Casino AML Risk in 2026: Key Takeaways from the NMLRA

Recently, the Department of the Treasury released their biennial National Money Laundering Risk Assessment (NMLRA), outlining not just an update to existing guidance, but also signaling new risks related to how money laundering has materially evolved in the United States.

For casino compliance teams, the implication is clear: risk assessments and AML programs must evolve alongside it.

Many programs today are still grounded in traditional casino risk indicators: cash intensity, structuring, and minimal gaming. While those risks remain valid, the 2026 NMLRA highlights a broader and more complex reality.

From Transaction-Based Risk to Source-of-Funds Risk

One of the most important shifts in the 2026 NMLRA is the continued rise of fraud as a primary driver of illicit proceeds.

This matters because fraud changes how risk presents itself. Unlike traditional cash-based crime, fraud proceeds:

• Often enter the casino after moving through multiple financial channels
• May appear less suspicious at the point of transaction
• Are frequently associated with victims, intermediaries, or third parties

This creates a gap in many existing risk assessments, which are still heavily weighted toward how transactions look, rather than source of funds and how they were generated.

For compliance teams, this suggests a necessary shift: Risk assessments should place greater emphasis on source-of-funds typologies, not just transactional anomalies.

The Growing Role of Organized Laundering Networks

The NMLRA also reinforces the increasing role of professional money laundering networks, including transnational actors, that move funds on behalf of other criminal groups.

These networks introduce a different kind of risk:

• Activity may be distributed across multiple individuals
• Transactions may appear independent when viewed in isolation
• The overall pattern may only emerge when viewed holistically

For casinos, this challenges a long-standing assumption: that suspicious activity can be identified at the individual patron level.

Instead, compliance programs may need to consider:

• Whether controls are capable of identifying linked or coordinated activity
• How effectively patterns across time, patrons, and transactions are evaluated
• Whether investigations consider the possibility of networked behavior, not just individual conduct

Revisiting “What Suspicious Looks Like”

Another implication of the NMLRA is more subtle, but equally important.

As illicit activity becomes more sophisticated and more structured, it may also become less visibly unusual. This creates a risk that:

• Activity that aligns with known laundering typologies may not appear “out of the ordinary”
• Staff may overlook behavior because it does not trigger traditional expectations

Compliance teams should ask themselves:

“Are we defining suspicious activity based on what is unusual, or based on what aligns with known criminal behavior?”

What This Means for Casino AML Programs

The 2026 NMLRA suggests that many programs may need to expand their scope.

In practice, this may include:

• Updating risk assessments to reflect fraud and transnational activity as primary risk drivers
• Evaluating whether monitoring approaches can identify patterns, not just transactions
• Reconsidering how third-party activity and intermediaries are assessed
• Ensuring that investigative processes consider broader context, not just unique events

Perhaps most importantly, it requires alignment across the organization, not just within compliance teams, but in how risk is understood operationally.

A Moment for Reassessment

The 2026 NMLRA ultimately reinforces a broader point:

AML effectiveness is not just about having controls. It’s about having controls that reflect reality. For casinos, this is an opportunity to reassess whether current programs are calibrated to today’s risk environment, or whether they are still anchored in yesterday’s.

As the industry continues to evolve, so too must the way risk is defined, detected, and understood.