In September 2026, the Financial Action Task Force (FATF) released a special report, "Risks of Gaming and Gambling," which systematically analyzed the risks of money laundering, terrorist financing, and proliferation financing faced by casinos, sports betting, other betting, and online gaming.

The value of this report lies not in categorizing all gaming and gambling activities as high-risk, but in revealing a more significant shift that virtual asset servicing institutions should pay attention to: as online platforms, cross-border transactions, and the integration of multiple products and payment methods occur, gaming and gambling platforms are becoming part of a broader value transfer ecosystem. For exchanges, VASPs, and virtual asset servicing institutions providing services such as crypto payments, funds from this ecosystem should not be understood merely as a "gambling transaction," but should be examined within the context of a complete financial relationship.

The FATF report outlines a wealth of specific risk indicators, covering multiple dimensions including customer and account behavior, betting patterns, payment and transaction activities, and platform and business models. This article will focus on analyzing the aspects directly related to fund flows and on-chain risk identification; for a complete risk indicator framework and specific cases, readers can further refer to the original FATF report.

Report link: https://www.fatf-gafi.org/content/dam/fatf-gafi/publications/risks-of-gaming-and-gambling-2026.pdf.coredownload.pdf

The core of gambling risk lies in the "inflow, transfer, and outflow" of funds.

The traditional understanding of gambling being used for money laundering is that funds enter the platform, engage in a small amount of seemingly normal gambling activity, and then exit in another form. The FATF's newly listed red flags focus on this type of funding pattern that is inconsistent with normal business objectives.

For example, large sums of money are deposited and then quickly withdrawn with little or no gambling activity; small sums of money from multiple different sources are consolidated into a larger amount and then withdrawn; funds are quickly transferred to different accounts or beneficiaries; accounts use multiple payment methods or are topped up by third parties with unclear relationships to the account holder.

These signals do not necessarily prove that customers are engaged in illegal activities. They raise a more specific question: Is the platform being used for legitimate gambling, or is it being used to facilitate the entry, transfer, and exit of funds?

A sum of money entering the platform, a small amount being bet, and then withdrawn from another account may not seem unusual on its own; however, when the deposit, betting, withdrawal, account relationships, and payment channels are put together, the meaning of the transaction may change.

How do risks spread to the virtual asset ecosystem?

The FATF points out that the gaming and gambling industry is connecting with various value transfer methods, including cash, bank cards, bank transfers, virtual assets, mobile payments, and third-party intermediaries. Online and cross-border transactions further reduce spatial limitations on fund flows and complicate the relationships between different platforms, accounts, and services.

Of particular note is that the FATF explicitly lists virtual assets as one of the payment methods used in the gaming and gambling industry, and points out that some payment methods, including virtual assets, may support rapid, anonymous, and cross-border value transfers.

This means that the risks are not necessarily confined to the gambling platform itself. As funds enter or leave the gambling ecosystem through virtual assets, the associated risks may further emerge in exchanges, payment institutions, and other virtual asset service platforms.

However, for virtual asset service providers, a client's address engaging in transactions with a gambling platform, or triggering a gambling-related risk label, does not necessarily mean that the funds are involved in illegal activities. The FATF also emphasizes that a single risk indicator cannot prove the existence of money laundering, terrorist financing, or proliferation financing activities.

What truly needs attention is what this connection means within the overall financial relationship. For example, an address may be indirectly linked to a gaming entity, but its risk assessment requires considering factors such as the number of hops, the amount and percentage of transactions, transaction frequency, customer background, and historical behavior. Conversely, ignoring financial connections with high-risk or unlicensed platforms may result in overlooking risk signals warranting further investigation.

This approach shares some common ground with our previous analysis of OKX's risk control practices: when exchanges face high-risk funds, they need to pay attention not only to whether a single transaction hits a certain risk label, but also to information such as the source of funds, counterparties, direct or indirect exposure, and the path of funds.

To learn more about how exchanges identify high-risk funding networks from the perspective of funding sources and trading exposure, please refer to our previous article: From "Who is depositing funds" to "Where does the money come from": On-chain funding risks behind OKX's risk control strategy

Therefore, for this type of cross-platform, cross-business scenario risk, a more valuable analytical approach is:

Who is the customer? Where does the money come from? Which entities have they interacted with? Which addresses have the funds passed through? Are there any ongoing abnormal behaviors? Are the current transactions consistent with historical activities?

Combining this information allows us to further understand the financial relationships beyond a single risk label and form a more interpretable and verifiable basis for risk assessment.

From one-time screening to continuous risk management

In practice, screening, investigation and continuous monitoring need to be integrated.

Institutions can first identify known risk entities or risk types through address and transaction screening, and then conduct further investigations by combining customer information, funding sources, on-chain counterparties, and funding paths. Based on supporting evidence and applicable rules, they can then decide whether enhanced due diligence (EDD), restrictive measures, or reporting are necessary.

For businesses that require continuous monitoring, it is necessary to pay attention to new high-risk counterparties, abnormal fund aggregation, rapid dispersal and transfer, and transaction patterns that are inconsistent with the existing behavior of customers.

This is not the only procedure prescribed by the FATF for all agencies, but rather a risk-based approach to practice. Its core is to ensure that each escalation action provides an explanation of: what signal was triggered, what information was verified, what financial relationships were discovered, and why the corresponding measures were taken.

This helps reduce misjudgments based on a single label and also facilitates internal review, auditing, and subsequent compliance documentation.

How do on-chain analytics tools provide support?

On-chain analytics tools cannot make final compliance conclusions for institutions, but they can provide structured evidence for the aforementioned processes.

Taking MistTrack as an example, its risk screening can return the associated risk entity label, risk type, direct or indirect exposure, number of hops, funding path, related transaction volume and its proportion; among which, the risk type includes gambling. This information helps to break down the general signal of "associated with gambling entities" into more specific risk facts.

After initial screening, the risk control team can also use risk mapping and counterparty analysis to view the paths of risk addresses associated with the target address, transfer in and out relationships, tagged counterparties, cumulative amounts, and their percentages.

For businesses that require continuous risk management, MistTrack also provides capabilities such as monitoring addresses, transaction risk monitoring, and triggering alerts.

When embedding these capabilities into business processes, the key is not to treat risk scoring as a switch for automatic rejection or approval, but to make scoring, labeling, pathways, and transaction behavior work together to serve human review and risk-based decision-making.

Conclusion

When on-chain risk information is combined with customer due diligence, transaction behavior, and internal handling processes, institutions can move beyond single-point screening to a continuous understanding of funding relationships and risk networks, and develop more interpretable and verifiable AML/KYT risk management capabilities.

Currently, MistTrack's analytical capabilities cover 19 mainstream blockchains, 100+ tokens, 18 stablecoins, 500 million+ entity address tags, 10,000+ entities, 500,000+ threat intelligence data points, and 25 risk types, providing underlying support for on-chain risk identification and financial analysis.

Based on eight years of experience in on-chain security and threat intelligence, MistTrack has served more than 500 institutional clients, including cryptocurrency trading platforms, crypto funds, DeFi platforms, cross-chain bridges, and cross-border payment platforms. It has also won the Gold Award for FinTech (RegTech: Regulatory and Risk Management) from the Hong Kong ICT Awards.

If you are interested in how to apply on-chain risk identification capabilities to your business scenarios, please contact us for further information.

Website: https://misttrack.io/

Email: support@misttrack.io

Form: https://kyt.slowmist.com/cn/get-started.html