Melissa Gomez Nelson reminded attendees of Global Gaming Expo (G2E) that regulators fined casinos $34 million September alone.
“That’s what regulators collected from casino ownership in response to investigations related to AML (anti-money laundering) and KYC (know-your-customer) concerns, said Nelson, a partner with Dentons US, during a panel discussion titled “Identifying and Managing Emerging Financial Crime Risks.”
The casinos weren’t identified but suffice to say that damage was done. One casino allowed a man to gamble on 80 separate days without verifying his source of funding. Another was fined for systemic AML oversight weaknesses and historical weaknesses. Despite receiving a tip, another casino was fined for allowing a man to gamble despite designating him a high-risk gambler.’
“This is obviously a concerning issue because there were a lot of red flags that were flagged and issues that were raised within the operators’ organizations,” Nelson said.
Abigail Singley, PwC advisory director, said because enforcement actions have recently been loosened, it’s no longer about having the “pillars of an AML program in place on paper.
“It’s really about being able to demonstrate and implement a true risk-based program that’s effective in identifying and ultimately actioning on risk to the operator.”
Elise Lebourg, Ernst & Young senior manager of Forensics & Integrity Services, noted that too many AML and KYC programs have devolved into pulling out a binder, checking a few boxes, and then closing it until the next time anyone asks to show evidence that certain goals and protocols have been met.
But that’s not really true risk assessment.
“It’s understanding that yes, it’s risk, but is your assessment of that risk accurate?” Lebourg said. “Is it moving with your product road map or are you just arbitrarily updating your risk assessment spreadsheet
DraftKings Vice President, AML Officer Dave Foppert said that during the last year AML policies have been diminished. Instead of being exemplary, they meet minimum requirement.
“I think we’ve all seen this over the last 12 months, where having a policy is the floor, not the ceiling,” Foppert said. “Of course you have to have a policy, but where regulators, whether they be at a state or federal level, are really honing in and focusing on is the effectiveness of that program, and from my perspective, at least, I think a core function of that is partnership with the business.
“I think in some of the case studies that we’ve seen come to life over the last 12 months, oftentimes there were breakdowns between different organizations within a single gaming operator casino.
“To me, to have that really effective program, you need to have a strong communication partnership between your compliance organization and your marketing team, your product team, your customer team, who’s talking and working with those customers every day. And what we saw with the enforcement actions in many ways was a breakdown of that.”
Lebourg said she starts with risk assessment because that’s the foundation of these procedures. The gaps that appear are because risk assessment isn’t updated, and more importantly, companies don’t know what to do with the output.
“Just figuring that out, understanding that okay, if this is what my residual risk is, what am I actually doing with that and packaging it up in readable format for the business to go ahead and implement?” Lebourg said. “A lot of times we see compliance build these beautiful risk assessments, but the output isn’t something that’s digestible or punchyfor a line of business to go and implement and improve upon.”
