UK Money Laundering Regulations, POCA & the risk-based approach
The UK's anti-money-laundering framework has two main pillars. The Money Laundering Regulations 2017 (MLRs) set out the preventive obligations — risk assessment, customer due diligence, record-keeping and senior-management oversight — for firms in the 'regulated sector'. The Proceeds of Crime Act 2002 (POCA) creates the substantive money-laundering criminal offences and the suspicious-activity-reporting regime that applies to everyone. Both operate on a risk-based approach: controls must be proportionate to the risk each business and customer presents. For gambling, the Gambling Commission is the AML supervisor for casinos and sets wider AML expectations for all its licensees.
The MLRs 2017 (SI 2017/692), in force since 26 June 2017 and amended several times (e.g. 2019 for 5MLD and 2022), require a documented risk assessment, CDD/EDD, ongoing monitoring, record-keeping and a nominated officer (MLRO).
Under the MLRs, only casinos (remote and non-remote) sit in the 'regulated sector' supervised by the UK Gambling Commission; other gambling operators fall outside the MLRs but remain bound by POCA and the Commission's licence conditions.
POCA's principal money-laundering offences are sections 327 (concealing/transferring), 328 (arrangements) and 329 (acquisition, use and possession) of criminal property.
The regulated sector also faces 'failure to disclose' offences (ss.330-332) and a 'tipping off' offence (s.333A).
A defence to the principal offences is an authorised disclosure — a Suspicious Activity Report (SAR) — to the National Crime Agency; where consent to proceed is sought this is a Defence Against Money Laundering (DAML) SAR.
For a DAML, the NCA has a 7-working-day notice period to refuse consent; if it does refuse, a 31-calendar-day moratorium period follows before the transaction may proceed.
The Gambling Commission's Licence Conditions and Codes of Practice (LCCP) require all operators — not just casinos — to assess and mitigate money-laundering risk, and enforcement routinely couples AML with social-responsibility failings.
For UK-licensed casinos (including online casinos), the MLRs impose the full statutory CDD/EDD, monitoring and reporting regime, policed by the Gambling Commission as supervisor. All gambling operators, whatever their sector, are subject to POCA offences and to the Commission's LCCP AML requirements, so betting and bingo firms must still run risk-based checks, file SARs to the NCA and evidence source of funds — and the Commission has issued a string of multi-million-pound penalties for AML and affordability failings.
Reference, not advice. This is a teaching summary of the AML framework — not legal advice, and not an operational compliance procedure. Confirm requirements against the primary regulator and your own counsel.