Legalized Sports Gambling: Anti-Money Laundering Compliance

This alert is the fourth in a series of alerts discussing updates and potential developments in light of the Supreme Court’s decision in Murphy v. National Collegiate Athletic Association. The first installment outlined the Murphy decision itself, and the second installment focused on potential state and federal legislation following Murphy. The third installment identified potential revenue opportunities that may emerge following Murphy. This alert outlines risks related to money laundering and key aspects of an anti-money laundering compliance program as they apply to established businesses that may now expand into sports betting, as well as those that may be new entrants into the market post-Murphy.

In the months following the Supreme Court’s decision in Murphy v. National Collegiate Athletic Association (Murphy), which removed the barrier to legalized sports betting, a number of states have authorized and are now regulating sports betting. While Murphy offers market participants a new and significant opportunity to generate revenue, both new entrants to the market and those looking to expand the scope of their existing activities will need to be vigilant in avoiding unwitting participation in, and liability for, money laundering or any other illicit betting activity. Further, as we describe below, those individuals and entities that meet a certain threshold of sports betting activity are subject to anti-money laundering rules applicable to casinos and card clubs. While the Supreme Court’s decision in Murphy has brought new opportunities to both those interested in betting and sportsbook businesses, these opportunities come with their own unique risks.

Legal Sports Betting & Compliance Risks

Casinos and card clubs have long been an attractive venue for money launderers, in large part due to their historically cash-intensive operations. This gives rise to an obvious risk of money laundering as the potential customer base expands through legalized sports betting. All businesses, including sportsbooks, have, at a minimum, an obligation to avoid participating in the laundering of illicit funds. Federal anti-money laundering laws prohibit transactions with funds that a person knows derive from unlawful activity, even if he is unaware of the nature of unlawful activity involved.¹ Additionally, even where “clean” funds are involved at the start, a money laundering transaction may occur where they are sent overseas to promote criminal activity.² Finally, under conspiracy and aiding and abetting laws, a person may be liable for actions of business partners and others who engage in money laundering transactions.³

Sportsbooks and casinos accepting sports bets must also be aware of limitations on out-of-state bettors and certain categories of in-state bettors. For example, in order to protect the integrity of sporting events, New Jersey prohibits any person who is a direct or indirect legal or beneficial owner of 10% or more of a sport’s governing body, or any of its team members, from placing or accepting a wager on a sporting event in which they participate.⁴ Of the states that have legalized sports betting to date⁵, all prohibit out-of-state bettors from placing bets with in‑state sportsbooks.⁶ It may be expected that some bettors will seek to use geolocation spoofing technologies aimed at getting around these rules.

At the federal level, interstate sports betting may still run afoul of the Wire Act, which prohibits those “in the business of betting or wagering” from using a “wire communication facility,” such as a mobile sports betting app, in the placing of bets on sporting events across state lines or in the transmission of money won or lost on those bets, regardless of whether such betting is legal in a particular state.⁷ DraftKings, a popular Boston-based online daily fantasy sports platform, has already entered the mobile sports betting market in New Jersey, although it currently limits access to New Jersey-based bettors.⁸ As mobile and online sports betting platforms enter the market, these companies will need to pay close attention to both the Wire Act and the geographic locations of their users. Further, with limitations such as those described above, sportsbooks will need to be aware of the risks of third-party betting, where prohibited and unidentified bettors use an intermediary to place bets in order to obscure the identity of the third-party and the source of funds used to conduct the transaction. 

Finally, the expansion of sports betting itself beyond traditional casinos requires application of existing anti-money laundering laws and requirements to new technologies and platforms, which may not easily fit within existing rules.⁹ 

Anti-Money Laundering Requirements

While, as mentioned, all business should avoid laundering criminal funds, not all sportsbooks will be subject to the formal requirement of having a written AML program, although many may find that having some level of AML program is prudent. However, all sportsbooks that are operating pursuant to state casino licenses and that have gross annual gaming revenues greater than $1 million are “financial institutions” subject to the requirements of the Bank Secrecy Act (BSA), 31 U.S.C. § 5311, et seq,¹⁰ and therefore subject to its AML requirements. The BSA, as amended by the USA PATRIOT Act, Pub. L. No. 107-56, 115 Stat. 272 (2001), seeks to prevent money laundering and the financing of terrorism by helping law enforcement identify the source, volume, and movement of funds within the United States and/or transmitted across its borders. To do this, the BSA requires “financial institutions”¹¹ to maintain records and submit reports of certain types of transactions, including those that are suspicious.

The Financial Crimes Enforcement Network, or “FinCEN,” an agency of the Department of Treasury, is empowered to regulate financial institutions and enforce compliance with the BSA.¹² The BSA and implementing regulations developed by FinCEN require casinos to, among other things:

• Implement a written risk-based anti-money laundering compliance program, including a system of internal controls, training of personnel, internal and/or external independent testing for compliance, and designation of one or more compliance officers;
• File currency transaction reports (CTRs) for each transaction in currency involving either cash in or cash out of more than $10,000,¹³ while verifying and recording the name and address of the individual presenting the transaction, as well as of any person or entity on whose behalf such transaction is conducted;¹⁴
• File Suspicious Activity Reports (SARs) with FinCEN when a casino knows, suspects, or has reason to suspect that a transaction aggregating at least $5,000¹⁵ is suspicious; certain types of activity may be a “red flag,” including transactions in amounts designed to fall just below reporting or recordkeeping thresholds, customers conducting unusual banking-like transactions at the cage, large transactions with minimal gaming activity, other unusual transactions, or indicators of criminal activity;¹⁶
• Establish a system of recordkeeping to maintain records for at least five years, including receipts of funds on account, extensions of credit over $2,500, transfers outside of the United States, CTRs, and SARs and their supporting documentation.¹⁷

In guidance issued to casinos in 2010, FinCEN emphasized that in addition to the requirements above, casinos must use all information available to them—including the sophisticated automated monitoring capabilities they use to identify their customers’ patterns and preferences—to effectively identify customers, identify suspicious transactions, and create records of transactions required by the BSA.¹⁸ Further, FinCEN highlighted that an organization must have (1) management that is fully aware of and committed to BSA compliance; (2) compliance officers with sufficient expertise, authority, and control; and (3) policies and procedures that are sufficiently developed and updated.¹⁹

Additionally, casinos are expected to take steps to determine whether a patron is betting on her own behalf or on behalf of a third party. In highlighting the risks of third-party betting,²⁰ FinCEN advised in 2014 that, as with all aspects of an organization’s AML program, casinos must use a risk-based approach to developing their AML program to properly identify the person behind the transaction to ensure accurate filings of CTRs and SARs.

Lessons from Enforcement

The rise in federal enforcement actions against casinos and card clubs relating to BSA violations demonstrates FinCEN’s growing focus in this sector. Recently, in May of 2018, FinCEN assessed a $5 million civil penalty²¹ against Bay Area casino Artichoke Joe’s for willful failure to implement and maintain an effective AML program and for failure to properly detect and report suspicious transactions. Notably, the company failed to report illicit loan shark activity that was openly taking place on the gaming floor and known to some company employees and to law enforcement.²² The company did not continue to monitor customers on whom it had filed numerous SARs, nor did it utilize information that may have been available through propositional players²³ relating to any observations of suspicious activity. Existing AML policies were incomplete, containing placeholder language such as “Insert explanation of how we intend to accomplish,” and “find actual wording,”²⁴ and the company had failed to have regular independent reviews of its AML program.²⁵

FinCEN is acutely aware of the AML risks in the sports betting sphere. Cantor Gaming, one of the largest race and sportsbook operators in the country, with operations at various resorts and via mobile gaming in Nevada, was the subject of a $16.5 million non-prosecution agreement with the US Attorney’s Office for the Eastern District of New York and a concurrent $12 million civil enforcement action by FinCEN. In violations it called “egregious and systemic,” FinCEN identified an AML program that lacked sufficient internal controls, proper training for officers and employees, failed to detect and report suspicious transactions, and displayed numerous other reporting and recordkeeping violations.²⁶ In fact, FinCEN found that Cantor Gaming’s vice president knowingly facilitated illegal gambling by a group known as the “Jersey Boys,” for which he was indicted along with them.²⁷

Recent FinCEN enforcement actions against casinos and card clubs have often focused on a company’s failure to demonstrate a strong culture of compliance to regulators. California card club Hawaiian Gardens was assessed a $2.8 million civil penalty for AML program failures similar to those described above, as well as for having insufficient customer identification procedures, weak risk assessments, an unqualified BSA Officer, and an absence of a compliance culture emanating from the top.²⁸ In 2016, FinCEN fined Sparks Nugget in Nevada $1 million for failure to have an effective AML program, including a pattern of ignoring its own BSA Officer’s program concerns and recommendations regarding the filing of SARs, as well as its failure to use systems and data it routinely used to improve its customers’ experiences to minimize AML risks.²⁹ These enforcement actions are consistent with FinCEN’s public statements, such as those made by FinCEN Director Kenneth Blanco last month emphasizing that casinos must use all available information, data, and analysis they have developed for business purposes to assist also with AML compliance and reporting.³⁰

Thus, regulators will expect sportsbooks to develop risk-based AML programs commensurate with the size, scope, and nature of their operations to establish a culture of compliance from the top of the organization, to provide AML compliance staff with adequate resources and authority to run an effective program, and to use all available data and information in monitoring transactions and reporting suspicious transactions to law enforcement.

Looking Ahead

Although there is much speculation regarding whether and when Congress may establish a national regulatory structure applicable to sports betting in the United States, federal anti-money laundering laws are already broadly applicable to any licensed sportsbook operating here. Law enforcement has engaged with the gaming industry, offered guidance, and taken enforcement action where it has felt it necessary.

Going forward, we expect to see increased focus in the use of emerging technologies and data collection. Blockchain has already emerged as a platform in online casino gambling. In the esports arena, the use of virtual currency within gaming platforms is well-established and widely accepted for in-game payments and upgrades, among other things. With the legalization of sports betting, entities beyond traditional casinos will enter the sports betting market, including blockchain businesses and cryptocurrency platforms, either through primary licenses or partnerships with existing casinos. Blockchain companies promise increased transparency regarding the results of a game, winning bets, and payout amounts, which would all be publicly available and immutable. Many new blockchain companies also offer the promise of betting through the use of smart contracts, which would remove the middleman and ensure immediate payouts, as well as added security through the use of decentralized ledgers—allowing no single centralized actor the opportunity to disrupt the system—and reduced transaction fees.

These new business models will bring the challenge of operating as a regulated “financial institution” under the BSA for the first time. As is the case already with currency exchanges and blockchain investment platforms, we can expect a focus by law enforcement on bringing enforcement actions first against those companies or individuals that may be engaged in promoting fraudulent offerings or services.

As it relates to both traditional sportsbooks and new blockchain platforms, FinCEN has emphasized in recent years its expectation that casinos use “all available information”—and by that it means the increasing amount of data casinos collect through automated means on their customers, their customers’ preferences, patterns, and practices—to enhance the effectiveness of their AML programs. Integrating that data collection and use from the business side of an operation with the compliance side will be important. Through increased enforcement action and public comments by regulators and law enforcement, we expect to see continued robust enforcement action aimed at sportsbooks and other licensed casinos and an expectation that those engaged in regulated sports betting activity develop and integrate strong AML programs into their ongoing business.

This memorandum is a summary for general information and discussion only and may be considered an advertisement for certain purposes. It is not a full analysis of the matters presented, may not be relied upon as legal advice, and does not purport to represent the views of our clients or the Firm. Nicole M. Argentieri, an O'Melveny partner licensed to practice law in New York, Steve Olson, an O'Melveny partner licensed to practice law in California, Irwin Raij, an O'Melveny partner licensed to practice law in the District of Columbia, New York, and Florida, Eric Sibbitt, an O'Melveny partner licensed to practice law in California and New York, Jeremy Maltby, an O'Melveny partner licensed to practice law in the District of Columbia, New York, and California, Laurel Loomis Rimon, an O'Melveny senior counsel licensed to practice law in California, and Marjorie B. Truwit, an O'Melveny associate licensed to practice law in the New York, contributed to the content of this newsletter. The views expressed in this newsletter are the views of the authors except as otherwise noted.

© 2018 O’Melveny & Myers LLP. All Rights Reserved. Portions of this communication may contain attorney advertising. Prior results do not guarantee a similar outcome. Please direct all inquiries regarding New York’s Rules of Professional Conduct to O’Melveny & Myers LLP, Times Square Tower, 7 Times Square, New York, NY, 10036, T: +1 212 326 2000.