By their very nature, casinos deal with large volumes of money, rendering them uniquely vulnerable to abuse by those seeking to launder ill-gotten gains. Like all financial institutions, casinos have always been required to monitor and detect suspicious activity and file the appropriate reports with the Financial Crimes Enforcement Network (FinCEN).
Last year, several prominent casinos faced stiff penalties and were required to strengthen their risk management and anti-money laundering (AML) procedures for reporting suspicious activity. This year, the trend is expected to continue. Regulators will increasingly look at a casino’s AML program to determine if there are truly effective controls, policies, procedures and technology in place to detect and prevent “high rollers” from laundering funds.
Regulators are placing more emphasis on whether senior casino executives maintain a strong “tone at the top” that makes compliance a true priority in the corporate culture. From a risk management perspective, casinos would be wise to develop and implement programs to ensure that all employees fully understand their institution’s AML obligations.
A casino’s board ought to be part of this process and be asked to sign off on an AML compliance program. Just as important, casinos need to put in place well-trained compliance staff members to constantly monitor and mitigate the risks associated with money laundering. Regulators will expect nothing less.
If not already in place, casinos should also design and implement an AML risk assessment. A solid risk assessment needs to identify the casino’s inherent AML risks, with particular emphasis on risks associated with products, geographies, transactions and customer characteristics. It is important to perform the risk assessment annually or in conjunction with material changes in the business.
At a minimum, the risk assessment methodology needs to include five key action items:
• Identify the business segments, business units and support functions to be assessed.
• Determine the scope of applicable AML rules and regulations that apply to each business segment, business unit and support function.
• Score the inherent risk factors and control strength factors.
• Generate inherent risk and residual risk heat maps.
• Document the risk assessment narrative for each business segment, business unit or support function.
A review of existing technology should also be a major focus for compliance and risk management teams. Historically, systems utilized by the gaming industry to detect suspicious behavior have not been held to the same rigorous standards as in the banking industry. Investments may be required and additional data may need to be captured to ensure that a casino is properly monitoring and detecting suspicious activity.
Whether it is home-grown or off-the-shelf, the technology selected should be able to detect suspicious or unusual patterns of transaction activity and identify certain high-risk geographies and/or individuals. Risk scenarios and parameters need to be constantly evaluated and tested to ensure that the appropriate thresholds are in place for the risks identified by the risk assessment process.
Given the increased regulatory scrutiny, it is more important than ever that a casino’s AML program be designed and implemented with a risk-based approach in mind. Once an appropriate program is in place, it is just as critical to implement an independent testing function to ensure that the controls are working as designed. A robust independent testing program should ensure proper documentation of the scope of testing, the review process, weaknesses identified, and the corrective actions needed to address them. Rest assured that AML regulators will review an independent testing program to determine if it is comprehensive and overseen by individuals who understand AML and the relevant Bank Secrecy Act regulations.
Even with the best programs and technologies, casino employees will always be on the front line for detecting suspicious behavior. Casinos must hold their employees directly accountable for AML compliance, so an ongoing training program is critical for effective risk management.
For instance, policies that offer employee incentives based on high-roller customer activity may encourage the wrong behavior and should be reviewed. Conversely, bonuses tied to compliance efforts are likely to be viewed favorably by regulators and should be encouraged.
The controls and strategies described above are just a few of the considerations for a casino to address AML risks within its global organization. As regulators continue to intensify their review of these organizations, we can expect to see more casinos struggle with AML compliance.
Ready or not, one thing remains certain: the regulatory environment for casinos has changed and will likely continue to change throughout the year. Casinos would be well advised to begin adjusting now to this new reality. This will help them avoid the steep penalties and reputational damage that will surely result from failing to do so.