On 17 July 2025, HM Treasury and the Home Office jointly published the National Risk Assessment of Money Laundering and Terrorist Financing 2025 (“NRA 2025”).

The NRA 2025 represents the UK’s “stock-take” on money laundering (“ML”) and terrorist financing (“TF”) risk since the third iteration of the NRA was published in 2020. The NRA is critical to the broader infrastructure that is in place to combat and mitigate against ML and TF risk to the UK’s financial system.

The NRA sets the foundations of the ‘risk-based approach’ at national level and, as noted in the Ministerial Foreword, it informs the UK’s “policy, regulatory, and operational priorities and response”. With respect to those that operate in sectors that are regulated under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“MLRs”), the NRA also “provides essential insight into how their services may be exploited for illicit purposes, and guidance on how these threats can be identified and mitigated”.

Casino

The MLRs expressly include within the regulated sector those gambling operators that maintain a casino licence – remote and non-remote – from the Gambling Commission (“Commission”). The NRA includes, at pages 107 – 112, sector specific insight on casinos.

Most significantly for casino operators, whilst TF risk in the sector remains ‘low’, that is not true of ML risk, where risk has increased from ‘low’ to ‘medium’. ML risk in the casino sector had been ‘low’ in both the 2017 and 2020 iterations of the NRA. The increase in risk is “driven by changes in customer, geographical and transaction risks”, with it being recognised that since the previous NRA, there has been an increase in funds flowing through remote casinos. Other factors cited for the increase in risk are “new ways to play casino games, and the updated assessment of [Money Service Business] activities offered by some casinos”. The NRA 2025 sets out that – according to the data – licensed casino operators most commonly face ML risk in the form of the recreational spend of criminal property, albeit attempts to clean criminal funds have also been observed.

In addition, the NRA 2025 cites the following as vulnerabilities in the casino sector: (i) exposure to higher risk payment methods; (ii) use of white-label partnerships and peer-to-peer poker offerings by remote casino operators; and (iii) the higher proportion of international PEPs gambling at high-end non-remote casinos.

It is also noteworthy that the NRA highlights as an emerging risk the deployment of artificial intelligence to bypass CDD checks, as well as the prevalence of ‘crash games’ in that criminals might “conceal the high risk behaviour of cashing out quickly with limited gameplay”.

Next Steps

The Commission has announced that it is reviewing the NRA 2025 and will then update its own risk assessment, which was last published in November 2023.

Licence Condition 12.1.1(3) sets out that licensees must “…take into account any applicable learning or guidelines published by the Gambling Commission from time to time”. As such, whilst operators will be required to revisit their own risk assessment once the Commission’s has been updated, it is important that licensees – in particular those that operate within the regulated casino sector given the increase in risk to ‘medium’ – nevertheless take heed of the NRA 2025. It would be advisable to take proactive steps to consider whether current risk assessments may require at least some revision in light of the NRA 2025 prior to the Commission going to print with its own updated risk assessment.