iGaming & Gambling Compliance in the United States

The United States market is open to online gambling only state by state. Some states authorise online casino games, online sports betting or both; others prohibit them. Federal law sits on top: the Wire Act and the Unlawful Internet Gambling Enforcement Act make interstate or unauthorised online wagering, and the payments that fund it, unlawful, while carving out bets placed entirely within a state that permits them under its own age and location controls.

The principal authorities are the state gaming regulators (for example the New Jersey Division of Gaming Enforcement, the Pennsylvania Gaming Control Board and the Michigan Gaming Control Board), the Financial Crimes Enforcement Network for AML, the National Indian Gaming Commission for tribal gaming, the IRS for winnings reporting and the Commodity Futures Trading Commission for prediction markets.

The biggest obstacle for a new entrant is that every state is a separate market: a separate licence, a separate geofence, a separate self-exclusion list and separate technical standards, all layered over one federal AML regime that was written for casino cages.

1. Who regulates this sector

2. Licensing and authorisation

Gambling licensing is state law. Where a state authorises online play, the online authorisation is distinct from the land-based licence. In New Jersey, for example, internet gaming is offered by an Atlantic City casino licensee holding an internet gaming permit, with all equipment used to conduct internet gaming located in Atlantic City (N.J.A.C. 13:69O-2.1). Michigan's Lawful Internet Gaming Act licenses internet gaming operators and requires them to display evidence of their licence on the platform (MCL 432.311(5)). These examples are illustrative, not a survey: each state sets its own licence classes, supplier and platform-provider licensing, fees and taxes.

Federal limits on online wagering

The Wire Act (18 U.S.C. 1084) makes it a federal crime for a person in the business of betting to use a wire communication facility to transmit bets or wagers in interstate or foreign commerce. The Department of Justice's Office of Legal Counsel concluded on 2 November 2018 that only one of the Act's prohibitions is limited to sports betting and the others reach non-sports gambling, and that the Unlawful Internet Gambling Enforcement Act (UIGEA) did not narrow the Wire Act.

UIGEA (31 U.S.C. 5361 to 5367) prohibits gambling businesses from accepting payments in connection with unlawful internet gambling. It excludes bets initiated and received exclusively within one state where state law expressly authorises them and includes age and location verification requirements and data security standards (31 U.S.C. 5362(10)(B)). A parallel exclusion covers bets made exclusively within Indian lands (5362(10)(C)). These two exclusions are the federal basis for state-licensed, geofenced online gambling.

Tribal gaming

Under the Indian Gaming Regulatory Act, casino-style (Class III) gaming is lawful on Indian lands only if authorised by an approved tribal ordinance, located in a state that permits such gaming, and conducted under a Tribal-State compact (25 U.S.C. 2710(d)). Online wagers placed by players located off Indian lands fall outside the intra-tribal exclusion and depend on state law and the applicable compact.

3. AML, KYC and customer due diligence

A casino or card club is a financial institution under the BSA if it is licensed or authorised to do business as such under state, territorial or tribal law and has gross annual gaming revenue above $1 million in either the previous or the current business year (31 CFR 1010.100(t)(5) and (6)). FinCEN has stated that sports betting and mobile gaming offered through a casino carry the same AML obligations as any other product, whether offered on or off premises. FinCEN has also stated that internet gaming sites that are not licensed as casinos in the United States are not casinos for BSA purposes and are likely to be operating as money transmitters.

AML programme

A written programme with internal controls, independent testing, training, a compliance officer, procedures for using all available information, and automated systems where the casino has them (31 CFR 1021.210).

Suspicious activity reports

Required for transactions conducted or attempted by, at or through the casino involving at least $5,000 that the casino knows or suspects are suspicious. Due within 30 calendar days of initial detection, extendable by 30 days to identify a suspect but never beyond 60 (31 CFR 1021.320).

Currency transaction reports

Required for each transaction in currency, cash in or cash out, of more than $10,000. Multiple currency transactions by or for the same person are aggregated per gaming day (31 CFR 1021.311 and 1021.313).

Records

A log of instruments with a face value of $3,000 or more, records of credit extended above $2,500, account records and records used to monitor gaming activity (31 CFR 1021.410(b)), kept for five years (31 CFR 1010.430(d)).

Casinos are not subject to a customer identification programme (CIP) rule. Identity obligations come from two separate provisions. At each deposit of funds, account opening or extension of credit, the casino must record name, permanent address and Social Security number and verify name and address against a document (31 CFR 1021.410(a)). Before concluding a reportable currency transaction, it must verify and record the identity of the person presenting it (31 CFR 1010.312). There is no casino-specific beneficial ownership rule; beneficial ownership verification under 31 CFR 1010.230 applies only to the covered financial institutions listed there.

4. Identity verification and onboarding

For online players, three layers apply at once: the BSA record and verification rule, the state's account registration rules and, at payout, IRS identification rules.

Federal: non-documentary verification for online customers

FinCEN's exceptive relief FIN-2021-R001 (19 October 2021) lets casinos satisfy 31 CFR 1021.410(a) for online customers by applying compliance measures consistent with a CIP, including non-documentary methods such as comparing customer information with a consumer reporting agency, public database or other source. The casino's AML programme must state when it uses documentary methods, non-documentary methods or both, set minimum acceptable documents (for example an unexpired photo driver's licence or passport) and address situations such as a customer who opens an account without appearing in person. The relief is optional and must be adopted in the programme before it can be relied on.

State: registration before play

State rules require verification before the account can be used. New Jersey requires an electronic patron file (legal name, date of birth, Social Security number or its last four digits if voluntarily provided, address, email and telephone, the verification method and date), verification either against a government-issued credential with its number recorded or by a Division-approved method of remote multi-sourced authentication using third-party and government databases, and confirmation that the patron is 21, not self-excluded and not otherwise prohibited (N.J.A.C. 13:69O-1.3(b)). Michigan requires mechanisms that reasonably verify the player is 21 or older and located in the state, and verification must be satisfied before an account is established or a wager made (MCL 432.311(1) and (2)).

At payout

Payees of winnings that meet the W-2G reporting or withholding thresholds must present two forms of identification, one with a photograph; a signed Form W-9 is acceptable as the non-photo form (IRS Instructions for Forms W-2G and 5754, revised January 2026).

5. Digital channels: what's different

Bottom line: the federal AML rules are the same on an app as on a casino floor, but online play moves verification to the front of the relationship: identity, age, self-exclusion and location must all be confirmed before the first wager, and location is checked again every session.

Verification timing and method

At a land-based casino, BSA identification is triggered by deposits, accounts, credit and cash above the reporting threshold, so a cash player at a slot machine may never be identified. Online play always runs through an account, so 31 CFR 1021.410(a) applies to every player, and state rules (N.J.A.C. 13:69O-1.3; MCL 432.311(2)) require verification before play. FIN-2021-R001 is what makes data-based remote verification lawful under the federal rule.

Geolocation

New Jersey requires the system to detect the patron's physical location at login and as often as the operator's approved submission specifies, and to refuse wagers while the patron is outside an authorised area (N.J.A.C. 13:69O-1.2(e)). UIGEA's intrastate exclusion depends on state location controls, and Regulation GG provides that intermediate routing of data does not determine where a bet is made (31 CFR 132.2(bb)).

Self-exclusion and session controls

Pennsylvania runs an iGaming self-exclusion list separate from its casino list, and online operators must refuse wagers from listed persons and stop marketing to them (Pennsylvania Gaming Control Board, 28 May 2019). New Jersey requires re-entry of credentials after 15 minutes of inactivity (N.J.A.C. 13:69O-1.2(o)).

Payments

Regulation GG requires non-exempt participants in designated payment systems, not operators, to maintain policies reasonably designed to identify and block restricted transactions (31 CFR 132.5).

6. Data protection and biometrics

There is no single federal data protection statute or authority. For an online operator, the binding identity-data rules come from gaming regulation and a patchwork of state privacy and biometric laws. New Jersey requires operators to encrypt the Social Security number (or foreign equivalent), passwords and PINs, and card or bank account numbers held in the electronic patron file (N.J.A.C. 13:69O-1.3(b)(2)). BSA records, including identification records, must be kept for five years (31 CFR 1010.430(d)). Several states regulate the capture of facial geometry and other biometric identifiers through notice, consent and retention limits; operators using selfie and liveness checks must map these laws state by state alongside the gaming rules.

7. Sector-specific obligations

Winnings reporting and withholding

The statutory information-reporting threshold under 26 U.S.C. 6041 rose to $2,000 for payments made after 31 December 2025, indexed for inflation from 2027; the IRS applies the $2,000 minimum to Form W-2G for 2026. Regular gambling withholding at 24% applies where winnings net of the wager exceed $5,000 from sweepstakes, wagering pools, lotteries and, if at least 300 times the wager, parimutuel and sports wagering; backup withholding at 24% applies when the winner does not provide a correct taxpayer identification number (IRS Instructions for Forms W-2G and 5754, January 2026). The current regulation still sets $1,200 for bingo and slots and $1,500 for keno; an IRS proposal would move these to the statutory threshold [Proposed, comments closed 16 Jun 2026].

Prediction markets and sports event contracts

Event contracts listed on a CFTC-designated contract market are derivatives, and an exchange may self-certify new contracts, subject to the CFTC's power under the Commodity Exchange Act to find that contracts involving gaming and other enumerated activities are contrary to the public interest. The CFTC withdrew its 2024 event-contracts proposal on 6 February 2026, issued an advance notice on prediction markets on 16 March 2026, and on 12 June 2026 proposed a definition of "gaming" and factors for when sports event contracts are or are not contrary to the public interest [Proposed, comments closed 27 Jul 2026]. In that proposal the CFTC takes the position that the Commodity Exchange Act preempts state gambling laws as applied to contracts on registered exchanges.

States contest this. New Jersey's petition to the Supreme Court in Flaherty v. KalshiEX (No. 26-299) asks whether the 2010 Dodd-Frank Act preempted state regulation of sports bets offered on CFTC-registered markets, describing a split between the Third Circuit (preemption) and the Ninth Circuit (no preemption). As of 16 October 2026 the petition is pending, with the response due 9 November 2026. Until the question is resolved, the answer depends on the federal circuit, and operators offering sports event contracts face state enforcement risk in some states.

8. Risk indicators and red flags

Casino and online gaming typologies reported to FinCEN

• Minimal gaming with large transactions: funds deposited and withdrawn with little play, the most-cited casino SAR category in 2019.
• Structuring below the CTR threshold: cash split across transactions or gaming days to stay at or under $10,000.
• Altering or cancelling transactions to avoid a currency transaction report.
• Unknown source of funds or chips, including deposits inconsistent with the player's profile.
• Two or more individuals working together, including multiple accounts controlled by one person.
• Cyber indicators from betting apps: shared devices or IP addresses, account takeover, user-name patterns; FinCEN expects these in SARs from mobile platforms.
• Convertible virtual currency funding without analysis of its source.

9. Enforcement and penalties

FinCEN may impose civil money penalties for willful BSA violations. For AML programme failures, each day a violation continues is a separate violation. The general willful-violation penalty is the greater of the amount involved (capped) or a floor, adjusted for inflation: currently $71,545 to $286,184 per violation; negligence carries up to $1,430 per violation and up to $111,308 for a pattern of negligent activity (31 CFR 1010.821, adjusted 17 January 2025). FinCEN weighs factors in its 2020 enforcement statement, including seriousness, pervasiveness, remediation and cooperation. Criminal penalties apply separately, and state regulators impose their own fines and licence sanctions.

In its most recent public casino action, FinCEN imposed a $900,000 penalty (with $50,000 suspended pending an independent review) on a California card club in October 2024 for willful failures in its AML programme, currency transaction reporting, suspicious activity reporting and recordkeeping, coordinated with the California Bureau of Gambling Control (Consent Order 2024-03).

10. Recent changes and what to watch

• 2 September 2026: New Jersey petitions the Supreme Court in Flaherty v. KalshiEX [Petition pending, response due 9 Nov 2026]. A grant and decision would settle whether states can regulate sports event contracts.
• 12 June and 1 July 2026: CFTC proposes public-interest factors and a "gaming" definition for event contracts, then data reporting rules for certain event contracts [Proposed]. Final rules would set what sports contracts exchanges may list.
• 17 April 2026: IRS proposes conforming W-2G thresholds for bingo, keno and slots to $2,000 [Proposed]. The $2,000 statutory threshold already applies for 2026.
• 10 April 2026: FinCEN proposes to overhaul AML/CFT programme rules across sectors, including casinos [Proposed, comments closed 9 Jun 2026]. Expect changes to risk assessment and programme content.
• 16 March 2026: CFTC advance notice on prediction markets, following withdrawal of its 2024 proposal on 6 February 2026 [Advance notice].
• 17 November 2025: FinCEN proposes a special measure against transactions involving ten Mexico-based gambling establishments [Proposed, not final]. If adopted, it would require special due diligence on correspondent accounts.
• 1 January 2026: $2,000 statutory information-reporting threshold takes effect [In force].

11. What this means for identity verification

Online operators verify every player before play, so onboarding must combine identity, age (21 in the states covered here), self-exclusion and location in one flow. Data-based (non-documentary) verification is permitted federally only if written into the AML programme, and states may require a regulator-approved method or a recorded government credential number; a document plus selfie route remains the fallback where data checks fail. Location is a continuing control, not a one-off check: re-verify at each login and at the interval in the operator's approved submission. Each state keeps its own exclusion lists, so checks must run per state and be refreshed. At payout, W-2G events require a taxpayer identification number and two IDs, one with a photo. Keep verification evidence, method and date for at least five years, encrypt Social Security numbers and financial data, and map biometric capture against each state's privacy law.