What Source of Funds Checks Require at UK Casinos

A source of funds check is the step in which a gambling operator establishes where the money a customer gambles with came from.

The check is part of customer due diligence (CDD), which means the checks an operator must carry out on its customers under the Money Laundering Regulations and the Gambling Commission's Licence Conditions and Codes of Practice (LCCP). When a customer presents a higher risk of money laundering, the operator must apply enhanced customer due diligence (EDD). EDD is a more detailed set of checks, and it includes a closer look at the origin of funds.

The check decides whether an operator continues to accept a customer's money and on what terms. It applies to land-based casinos and to online operators.

The Commission's guidance sets out the sequence below.

1. Onboarding. Under Licence Condition 17.1.1, a licensee must have robust customer due diligence and onboarding checks in place.
2. Risk rating. The operator assigns each customer a level of money laundering risk. Certain indicators raise that level.
3. Enhanced due diligence. If a customer is rated higher risk, the operator must carry out more detailed checks. For higher-risk customers using pre-paid payment methods, the operator must gather an understanding of where the customer's funds and wealth originated.
4. Scaling. The Commission takes a risk-based approach. The level of detail required rises with the customer's assessed risk.
5. Keeping policies current. Under Licence Condition 12.1.1 paragraph 3, operators must keep up to date with emerging risk information the Commission publishes. When the Commission publishes a bulletin, operators must review their risk assessments, policies, procedures and controls.

The operator carries the duty itself. The Commission's emerging risks guidance from October 2025 states that operators must not rely on third-party payment processors to perform know-your-customer (KYC) checks for them. It also states that operators must not rely on a third party to establish source of funds without applying further scrutiny themselves.

The Commission's published material does not list a fixed set of documents. The Rank findings refer to photographic identification and evidence of income as records that should have been held for one high-risk customer.

The following are named in Commission guidance or in the Rank findings as reasons for closer scrutiny:

• Cryptocurrency-linked funds. The Commission expects these to be treated as a high-risk indicator. If crypto-linked funds are indicated, sufficient due diligence must be completed.
• Pre-paid payment methods. For higher-risk customers, the operator must understand where funds and wealth originated.
• Repeated cash recycling. This means repeatedly exchanging cash with little or no gambling in between.
• Customers linked to high-risk jurisdictions.
• Unusual funding patterns.

The Commission's 2026 money laundering risk assessment, published 30 July 2026, rates three sectors High risk. These are remote casino, betting and bingo, non-remote casino, and non-remote off-course betting.

On 7 October 2026 the Commission announced that three Rank Group companies had agreed to pay £5,012,261. The companies are Grosvenor Casinos Limited, Grosvenor Casinos (GC) Limited and Gaming Group Limited. Together they run 51 casinos in Great Britain.

The payment was made in lieu of a financial penalty. It is not a formal fine. The money goes to the Government's Consolidated Fund. Rank also pays the Commission's investigation costs and must fund an independent third-party audit of its anti-money laundering (AML) and safer gambling controls.

The Commission found the following source of funds and due diligence failings:

• Rank had not updated its AML policies to reflect the 2020 changes to the Money Laundering Regulations.
• Unclear policies led to inconsistent risk ratings for customers with elevated money laundering risk.
• EDD was not carried out in cases where Rank's own policies required it.
• Cryptocurrency-derived funds were accepted once converted to sterling, without adequate checks on where they came from. Rank's policy required only that crypto assets be converted into fiat currency through a bank account.
• A customer using cryptocurrency as a source of funds was not risk-rated as required, although internal procedures called for EDD.
• A customer recycled about £85,000 in cash over about 11 weeks without the risk level being raised. EDD was delayed until losses reached about £13,000.
• A customer lost about £200,000 across two visits without adequate photographic identification or evidence of income on file, as reported by Next.io.

The Rank case contained both kinds of failure. The safer gambling failings included a customer who lost £50,000 with no interaction recorded. They also included a customer who won about £260,000 and lost about £250,000 within 12 days with no documented interaction. Neither example concerns where the money came from.

The Commission's published material on this case does not compare source of funds checks with financial risk or affordability checks. That comparison is not covered here.

The Rank case concerned land-based casinos. The same Licence Conditions apply to online operators. The 2026 risk assessment rates remote casino, betting and bingo High risk for money laundering, the same rating it gives non-remote casinos.

The Commission's Executive Director of Operations made the point from the other direction:

For a player, the guidance means the following:

• If an account is funded through cryptocurrency or a pre-paid method, the operator is expected to look more closely at it.
• If an operator asks where funds came from, the request reflects a licence duty. The operator cannot pass that duty to a payment processor.
• If an operator accepts large sums with no questions, that is not evidence that the rules allow it. In the Rank case, the absence of questions was the breach.