AML Compliance Software for Casinos: A Requirements Checklist
AML compliance software for a casino is the set of systems that holds the evidence for reporting, record keeping and monitoring under Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Act. It supports the compliance program. It does not replace it.
This checklist is for compliance officers and payments leads who are deciding what their tooling must do. It assumes a Canadian casino that is a reporting entity. It is general information, not legal advice.
What AML compliance software can and cannot do for a casino
FINTRAC requires casinos to run a compliance program with five elements: a compliance officer, written policies and procedures, a documented risk assessment, a training program, and a two-year effectiveness review. Software can store and time the evidence for each element. It cannot write the risk assessment, decide what meets the reasonable grounds to suspect test, or sign off the effectiveness review. A tool that claims to do those things is offering a substitute for judgment, and that is a weak position in an examination.
Reporting capabilities to require
Whatever product or build you choose, the system should cover these points:
- Detection for each report type a casino files: suspicious transaction reports, large cash transaction reports, large virtual currency transaction reports, electronic funds transfer reports and casino disbursement reports.
- The 24-hour aggregation logic for the threshold reports, tested against sample transactions that include split deposits.
- Time stamps on the receipt, the alert, the case review and the filing, so the "as soon as practicable" and 5-working-day clocks can be shown.
- Virtual currency valuation that applies one documented exchange-rate method and records the rate used.
- Retention of each filed report for at least 5 years, the period FINTRAC states for LVCTR copies.
Evidence an examiner will ask for
An examination looks for a trail, not a dashboard. For each suspicious transaction report, keep the alert, the analyst's notes, the reasons for filing or for closing the case without a report, and the final narrative. For each threshold report, keep the receipt record, the valuation, the aggregation check and the submission log. Software that shows only counts of filings, without the files behind them, will not answer that request.
Ask any vendor for a sample file of each report type, a field map showing how the system fills the FINTRAC report, and a test log showing how the 24-hour rule behaves on split deposits. A vendor that cannot show those items is describing a product, not a compliance function.
Unified or separate tools
Many casinos ask whether one platform should cover identity checks, screening and reporting, or whether separate tools make more sense. Both options carry trade-offs, and our KYC and AML software comparison sets them out. Decide the question after the risk assessment, because the assessment shows which data flows and which report types the tool must handle.
Gaps to test before a contract is signed
Three gaps are worth testing before a contract is signed. Alerts can pile up with no review trail. Monitoring rules can go live without being run against past cases to see what they would have caught. And reporting modules can be fed from a payments export that is never reconciled to the casino's own ledger. Each test takes a few days and prevents a much longer remediation later.
Assign one owner to every rule setting. The compliance officer should approve each change, and each change should be logged with its date and reason. Without that log, a rule change can look exactly like a reporting gap during an examination.
Retention and access need the same care. Filed reports and their supporting files should sit in a store that the compliance team controls, with access limited to named staff and a record of who opened what. Operations teams often need dashboards for daily work. Those views can show counts and status, but the underlying case files should stay in the compliance store so that an examiner sees the same record the casino filed.
Write the risk assessment and the policies first, then choose software that supports them. Our AML compliance program guide for online casinos walks through each pillar. The primary source for the obligations above is the FINTRAC casinos sector guidance, which should be checked against any current version before it is relied on.