NO KYC CASINOKYC / AML: Where Identity Checks Stop and the Program Starts
FinCEN's casino rules put ID checks inside a wider AML program: SARs from $5,000, CTRs above $10,000, and a licensing test offshore crypto sites miss.
- logged
- by
- No KYC Casino Dispatch
- rail
- Crypto Gambling
- read
- 6 min
- hash
- 2f424af
KYC is the identity step: collecting and verifying who a customer is. AML (anti-money laundering) is the full compliance program that step sits inside, which also covers internal controls, independent testing, training, a compliance officer, suspicious activity reports and record keeping. In US federal rules, KYC is a component of AML, so a site can skip ID checks and still owe, or still dodge, everything else.
Most kyc / aml explainers are written by verification vendors, so they treat the two as a pair of products. The primary texts from FinCEN's Bank Secrecy Act rules draw the line more precisely, and they also show which duties reach a crypto gambling site and which stop at a bank's door. The figures below are from the eCFR as of October 2026.
What is anti-money laundering (AML)?
AML is a written, ongoing program, not a single check at signup. For casinos, federal rules require that each operator develop and implement a written program designed to keep it compliant with the Bank Secrecy Act (BSA).
That program has named parts. The casino rule lists a system of internal controls alongside independent testing, staff training and a designated compliance person. Reporting and record keeping hang off the same program:
- Suspicious activity reports (SARs). A casino SAR applies when a transaction involves or aggregates at least $5,000 in funds or other assets and looks suspicious. The filing is due no later than 30 calendar days after the casino first detects the facts behind it.
- Currency transaction reports (CTRs). A casino reports cash in or cash out of more than $10,000 in currency. Cash in includes front money deposits and bets of currency.
- Retention. The casino keeps each SAR and its supporting documents for five years from filing.
Note the gap between the two thresholds. The SAR trigger is half the CTR trigger, and it is not limited to cash, so a crypto deposit that never touches currency can still fall under SAR rules while sitting outside the CTR.
What is Know Your Customer (KYC)?
KYC is the procedure for learning and confirming a customer's identity. In the casino rule it appears as one item inside the AML program: procedures to determine when the name, address, social security number and other details, and verification of them, are required.
For casinos the trigger is an event, not account creation as such. A casino must record the name, permanent address and social security number of the person involved when deposits, accounts or credit are opened or extended. Where the number cannot be obtained, the casino keeps a list of those customers, provided it made a reasonable effort to secure it.
Banks carry a stricter and more formal version, the customer identification program (CIP). The bank rule says the procedures must let the bank form a reasonable belief that it knows each customer's true identity.
AML vs KYC: the difference that matters
The short version: KYC answers "who is this customer?", while AML answers "what is this money doing, and who has to be told?". The bank rule states the relationship directly: the CIP must be part of the anti-money laundering compliance program.
| Element | KYC (identity) | AML (program) |
|---|---|---|
| Purpose | Identify and verify the customer | Detect, report and deter laundering |
| Timing | At onboarding or a triggering event | Continuous |
| Casino example | Name, address and SSN at deposit or credit | Internal controls, testing, training, compliance officer |
| Reports | None on its own | SAR from $5,000; CTR above $10,000 cash |
| Records | Identity records | SAR copies kept five years |
| Bank example | CIP with a reasonable belief standard | CIP sits inside the AML program |
This is why "no KYC" and "no AML" are different claims. A site that skips ID checks has removed one procedure. Whether the rest of the program applies depends on whether the law treats the operator as a covered institution at all.
Which AML KYC duties bind a crypto casino, and which bind a bank
Under the BSA, an operator is a "casino" only when it is duly licensed or authorized in the United States and has gross annual gaming revenue above $1 million. Both conditions matter. The program, SAR, CTR and record rules above are written for operators inside that definition.
The definition of a financial institution also has a territorial edge: it covers each agent, agency, branch or office within the United States. An offshore crypto casino with no US license and no US office does not fit the casino definition as written. That is a statement about which federal casino rules apply, not a statement that serving US players is lawful. State gambling laws and other federal statutes are a separate question, and being outside the casino definition does not answer them.
Banks sit in a different place. The CIP duty is written for banks, so a bank carries both a formal identity program and the wider AML program regardless of what any casino does.
Privacy questions
What are AML and KYC guidelines?
KYC guidelines cover identifying and verifying a customer. AML guidelines cover the whole compliance program around that: internal controls, testing, training, a responsible officer, transaction reports and record keeping. Under US rules for casinos and banks, KYC sits inside AML, not beside it.
What is the difference between a SAR and a CTR at a casino?
A currency transaction report is mechanical: it covers cash in or cash out of more than $10,000. A suspicious activity report is judgment based and applies from $5,000 in funds or other assets, cash or not, when the activity looks suspicious.
What is CDD and EDD in AML?
Customer due diligence is the baseline work of knowing who a customer is and what activity to expect; enhanced due diligence is the deeper review for higher risk customers. The US casino rules in this article do not use those labels, but their identity procedures and ongoing monitoring do the same job inside the AML program.
Does an offshore no-KYC crypto casino have to follow FinCEN casino rules?
The federal casino definition turns on being licensed or authorized in the United States and on gross annual gaming revenue above $1 million. An operator that sits outside that definition is not a BSA casino, though that does not make it legal to serve US players, and other laws can still apply.
Related dispatches
Primary sources
- eCFR via Cornell LII, 31 CFR 1021.210 Anti-money laundering program requirements for casinos, accessed 2026-10-15
- eCFR via Cornell LII, 31 CFR 1021.320 Reports by casinos of suspicious transactions, accessed 2026-10-15
- eCFR via Cornell LII, 31 CFR 1010.100 General definitions, accessed 2026-10-15
- eCFR via Cornell LII, 31 CFR 1020.220 Customer identification program requirements for banks, accessed 2026-10-15
- eCFR via Cornell LII, 31 CFR 1021.410 Additional records to be made and retained by casinos, accessed 2026-10-15
- eCFR via Cornell LII, 31 CFR 1021.311 Filing obligations (casino currency transaction reports), accessed 2026-10-15
keywords
- NDNo KYC Crypto Casino Rules: When Verification Still AppliesCrypto Gambling
- NDTravel Rule Compliance: What the US Regulation RequiresCrypto Gambling
- NDDecentralized Poker: Can Blockchain Replace Traditional Poker Rooms?Crypto Gambling
- NDWhy Crypto Transactions Sometimes Get Stuck and What to DoCrypto Gambling
- NDKYC vs Anonymous Crypto Casinos: A Systems AnalysisCrypto Gambling