Casino AML operations: from risk assessment to a reviewable case

A reviewable case checklist

Avoid including unnecessary identity-document contents in general dashboards or broad operational exports.

Begin with the business-specific risks

The Gambling Commission’s October 2025 casino casework bulletin describes shortcomings in risk assessment, customer profiling and ongoing monitoring. It warns against relying on financial thresholds alone where other risk factors are present. Treat this as evidence about British casino supervision. Do not convert a threshold copied from another operator into a safe harbour for your own business.

Gambling Commission — Casino AML casework trends, October 2025

Translate the assessment into observable controls

Our proposed mapping starts with a risk scenario, the information available to detect it, a responsible team and an action. Include the relevant products, locations, payment methods and business relationships. Record which risks cannot be assessed because data is missing. A generic policy saying “monitor unusual behaviour” is not an executable instruction: an analyst needs the context to investigate and a route to escalate uncertainty without silently closing the case.

Separate identity from the wider customer picture

Knowing that a document belongs to an applicant answers a different question from understanding the customer relationship and activity. NIST’s identity-proofing framework explicitly separates proving identity from deciding entitlement to a service. In an AML workflow, keep evidence of identity, business-specific risk assessment and subsequent monitoring decisions distinguishable. Avoid treating a vendor identity-pass response as blanket evidence that all due diligence is complete.

NIST SP 800-63A-4 — Scope of identity proofing

Build a case that another reviewer can reconstruct

Use the case reference to connect the triggering event, relevant customer information, transaction chronology, documents considered and analyst reasoning. Distinguish what was observed from what was inferred. When evidence is inconsistent, record the discrepancy and how it was resolved rather than attaching documents without an assessment. Preserve the controls on sensitive case information. Any reporting decision belongs to the designated compliance function under applicable requirements, not to an automatically generated narrative.

Test the hand-offs before volume arrives

Rehearse a case that spans payments, customer support and compliance. Establish who owns the next action, which account restrictions are authorised, how deadlines are monitored and what the customer can appropriately be told. An alert can be technically delivered while remaining operationally unowned. The test is complete only when the final disposition and rationale are recorded and the correct teams receive the outcome.

Measure review quality as well as throughput

Our recommended dashboard shows open cases by age and risk category, overdue actions, repeated requests, quality-review findings and the reasons cases are reopened. Sample both escalated and closed cases. A falling alert count is not automatically improvement: it can reflect changed coverage or a failed data feed. Record rule and model versions, investigate gaps and review whether controls still address the original risk scenarios. Use those findings to revise training and controls, with accountable sign-off.