Navigating Regulatory Landscape, by Rudy Stevenson

When casinos go cashless, they are taking an important step toward the possibilities of fintech’s future. At the same time, they are better positioned to function in a landscape of growing regulatory oversight. Cashless systems offer players another form of payment, and they can eliminate cash in gaming machines and facilitate payouts to consumers and electronic deposits. While cash is relatively anonymous, cashless systems increase visibility and facilitate anti-money laundering (AML) and Know-Your-Customer (KYC) compliance.

As the cashless rollout accelerated over the past few years, in the United States many tribal and commercial casinos adopted it, implementing a variety of cashless transaction services. Cashless gaming is already available in several countries, including parts of the United States, Canada, Bermuda, and Australia.

More recently, the advent of cashless gaming has brought both convenience and new challenges to the world of entertainment. However, with these advancements, there has also been a growing concern over cybersecurity issues in the gaming industry. In specific instances, cyberattacks have targeted cashless gaming launches in different markets, leaving other financial data untouched. This has raised alarm bells about the vulnerabilities present in cashless gaming systems. NSW cashless gaming trial was terminated after a cyberattack. What was odd about this particular attack was that other financial data was unscathed, while aspects specific to cashless gaming operations were targeted. Coincidence? Irrelevant? You decide.

Cashless gaming, which allows players to make transactions using digital currencies or virtual payment methods, has gained popularity due to its ease-of-use and seamless integration with modern tech. Nevertheless, cybercriminals have recognized the potential for exploiting weaknesses in this novel landscape. The specific targeting of cashless gaming aspects in these attacks indicates a sophisticated level of understanding of the industry’s intricacies.

One possible reason behind these targeted attacks could be the relatively new and untested nature of cashless gaming systems. As these technologies continue to evolve, hackers may identify and exploit vulnerabilities that developers have yet to address adequately. Additionally, the potential financial gains for cybercriminals in the gaming world can be substantial, making it an attractive target.

To mitigate the risks associated with cyberattacks on cashless gaming, several measures can be implemented. First and foremost, developers and gaming companies must prioritize security during the design and implementation phases. Rigorous testing, regular security audits, and continuous monitoring can help identify and fix vulnerabilities before malicious actors can exploit them.

Furthermore, collaboration among industry stakeholders is crucial. Gaming companies, financial institutions, and cybersecurity experts should share information about emerging threats and work collectively to strengthen defences. Developing standardized security protocols across the industry can also enhance protection against potential attacks.

Education and awareness among users are vital components of cybersecurity efforts. Players should be educated about best practices for securing their accounts, such as using strong passwords, enabling two-factor authentication, and avoiding suspicious links or downloads. By fostering a security-conscious user base, the industry can reduce the success rate of social engineering tactics used by hackers.

Regulatory bodies can play a crucial role in establishing cybersecurity standards for cashless gaming operators. Clear guidelines and compliance requirements can incentivize companies to prioritize security measures and make it more challenging for cybercriminals to exploit weaknesses.

Regulators have been proactively leading the way in approving and adopting technologies, implementing robust rules for cashless gaming operations to address the complexities and risks surrounding the technology. With many advantages, cashless systems can serve to ensure transparency and prevent fraud. Casinos and other gaming operators looking to implement cashless technology must understand the current regulatory landscape to ensure compliance, integrity, and smooth operations.

When making the decision if going cashless for your operations is right for you, it’s important to consider both the pros and cons to make informed decisions that align with the needs of both the casino operators and their customers. At the end of the day, it boils down to assessing and prioritizing risks versus opportunities. Here are several pros and cons to consider as you weigh the opportunities versus the challenges.

Pros of the gaming system
Streamlining legal compliance

• Enhanced safety and public health
• Efficient operations
• Promotes responsible gaming by allowing consumers to set gaming limits
• Enhanced transactional transparency
• Added protection against money laundering
• Increased physical safety and security for operators and guests
• Reduced banking costs
• Speedier transactions
• Connected data ecosystem
• Easily trace customer spending
• Customer insights in real time
• Marketing and loyalty program opportunities for operators
• Integration of consumers’ online and in-person gaming by using the same digital payment systems

While these benefits seem promising for operators driving the industry towards a cashless future, it’s crucial to acknowledge the potential roadblocks and significant considerations that may arise, such as:

Cons of Cashless Gaming Systems:

• Cybersecurity risks: Vulnerable to cyberattacks and data breaches.
• Technology dependency: Prone to disruptions and system failures.
• Excludes cash-reliant customers: Some may prefer using cash.
• Privacy concerns: Collects and stores customer transaction data.
• Limited access for certain demographics including tech-averse individuals.
• Regulatory hurdles and compliance costs: Stricter regulations and expenses.
• Transaction fees: Additional costs for operators and customers.
• Potential for addiction and overspending: Easier to overspend.
• System malfunctions and disputes: Customer dissatisfaction and legal issues.
• Reliance on electronic infrastructure: Requires stable internet connectivity.
• Transition and training costs: Training staff and customers, setup expenses.
• Resistance from traditional players: Some gamblers prefer cash-based experience.
• Crypto integration: Assessing and selecting regulated crypto currencies for global payments.

After assessing the pros and cons, if you are leaning toward venturing into this territory for your operations, here are a few key factors to guide you through your potential fintech journey towards cashless solutions.

Cashless Systems in Casinos – GLI Standard

GLI has presented a set of standards for cashless processes in casinos in GLI-16. Following certification, we will issue a certificate of compliance as well as an appropriate Gaming Labs Certified® mark indicating compliance with this standard.

BSA and AML Compliance Basics

On a federal level for each country, anti-money laundering legislation has established basic requirements to ensure transparency and prevent money laundering. In the case of cashless systems, advanced technology can facilitate compliance by integrating checks and automated reports.

To safeguard the integrity of the casino industry and the U.S. financial system, casino companies and gaming operators have developed effective risk-based programs to ensure compliance with the legal requirements of the federal Bank Secrecy Act and associated AML statutes and regulations. AML programs also protect the casino and its employees from even unwittingly being involved in money laundering criminal conduct.

AMERICAN GAMING ASSOCIATION

Best Practices for Anti-Money Laundering Compliance 2022

Basic Compliance Requirements

• Implementing internal controls
• Compliance training of casino staff
• Independent compliance and AML-focused audits
• Having a compliance officer responsible for AML compliance
• Implementing programs to identify customers by name, address, SSN
• Implementing programs to detect suspicious transaction patterns
• Maintaining:
  • Multiple Transaction Log (MTL)
  • Negotiable Instrument Log (NIL)
  • Monetary Instrument Log (MIL)
  • Suspicious Activity Reporting (SAR)

Modern cashless systems often integrate and automate reports to facilitate compliance with the current regulatory requirements.

Digital Wallets – Risk Assessment

Transactions made using digital wallets through cashless wagering accounts create digital records. While deposits and withdrawals within casino premises are subjected to currency transaction reporting requirements, other digital wallet transactions are not. In this case, casino operators must implement efficient transaction review procedures capable of detecting suspicious activities.

The American Gaming Association advises,

“Wherever possible, casinos should require the withdrawal method to match the deposit method unless the funds have been sufficiently placed at risk. Funds deposited into a Cashless Wagering Account should be confirmed to be used for gaming purposes. A reasonable, risk-based review process should be put in place to detect customers that frequently make deposits and withdrawals without associated gaming activity. Such instances should be considered for SAR filing.”

Mobile Wallets

Some companies have developed virtual wallets that enable players to activate slot machines using their smartphones. Patrons use the apps to deposit funds from their debit cards. These types of virtual wallets can be tied to casino loyalty accounts. Companies looking to implement this cashless technology must have a money transmitter license regulated by the Federal Deposit Insurance Corporation (FDIC).

Compliance Officers

Casinos must have one or more employees designated as responsible for AML and BSA compliance. The compliance officer must be well-versed in both the regulatory requirements and the casino’s products, services, and customer base. They must understand money laundering risks and have in-depth knowledge of AML/BSA reporting requirements. The compliance officer is also the primary contact for any regulatory inquiries.

Customer Identification

In order to open a digital account that they can use for gaming, patrons will be required to provide:

• Full name
• Address
• Social Security Number
• Additional information depending on assessed risk

Know Your Customer Due Diligence

Casino operators must keep records of the procedures used to analyze financial transactions and gaming patterns. Additionally, they must keep records of:

• Due diligence reports
• Risk determination
• Patron monitoring/termination/banning from certain casino services
• Reports to law enforcement
• Independent testing program reports

Cashless systems are here to stay. Using services provided by established companies can help casinos streamline transactions and facilitate record-keeping and compliance. While cashless gaming brings numerous benefits to the gaming industry, it also introduces cybersecurity challenges that must be addressed proactively. By focusing on robust security practices, collaboration, education, and appropriate regulations, the industry can better protect itself and its users from cyber threats. As technology continues to evolve, a collective effort is required to stay one step ahead of malicious actors and maintain the trust of players in the exciting world of cashless gaming.

At GLI, our team of global experts is here to help you align your fintech gaming goals with customer needs and navigate the opportunities and challenges ahead. While no one can predict the future, our insights and foresight will aid you in assessing risks versus opportunities in this ever-evolving space. Gaming Laboratories International is the world’s most capable company dedicated to providing independent testing and evaluation services for gaming technology of all types to the gaming industry.