Casino Risk Assessment Under FINTRAC Rules (2026 Guide)

A casino risk assessment under FINTRAC rules is a documented analysis of how the casino's clients, products, delivery channels and locations expose it to money laundering and terrorist financing, with a rating for each risk and the controls that respond to it. It is a legal requirement for every casino reporting entity, it must be updated before new products or technologies launch, and it must be tested at least every two years.

This guide explains what the regulations actually require, how to apply the prescribed factors to a land-based or online casino, and how to produce an assessment that an examiner can follow from rating to control. It is written for compliance officers and the vendors who support them. It is general information, not legal advice.

What the rules require

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act requires every reporting entity to establish a compliance program, and section 9.6(2) of the Act requires that program to include an assessment of the risk of a money laundering or terrorist financing offence. Section 156 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR) sets out what the program must include:

FINTRAC's current compliance program guidance also refers to sanctions evasion risk and to Canada's National Risk Assessment as inputs. Read the latest version of the guidance alongside the regulations, because FINTRAC updates it more often than the regulations change.

The prescribed factors, applied to a casino

Section 156(1)(c) lists the factors an assessment must consider. One of them, the activities of foreign and domestic affiliates, applies only to financial entities, life insurance companies and securities dealers, so it does not apply to casinos. That leaves four.

Clients and business relationships

Who plays, and how well do you know them? Relevant questions include the share of high-value players, politically exposed persons and heads of international organizations, players identified only to the minimum standard, players who use third parties, and business relationships such as junket-style hosts or corporate accounts where they exist. FINTRAC's casino indicators point to behaviour worth weighting here: reluctance to provide information, use of multiple names, and requests to pay winnings to third parties.

Products, services and delivery channels

Table games, slots, poker, sports betting, cashless or account-based play, cheque issuance and front-money deposits each carry different exposure. Delivery channel matters just as much. Online play is non-face-to-face by default, and FINTRAC's January 2024 bulletin on online gambling describes typologies such as funding accounts with prepaid cards bought with suspected proceeds of crime and then withdrawing to a bank account. Payment methods belong in this factor: cash, debit, e-transfer, prepaid vouchers and virtual currency do not carry the same risk.

Geographic location of activities

For a land-based casino this covers the property's location and where its patrons come from. For an online casino it covers the provinces it serves, how it confirms that players are physically inside them, and where funds come from and go to. FINTRAC's online bulletin lists log-in locations that do not match the registered address as an indicator, which makes geolocation data part of the evidence base for this factor.

Any other relevant factor

This is where the national picture belongs. Canada's March 2023 Updated Assessment of Inherent Risks of Money Laundering and Terrorist Financing raised the money laundering threat from unlicensed gambling, including online gambling, from high to very high. A licensed operator is not the unlicensed market, but it competes for the same players and receives funds through some of the same payment channels, which is worth recording. Other examples include staffing levels in compliance, reliance on third-party service providers, and the casino's own history of examination findings.

Separately, section 156(2) requires the casino to assess and document risk before introducing a new development or technology that may affect its clients, products, services, delivery channels or geographic location. Launching online play, adding crypto deposits or switching payment processors all qualify.

A method you can document

The regulations do not prescribe a scoring model, and FINTRAC accepts that methods will differ by size and business. What examiners look for is a method that is written down, applied consistently and linked to controls. FINTRAC's risk assessment guidance asks entities to document each step, the process followed and the reasoning behind it. A method that most casinos can defend:

1. Inventory. List every client type, product, channel, payment method and location in scope. Gaps in the inventory become gaps in the assessment.
2. Inherent risk. Rate each element before controls, using a simple scale (for example low, medium, high) with written definitions of each level.
3. Controls. Record the controls that apply to each element: identification standards, monitoring rules, limits, enhanced due diligence.
4. Residual risk. Rate what remains after controls, with a reason, not just a number.
5. Action. For each high residual risk, record the special measures applied and any planned improvements, with owners and dates.
6. Approval and refresh. Record who approved the assessment, when, and the events that trigger an update.

Avoid weighting formulas so complex that nobody outside the compliance team can explain them. A reviewer should be able to pick any player segment or product and trace it from inventory to rating to control in a few minutes.

Worked example: an online casino's risk matrix

The table below is an illustrative example for a fictional provincially authorized online casino. The ratings show the shape of the reasoning; they are not a benchmark, and a real assessment must be based on the casino's own data.

Note the PEP row. Some risks stay high after controls, and that is acceptable if the special measures are documented and applied. A matrix in which every residual risk is low tends to raise questions rather than answer them. The controls in the virtual currency row tie into large virtual currency transaction reporting for casinos, and the monitoring controls throughout depend on the transaction monitoring rules that feed analysts.

From high risk to special measures

When a casino rates a risk as high, the Act (s.9.6(3)) and the regulations require it to take prescribed special measures and document them in its policies and procedures. In FINTRAC's guidance these are enhanced measures to verify identity, keeping client information up to date, and enhanced ongoing monitoring to detect transactions that must be reported. In casino terms, that typically means:

• Enhanced identity verification for high-risk players, such as additional documents or a second verification method.
• Source of funds checks when play or deposits exceed what the player's profile explains.
• More frequent reviews of client information and risk ratings.
• Tighter monitoring thresholds and manual review of withdrawals for high-risk segments.
• Senior management approval to continue the relationship where the risk warrants it.

The link between the assessment and suspicious transaction reporting is direct. Players in high-risk segments get more scrutiny, so more of their activity reaches an analyst, and the analyst's decision is better informed. Our guide to suspicious transaction reports in casinos covers the reporting step.

The two-year effectiveness review

Section 156(3) requires the compliance program to be reviewed at least every two years. FINTRAC's guidance says the review should cover the policies and procedures, the risk assessment and the training program. FINTRAC's risk assessment guidance also recommends a review when the business model changes, for example after a new channel or product launch, although only the two-year cycle is a fixed legal requirement. An internal or external auditor must carry it out; an entity without an auditor may do it itself. Within 30 days of completing it, an entity must report the findings, any updates to policies and procedures, and the status of their implementation in writing to a senior officer.

For the risk assessment specifically, a useful review tests three things: whether the inventory still matches the business, whether the ratings are supported by data, and whether the controls listed are actually operating. Sampling players in each rating band and checking what happened to them is often more revealing than re-reading the document.

What FINTRAC penalties say about risk assessments

FINTRAC's public penalty notices show risk assessment failures recurring among casino-sector entities. Both violations in CNE Casino's 2025 penalty concern risk assessment: not assessing and documenting risk using the prescribed factors, and not instituting and documenting the prescribed review. Atlantic Lottery's 2026 penalty included failing to assess and document risk including the prescribed factors, and one of the three violations in Nova Scotia Gaming Corporation's 2026 penalty was the lack of an enterprise-level risk assessment. SIGA's notice cites 41 of 100 reviewed instances in which patron risk was rated "none", alongside findings on monitoring of high-risk patrons. CNE Casino and SIGA have appealed to the Federal Court, so their findings are not final. The full list is in our review of FINTRAC casino penalties.

The common thread is documentation and calibration. An assessment that exists only as a general statement, or that produces ratings no one has tested against real player behaviour, is treated as a gap.

Risk assessment checklist

• The assessment explicitly covers clients and business relationships, products, services and delivery channels, geographic location, and other relevant factors, each under its own heading.
• Every product, payment method and channel currently live appears in the inventory, including online play and cashless options.
• Rating definitions are written down and applied consistently.
• Each high residual risk is linked to documented special measures in the policies and procedures.
• New products and technologies have a dated assessment completed before launch.
• Rating distributions have been sanity-checked against actual player data.
• The two-year review is scheduled, scoped to include the assessment, and assigned to an auditor or, where none exists, to someone other than the assessment's author where possible.
• Review results reach a senior officer in writing within 30 days.
• Tooling can produce the evidence: segment counts, alert outcomes, enhanced due diligence records. Comparing KYC providers for iGaming operators against this list is a practical way to find gaps.

Responsible gambling note

This is a compliance resource for businesses, not a guide to playing. Gambling is for adults only: the minimum age is 19 in most provinces and 18 in Alberta, Manitoba and Quebec. No game or strategy guarantees winnings. Some patterns that look like financial crime risk, such as rapid repeat deposits, can also signal gambling harm, so risk teams should have a route to the responsible gambling team. If gambling is causing harm to you or someone close to you, free confidential help is available: ConnexOntario 1-866-531-2600 (Ontario), Jeu : aide et référence 1-800-461-0140 (Quebec), the Gambling Support BC line 1-888-795-6111 (British Columbia) and the Addiction Helpline 1-866-332-2322 (Alberta). In other provinces, contact your provincial health line or problem gambling service.

Gambling is for adults only: 19+ in most provinces, 18+ in Alberta, Manitoba and Quebec. Gambling can be addictive; no game or strategy guarantees winnings. This article is general compliance information for businesses, not legal advice.

Written and reviewed by the iGaming Expert Hub editorial team. Regulatory statements checked against the primary sources listed above on 2026-10-22; FINTRAC guidance changes, so confirm current requirements before relying on them.

← All articles