FinCEN, which has approximately 340 employees, oversees enhancing the integrity of the U.S. financial system by facilitating the detection and deterrence of financial crime. FinCEN is responsible for regulating the banking system, money service business, insurance industry, precious metal dealers, securities and future brokers, mortgage companies, card clubs, and casinos.

Operators must consider the most important items related to casino Title 31/AML compliance, which include:

  1.  A strong culture of compliance.
  2. Assessment of current Title 31/AML Compliance Program.
  3. Ensuring proper due diligence procedures including triggers for enhanced due diligence.
  4. A proper and adequate training program.
  5. Adequate independent testing that consummates with the Title 31/AML risk at your casino.

While there are many other items to consider, these five are very important and inter-relate to other pertinent compliance measures.

The culture of compliance can be defined as the “tone at the top” when it comes to Title 31/AML-related issues. In fact, a lack of a culture of compliance has been cited in several of the FinCEN enforcement actions in recent years. Elements of a strong culture of compliance include: leadership devoting adequate resources; leadership supporting and understanding compliance efforts; sharing relevant information; effective testing by independent and competent specialists; and understanding of the purpose (source). If a casino does not have a strong culture of compliance, it is highly likely the casino will have inadequacies in its compliance program. Profit over procedures is the ultimate sign of a weak culture of compliance.

When an auditor comes to a casino to complete a Title 31 risk assessment, audit, or agreed-upon procedures, one of the first items they will want to see is the casino’s most current Title 31/AML compliance program. If this hasn’t been updated in years, it is almost certain the program has problems and gaps. FinCEN speeches, enforcement actions, and other industry guidance is issued on an almost monthly basis, and the relevant content in these issuances need to be considered in a casino’s Title 31/AML compliance program.

Ensuring a casino has proper due diligence procedures including triggers for enhanced due diligence procedures is an area that several casinos struggle with. Like all elements of a Title 31/AML compliance program, due diligence procedures need to be considered with a risk-based approach. It is important to remember that criminals use casinos for enjoyment, not always with the intent to launder money, and that needs to be considered in your procedures. In fact, the number one risk for most casinos is criminals using a casino for enjoyment. It is not acceptable for operators or casino team members to bury their heads in the sand or look the other way. Ensuring casinos know their top and riskiest customers is the first step in proper due diligence. The tools are available to set up risk-based due diligence procedures, with the use of player card data, the marketing department, player hosts, databases, and other resources the casino may have.

A casino may have a great Title 31/AML compliance program, several high-priced back-of house technology systems, and procedures in place. Although if proper training for the front-line employees and users of the systems are lacking, the exposure will be noted in any audit or proper independent testing. Casinos must ensure that training is specific for new hires, different departments, and management as everyone will be at different experience levels and have different training
needs. Operators and compliance officers may consider using a risk based approach when considering which employees should have training, what type of training, the frequency of the training, and testing requirements after completing the training. To do this properly, authority level, primary job tasks, time spent on the gaming floor, and cash handling should be considered. From this process, a casino should be able to ensure training materials and testing requirements are unified and aligned with the employee’s position and level of risk within the organization.

Using 100% manual training is not usually as efficient as using an online training product. If properly set-up and utilized, this will save time and money for tracking and eliminate most of the manual processes. Before making this change, a casino needs to consider the resources available, who will champion
the project, as well as the computers and space to properly administer the online training. The best model for training is a mix of live and a trusted online training product that aligns with the risks within the casino.

Cantor Gaming (CG Technology), Hawaiians Gardens, Sparks Nugget and Caesars gaming enforcement actions – all noted insufficient independent testing of their AML program. In fact, several enforcement actions required for remedial framework that included required external independent reviews and look-back analyses for suspicious activity by 3rd party consultants. The remedial framework was in addition to the civil money penalty and often would be much more expensive than the fine when considering the consulting and legal fees. If a casino is relying upon your internal audit department to test the compliance program, it is essential to ensure the department is qualified and has the proper resources. Independent testing is much different than the required MICS internal auditing procedures and there is no checklist available for this testing as it is required to be risk-based. The scope and frequency of the testing must be commensurate with the risks posed by the services and products offered by the casino which can range widely by each casino property. Operators should ensure the scope of the independent testing is adequate to effectively counter the money laundering risks associated with the casinos products and services. These should all be identified in a proper Title 31/AML Risk Assessment.

The Title 31/AML compliance program, independent testing, and training may be vastly different by casino. A small rural casino with a couple hundred slot machines should have a vastly different compliance program than a large casino in Southern California with thousands of machines, credit and several other financial services. The compliance program should be comprehensive based upon a risk based approach that reasonably ensures that the casino is mitigating money laundering risks at that facility.

Casinos have and will continue to live under a regulatory microscope, and while the procedures can seem cumbersome, they are an essential element in the gaming industry’s ongoing efforts to maintain the greater public trust. As opponents of gaming attempt to point to unsubstantiated and refuted claims of increased crime being associated with casinos and the expansion of gaming, the industry can point to its compliance with robust anti-crime regulations, such as Title 31/BSA, as further evidence of the industry’s commitments.

Grant Eve, CPA, CFE, is a Partner at Joseph Eve.
He can be reached by calling (406) 727-1798 or email grant.eve@josepheve.com.
Featured in Indian Gaming Magazine’s April 2017 edition