming Commission (NYSGC)
- What’s Legal: Retail casinos and online sports betting; online casinos (iGaming) are restricted.
- Minimum Age: 21
- Key Requirements: Multi-layered identity verification with multiple touchpoints, AML compliance, geolocation, and detailed reporting
- Notable Actions/Changes: The NYSGC frequently updates its marketing and advertising compliance rules so compliance systems avoid targeting minors or self-excluded individuals
Illinois (Illinois Gaming Board)
- Regulator: Illinois Gaming Board (IGB)
- What’s Legal: Retail casinos and online sports betting; online casinos (iGaming) are restricted.
- Minimum Age: 21
- Key Requirements: Rigorous digital identity checks, clear audits, strict AML protocols, and continuous surveillance monitoring
- Notable Actions/Changes: Strict oversight of video gaming terminals (VGTs), requiring multi-layered transaction monitoring
Colorado (Colorado Limited Gaming Control Commission)
- Regulator: Colorado Division of Gaming and Limited Gaming Control Commission
- What’s Legal: Retail casinos and online sports betting; online casinos (iGaming) are restricted.
- Minimum Age: 21
- Key Requirements: Identity validation instantly at registration, direct data links with state-managed gaming networks for self-exclusion integration and prohibited participant lists, and geolocation verification.
Connecticut (Connecticut Department of Consumer Protection)
- Regulator: Connecticut Department of Consumer Protection (DCP) Gaming Division.
- What’s Legal: Retail casinos, online sports betting, and online casinos (iGaming) through tribal partnerships.
- Minimum Age: 21
- Key Requirements: Partnerships with tribal gaming authorities, secure onboarding systems with strong identity verification capabilities, including liveness detection.
What Technology Operators Need to Meet Gaming KYC Requirements
To keep up with changing regulations and complex state and federal rules, operators need advanced technology that can stop financial crime right away and provide an easy, user-friendly experience. Casino KYC requirements include:
Document Authentication Engine: AI-driven document authentication that can verify government-issued IDs, driver’s licenses, and passports, and screen for fake documentation.
Biometric Liveness Detection: Facial matching technology that compares a real-time selfie against the credential photo, using passive liveness testing to thwart attacks, masks, and digital deepfakes.
Regulatory compliance: Strict adherence to KYC, AML, and age verification laws across jurisdictions, such as BSA, age verification, and more.
Database Verification Networks: Instant cross-referencing of player PII against credit bureaus, utilities, government databases, and AML/PEP watchlists to confirm age, address, and risk profiles.
Dynamic Geolocation Tracking: Advanced spoof-resistant software that regularly assesses a user’s physical location to comply with state-border betting limits.
Retail vs. Online Compliance Channels
Technologies will also depend on the consumer touchpoint:
Compliance Dimension | Retail Channels | Online / Mobile Channels |
First Interaction | In-person contact at the cage, table game, or kiosk | Remote registration via mobile application or web browser interface |
ID Verification Method | Physical document scanner using UV/IR imaging or AI software | Digital capture of credentials/gaming ID verification uploaded via a smartphone camera |
Liveness Assurance | Visual validation in real time and/or ID-scanning system with a live camera feed and facial recognition software that snaps a live photo, pairs it with ID data, and logs it for record keeping | Automated biometric facial matching using liveness detection software |
Transaction Monitoring | On-floor surveillance cameras and manual tracking of cash buy-ins and chip counts | Real-time automated data tracking of digital deposit sources, device IDs, and IP addresses |
How AU10TIX Supports Online Gambling Verification Compliance
As regulations evolve, AU10TIX helps operators stay ahead with a fast, fully automated verification architecture that can handle large volumes without leaving gaps and exposing companies to regulatory or financial risk. AU10TIX also supports gaming identity verification compliance with:
- Document Authentication: AU10TIX detects and blocks fake, tampered, or counterfeit documents in real-time using fraud detection algorithms.
- Liveness Detection: By comparing document photos against user-friendly biometric liveness testing, AU10TIX ensures the credentials owner is physically present.
- Age verification: Advanced algorithms and real-time scanning analyze government-issued IDs to determine customer age.
- Automated High-Volume Onboarding: AU10TIX delivers automated verification results in seconds.
Give your business the boost of a fully automated, KYC process. No geographical limits and fast, frictionless onboarding verification processes enhance customer’s experience.
FAQ
Are online gaming operators subject to the same AML rules as brick-and-mortar casinos?
Yes. Under federal guidelines, any mobile sportsbook or online casino platform considered a licensed entity must follow the Bank Secrecy Act and FinCEN mandates as physical properties. This includes writing and following AML compliance programs, using proper customer identification protocols, monitoring accounts, and reporting suspicious financial patterns.
What triggers a SAR filing requirement for a gaming operator?
A Suspicious Activity Report (SAR) is triggered when an operator detects a transaction or transactions of $5,000 or more that appear irregular. Triggers are attempts to evade federal currency reporting via smaller deposits, the casino is used to carry out criminal activity, using stolen payment credentials, or making use of unverified third-party funds.
How do casino KYC requirements differ from state to state?
While federal identity verification baselines do not vary, individual states create and enforce localized operational rules. State variations include differing legal ages, mandates around self-exclusion databases, unique regional reporting metrics, and rules regarding the payment channels that can fund an active profile.
What age verification methods are acceptable for online gambling verification?
Acceptable age verification relies on multi-source automated checks. Online platforms must analyze date-of-birth records from valid, government-issued photo credentials using automated extraction software, and cross-reference that data against national credit networks, utility registries, and government records to guarantee the user is of legal age.
How do gaming identity verification systems handle players from multiple states?
Multi-jurisdictional verification uses dynamic, real-time geolocation fencing. As a player moves across state borders, automated verification systems evaluate their current geographic location against state regulatory engines, immediately factoring in platform boundaries, rules, and compliance parameters relevant to each jurisdiction.
