Anti-Money Laundering in the Gambling Sector: uncertainties and penalties
This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.
Another week, another voluntary settlement reached between the Gambling Commission (the “Commission”) and a casino operator who has been found to have “serious failings” in its anti-money laundering (“AML”) and social responsibility processes.
For those who were left in any doubt, AML and social responsibility compliance are very firmly in the Commission's radar at the moment and, given the wider statutory and political context, are likely to remain so for the foreseeable future.
Background
The Money Laundering Regulations 2007 ("MLRs") oblige holders of a casino operating licence "acting in the course of business carried on by them in the United Kingdom" to have certain systems and procedures in place in order to prevent money laundering. The failure to do so constitutes a criminal offence.
These obligations have been incorporated by the Commission into the gambling licensing regime - and in some respects extended, particularly in relation to social responsibility – in furtherance of the licensing objectives, including: "preventing gambling from being a source of crime or disorder, being associated with crime or disorder or being used to support crime". Moreover, while the MLRs apply only to operators whose business is carried on in the United Kingdom (which is likely to mean only operators which are physically present here), the Commission applies its regulatory obligations to operators wherever they are located (provided they have UK customers).
Casino operators will find a specific condition attached to their licence requiring them to put in place and implement the measures described in the MLRs. In addition, the Commission's general licence conditions and associated code of practice provisions provide that all gambling operators should have regard to the Commission’s guidance or advice on anti-money laundering (which is currently separated into casino guidance and advice for non-casino operators).
Moreover, the distinction between casino and non-casino operators from an AML perspective may soon become obsolete, with the Fourth Money Laundering Directive ((EU) 2015/849) (the "Directive") on the horizon. The Directive states that all providers of gambling services are to fall within the scope of regulated services for the purposes of legal AML compliance unless exceptionally the UK Government chooses to exempt in full or in part providers of certain gambling services (not casinos) from these provisions. If the UK Government does extend the application of legal AML compliance to other providers of certain services as a matter of law, it is almost certain that the Commission will follow suit from a regulatory perspective.
So a key issue for the whole industry is whether, when the Directive is transposed into national law (which it must be by 26 June 2017) the Government does exempt certain types of operators. It may do so only on the basis of "proven low risk". It is true that the Government’s recent national risk assessment of money laundering risk classified the regulated gambling sector as low risk but this sat alongside an assessment that “there remains considerable scope for further improvement” and that, if recent efforts by the sector to improve standards were to lapse, “the overall risk could rise". The Commission have now confirmed that they will be advising the Government on risk within the gambling sector and that "a major part of the risk assessment involved case studies and examples." In this context, these well-publicised voluntary settlements may be highly significant.
Case study: Paddy Power
Following our updates on the settlements reached with Rank Group and Caesars Entertainment (UK) Limited, Paddy Power Holdings Ltd (“Paddy Power”) is the latest gambling operator to be held to account by the Commission.
The Commission identified failings in the way Paddy Power handled relationships with two customers (customer A and customer B) at one of its shops and with one of its online customers who was later convicted of serious criminal offences.
Whilst Paddy Power had social responsibility and AML policies and procedures in place (including systems for monitoring internal compliance) and had delivered training to staff, the Commission considered that: (a) these were not in line with the Commission’s published guidance about managing the risks of money laundering; (b) not all staff involved in the identified incidents fully understood Paddy Power’s own policies; and (c) their internal compliance monitoring had failed to identify the issues relating to these customers.
Paddy Power acknowledged that it had:
- failed to have and apply a customer interaction policy which complied with SR code provision 3.4.1(1)(c) (a condition of its licence), as it did not include: “circumstances in which consideration should be given to refusing service to customers and/or barring them from the operator’s gambling premises”;
- interpreted the duty to be socially responsible in relation to potential problem gambling as being limited to monitoring and interacting with customers, rather than considering refusing service;
- asked staff to encourage customer A to continue to visit and to spend, despite being aware that he displayed signs of having a serious gambling-problem. This was grossly at odds with the licensing objective of preventing vulnerable people from being exploited by gambling;
- an AML policy which was inadequate in that it did not include reference to the spending of the proceeds of crime and therefore failed to take into account the Commission's published advice and guidance about managing the risks of money laundering;
- failed to respond appropriately to suspicions of money laundering in relation to customer B; and
- failed to take reasonable steps to establish customer A’s and the online customer’s sources of funds
The Commission accepted a voluntary settlement with Paddy Power, which (as is now becoming customary), included the publication of a public statement, the establishment of a critical review of AML and SR controls led by an external party, the dissemination of learnings from the case with the remote and non-remote sectors and the payment of a fixed sum (£280,000) to an agreed socially responsible cause. Notably however, the payment of a fixed sum in this case was not only to ensure that Paddy Power had not profited as a result of the compliance failures, it was also designated “a voluntary payment in lieu of a financial penalty.” In addition, Paddy Power was also required to contribute a (not insignificant) sum to to the Commission’s costs in investigating the matter (£27,000).
Comment
Paddy Power’s case is the third of three recent high profile voluntary settlements reached between the Commission and gambling operators and shows a certain level of momentum behind the Commission's campaign to enforce AML and SR compliance.
Gambling operators have once again been actively advised by the Commission to take note of the “valuable learning” provided by the case and, amongst other things, consider "can you demonstrate that your policies and procedures relating to anti-money laundering adequately meet ordinary code provision 2.1…".
However, it is not always entirely clear from the published Casino Guidance (available here) and Non-Casino Advice (available here) what is actually required of gambling operators in precise practical terms. Indeed, the acknowledgement that Paddy Power "failed to respond appropriately to suspicions of money laundering in relation to customer B" is emblematic of the vagueness of (at least certain) of the regulatory obligations that gambling operators are required comply with.
To take just a few examples from the Casino Guidance and the Non-Casino Advice:
- A casino operator who proposes to allow a politically exposed person to be a customer must "take adequate measures to establish the source of wealth and source of funds which are involved in the business relationship" (Casino Guidance);
- "To defend themselves against a charge that they failed to make a report when the objective test of suspicion has been satisfied, employees within remote and non-remote casinos would need to be able to demonstrate that they took reasonable steps in the particular circumstances (and in the context of a risk-based approach) to conduct the appropriate level of [customer due diligence]" (Casino Guidance);
- "Given that operators have the responsibility to prevent gambling from being associated with crime and disorder and protecting vulnerable people from being harmed by gambling, they should carry out appropriate enquiries and assessments which help them in fulfilling that role" (Non-Casino Advice).
The situation arises therefore, that despite the efforts to publicise each of these three high profile cases, and to disseminate the lessons to be learnt from each case, gambling operators are still being left in the difficult position of being required to make a judgment call on what constitutes "appropriate", "adequate" or "reasonable" steps, or risk receiving a substantial financial penalty.
There is a difficult balance to strike, because a prescriptive and inflexible regime may not be workable for operators or effective to identify the range of behaviours that may constitute money laundering.
This case comes swiftly after the recent high profile appointment for the Gambling Anti-Money Laundering Group ("GAMLG"). The GAMLG was established in January 2016 with the aim of improving the gambling industry’s ability to combat money laundering. Its primary aim is to produce, in collaboration with the Commission, industry good practice guidelines.
The Commission has also confirmed that it has developed its own money-laundering risk assessment. This is currently in draft form so we do not know the full details, but it is intended to identify the key risks in the gambling industry according to four criteria: (i) the threat (the amount of criminal money); (ii) vulnerabilities (what opportunities to cleanse money gambling and gambling products provide); (iii) controls which might mitigate the threat; and (iv) consequences (what is actually occurring).
It is not yet know what the industry good practice guidelines will look like, but a focus on what gambling operators should be doing from a practical day to day perspective (rather than an end focus) would be welcome.
