AML Training for Casino Employees: What Is Required

AML training for casino employees is a legal requirement in both North American regimes covered here. Canada's FINTRAC requires a written, ongoing compliance training program plus a documented training plan. The US rule, 31 CFR 1021.210, requires training of casino personnel, including in identifying unusual or suspicious transactions. Neither names one course or one annual date; Canada's guidance gives record-keeping examples, while the US clause is shorter and names none.

This guide is a plain-language explainer built from FINTRAC's compliance program guidance (Guide 4, page dated 11 October 2024) and the text of 31 CFR 1021.210 as displayed by Cornell LII, both opened on 11 November 2026. Guide 4 is FINTRAC's general guidance for all reporting entities, which includes casinos, so it sets general program requirements that apply to casinos rather than a casino-specific training rule. This is not legal advice: confirm your obligations with FINTRAC guidance and counsel.

AML training for casino employees: what regulators actually require

Training is one element of a wider compliance program, not a standalone box to tick. FINTRAC lists six program elements: a compliance officer, written policies and procedures, a documented risk assessment, a written ongoing training program, a documented training plan with delivery, and a review of the program at least every two years. For the operator-level view of how those pieces fit together, see our guide to the AML compliance program for online casinos.

The short version of the requirement, by jurisdiction:

• Canada (FINTRAC): if you have employees, agents or other persons authorised to act for you, you must develop and maintain a written, ongoing compliance training program and a documented plan for delivering it.
• United States (FinCEN): a casino's compliance program must provide for training of casino personnel, including training in the identification of unusual or suspicious transactions, to the extent reporting of such transactions is required by the chapter, other law or the casino's own policies.
• In practice: tie training to the job each person does and keep evidence that it was delivered. Guide 4 describes such records; the US training clause does not name any.

Training also depends on good customer data. Staff can only escalate what they can see, which is why identity checks and onboarding tools matter; our overview of KYC providers for iGaming operators covers that side of the stack.

Canada: FINTRAC's written training program and training plan

Guide 4 draws a useful line between two documents. The training program is what people need to know. The training plan is how, to whom and how often you will teach it. FINTRAC expects both to exist in writing, and the plan to be tailored to your business's size, structure and complexity and its exposure to money laundering, terrorist activity financing and sanctions evasion risk.

Who must be trained

Guide 4 says training recipients should include anyone who:

• has contact with clients, such as front-line staff or agents;
• is involved in client transaction activities;
• handles cash, funds or virtual currency for the business in any way; and
• is responsible for implementing or overseeing the compliance program, such as the compliance officer, senior management, information technology staff or internal auditors.

That wording is deliberately functional, not title-based. A cage cashier, a VIP host and a payments analyst are covered because of what they touch, not because of a department name.

What the program must cover

FINTRAC says the program should explain what recipients need to know and understand, including:

1. your requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations;
2. background on money laundering and terrorist activity financing, including definitions and methods;
3. how your business could be vulnerable, with indicators and examples;
4. your own policies and procedures, including reporting, record keeping and know-your-client requirements; and
5. each person's role and responsibilities in detecting and deterring money laundering, including when dealing with potentially suspicious activity.

Point three is where casino programs most often go generic. A slides-only course on the definition of money laundering does not show how your own floor, cage or payment flows could be abused. Your casino risk assessment under FINTRAC rules is the natural source for those examples.

Frequency, delivery and records

Guide 4 does not set one mandatory interval. It gives examples: training can be delivered at regular intervals (for example monthly, semi-annually or annually), when certain events occur (for example before a new employee deals with clients, or after a procedure is changed), or through a combination. Delivery methods it names include self-directed learning and e-learning, information sessions, face-to-face meetings, classroom sessions, conferences and on-the-job instruction. Instructors can be in-house or external but should know the Act and its regulations.

Guide 4 also says the training program should include a record of the training delivered, for example the date, a list of attendees and the topics covered, and that these records help schedule the next sessions and show you run the program on an ongoing basis. Source: FINTRAC compliance program requirements.

United States: the Title 31 training element

US casinos operate under the Bank Secrecy Act, administered by FinCEN. Under 31 CFR 1021.210, a casino is deemed to satisfy the anti-money laundering program requirement if it implements and maintains a written compliance program that, at a minimum, provides for:

• a system of internal controls to assure ongoing compliance;
• internal and/or external independent testing, with scope and frequency commensurate with the money laundering and terrorist financing risks of the casino's products and services;
• training of casino personnel, including training in the identification of unusual or suspicious transactions, to the extent that reporting of such transactions is required by the chapter, other applicable law or regulation, or the casino's own administrative and compliance policies;
• an individual or individuals to assure day-to-day compliance; and
• procedures for using all available information to determine required customer information and reportable transactions or patterns.

The training clause is short. It names no content list, no frequency and no record fields, so US casinos usually look to the other program elements, to their own policies and to industry guidance. The American Gaming Association's AML best practices (updated December 2019, as summarised by Ballard Spahr on JD Supra, a secondary source) recommend ongoing training tailored by role, covering game operations supervisors and above, hosts and marketing, the cage, surveillance, compliance, audit, and senior management and the board.

Currency note: the regulation text above is as displayed on Cornell LII; confirm the current wording on eCFR or with FinCEN before relying on it.

Canada and the US side by side

Who needs which training: a role matrix

The matrix below combines FINTRAC's recipient wording with the AGA role list. The topic column draws on FINTRAC's content list. It is an illustrative planning aid, not a regulator-issued schedule, and your own risk assessment should override it.

Cage, tables and slots

These teams see cash, tickets and chips first. Their training should be concrete: which transactions trigger a report, how to record them, and who to call when something looks wrong. Guide 4's event-driven example fits here: retrain when a procedure changes, and before a new hire starts dealing with clients.

Hosts and marketing

Hosts hold the relationships and the context. They are often the first to hear an unusual explanation for a source of funds, so their training should cover what to note and how to escalate it, and that escalation is not an accusation.

Online payments, fraud and VIP teams

Whether a particular online operator counts as a casino or reporting entity under the PCMLTFA or the US rules depends on its own status; check that with FINTRAC guidance and counsel, because this article does not decide it. If your operator is a reporting entity, FINTRAC's "handle cash, funds or virtual currency" wording points directly at payments, fraud and VIP staff. Tooling supports them (our overview of AML compliance software for iGaming explains what it does), but software does not replace trained people.

Senior management and the board

Guide 4 includes senior management among program overseers, so they belong on the training list. Their session looks different: risk exposure, review findings, resourcing and what they must approve.

Proving training works: records and the effectiveness review

FINTRAC's two-year effectiveness review must happen at least every two years. The next review must start no later than 24 months after the start of the previous one, and the previous one must be finished first. Guide 4 says the review tests the elements of the compliance program, including the policies and procedures, the risk assessment, and the ongoing training program and plan. Evaluation methods can include interviewing staff, sampling records and reviewing documentation. For entities, the findings must be reported in writing to a senior officer within 30 days of completing the review.

Guide 4 does not prescribe a specific test of training records. Still, the same evidence answers most questions a reviewer could ask: is there a written program, a documented plan, proof of delivery, and staff who can explain their role? A simple log covers the last two. These fields are an operational suggestion, with the first three taken from Guide 4's examples:

Common training gaps to close before a review

• One course for everyone. Guide 4 says large businesses may give different training by role and duties. Document the split in the plan.
• No new-hire trigger. If staff handle clients before they are trained, the plan's own event-driven example is not working.
• Vendor content not checked. If you use an external provider, Guide 4 says to decide whether its services and content suit your business.
• Training disconnected from the risk assessment. The vulnerabilities taught should come from your own assessment.
• No records. Without date, attendees and topics, the program is hard to demonstrate.

Responsible gambling and legal note

This page is a B2B compliance explainer for people working in or advising regulated gambling businesses. It does not encourage play. Gambling is for adults only: the minimum age is 18 or 19 depending on the Canadian province, and local law may set a higher age elsewhere. It is entertainment, not income, and nothing here suggests any outcome is guaranteed. If gambling is causing harm, provincial responsible-gambling services such as ConnexOntario can help. Nothing on this page is legal advice.

18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.

Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.

← All articles