Gambling operators across Britain should take a fresh look at AML provisions

David Heffron and Marie Chowdhry, financial regulation experts at Pinsent Masons, were commenting after the Gambling Commission published its money laundering and terrorist financing risk assessment for 2026, an update to its 2023 risk assessment. The publication incorporates developments identified by HM Treasury and the Home Office in the UK’s 2025 national risk assessment of money laundering and terrorist financing (163 pages/2.54MB PDF). The document is intended to help licensed operators understand current money laundering and terrorist financing risks within the British gambling industry and support the development of their own risk assessments, according to the Commission.

The regulator has linked the publication directly to operators’ existing compliance obligations. Under Licence Condition 12.1.1, gambling businesses must assess the risk of their operations being used for money laundering or terrorist financing and take account of relevant guidance and learning published by the Commission. The Commission has made clear that operators are expected to consider the sections of the assessment relevant to their business, update their risk assessments where necessary, and review associated policies, procedures, and controls.

The publication applies across the licensed gambling sector, including remote operators and land-based businesses. For casino operators, however, the assessment carries additional significance because of specific obligations under the Money Laundering Regulations 2017, which require licensees to take the Commission’s risk assessment into account when conducting their own financial crime risk assessments.

Heffron said: “The publication of the updated risk assessment is more than a routine regulatory update. The Commission has expressly reminded operators that they are expected to take account of the assessment when reviewing their own risk frameworks and compliance controls. Businesses should approach the publication as an opportunity to test whether existing controls remain fit for purpose in light of evolving threats and regulatory expectations.

“Operators should avoid treating the publication as a standalone piece of guidance. Instead, businesses should undertake a documented review of their existing AML and CTF risk assessments, identify any areas where risk ratings or emerging threats have changed, and ensure that corresponding policies, procedures, and customer due diligence measures remain appropriate."

The Commission’s notice reinforces that expectation, stating that licensees should consider how the risks identified apply to their businesses, update risk assessments accordingly, and use the risk ratings contained in the document to inform their analysis. Operators must also review and update policies, procedures and controls where changes to risk assessments are required.

Chowdhry said: “For casino operators in particular, the assessment carries additional significance, given the specific obligations under the Money Laundering Regulations 2017 and the Commission’s supervisory role. Businesses should be prepared to demonstrate not only that they have reviewed the updated assessment, but also the steps taken to implement any resulting changes.”

Chowdhry, who is based in the UAE, added: “Although the Commission’s risk assessment is focused on the UK gambling sector, many operators today operate across multiple jurisdictions, payment channels and customer segments. As a result, firms should ensure that their AML and CTF frameworks are not only aligned with UK regulatory expectations but are also capable of addressing wider international financial crime risks, including the use of cross-border payment arrangements, digital onboarding processes and increasingly sophisticated customer activity patterns.

“The themes highlighted by the Commission are consistent with the broader direction of travel being seen across financial services and other regulated sectors globally, where regulators are placing greater emphasis on documented, risk-based controls, governance and demonstrable outcomes. Given our work advising regulated financial institutions, payment service providers and other businesses on financial crime compliance, we are seeing many of the same challenges and supervisory expectations emerge across different sectors and jurisdictions.”

The Commission has similarly emphasised that casino operators should maintain records of steps they have taken to identify and assess money laundering and terrorist financing risks and be able to demonstrate the measures implemented following any updates. The regulator said changes should be made in a timely manner, while recognising that updates to risk assessments and compliance frameworks may require internal approval processes.

The latest assessment also sits within a broader programme of AML-related regulatory activity so far this year. "The publication continues the Commission's recent focus on AML compliance, following other regulatory developments this year, including updated guidance relating to money laundering regulations, money service businesses, and digital identity verification. Operators should therefore view this update as part of a broader trend towards increased regulatory scrutiny of financial crime controls across the gambling sector,” said Chowdhry.

By explicitly linking the document to existing Licence Condition 12.1.1 requirements and, for casinos, obligations under the Money Laundering Regulations 2017, the Commission has signalled that businesses are expected to review their risk frameworks, assess the relevance of the updated findings and document any resulting changes to their AML and CTF controls, she said.