Customer due diligence, or CDD, is the process used to understand who a casino customer is, who may ultimately control the funds, why the relationship exists, and whether the activity is consistent with the known profile. It is broader than checking an ID. Effective CDD combines identity verification, risk assessment, expected activity, source information, ongoing monitoring, and escalation when facts do not fit.
Core Elements of CDD
| Element | Question answered | Typical evidence |
|---|---|---|
| Identification | Who is the customer? | Name, date of birth, address, government ID |
| Verification | Is the identity information reliable? | Document checks, database checks, liveness or in-person review |
| Beneficial ownership | Who ultimately owns or controls an entity or funds? | Corporate records, ownership structure, declarations |
| Purpose and expected activity | Why is the relationship being opened? | Occupation, business, anticipated play and payment methods |
| Risk rating | How much scrutiny is appropriate? | Customer, geography, product, channel, transaction factors |
| Ongoing monitoring | Does later activity still make sense? | Transactions, play, deposits, withdrawals, alerts, reviews |
The current FATF Recommendations set the international framework for identifying and verifying customers and beneficial owners, understanding the purpose of relationships, and conducting ongoing due diligence. Local law determines the exact casino obligations.
When Casinos Apply CDD
CDD may begin at online registration, loyalty enrollment, credit application, VIP onboarding, wire transfer, high-value cash activity, withdrawal, or when linked transactions cross a regulatory threshold. It can also be triggered by unusual behavior even when no single transaction is large.
Land-based and online casinos collect different signals. A property can observe chip buy-ins, cashouts, markers, safekeeping, hosts, table ratings, and cage transactions. An online operator can see device, payment, account, velocity, and geolocation information. Neither channel should assume that one clean document resolves all risk.
The Risk-Based Approach
Risk-based CDD means applying controls in proportion to risk, not treating every customer as identical. A local recreational visitor making modest, consistent purchases may require standard checks. A complex company, politically exposed person, high-risk jurisdiction, unusual third-party funding pattern, or unexplained high-limit activity may require enhanced due diligence.
Risk ratings should not be stereotypes or nationality labels. They should be based on documented factors, updated when facts change, and capable of review. A high-risk rating means deeper understanding and monitoring; it does not automatically prove wrongdoing.
Source of Funds and Source of Wealth
Source of funds asks where the money used for a particular gambling relationship or transaction came from: salary, bank savings, a business account, property sale, investment proceeds, or another identifiable source. Source of wealth asks how the customer accumulated overall wealth.
The two can support each other but are not interchangeable. A bank statement can show the immediate source of a transfer without explaining the broader wealth. A credible profession can explain wealth without proving the origin of a specific deposit. Higher-risk cases may require both.
Building an Expected-Activity Profile
A useful profile is specific enough to test. It may include expected visit frequency, average buy-in, games played, payment methods, credit use, countries involved, and likely cashout pattern. “High roller” is not a sufficient profile by itself.
Suppose a customer declares annual income of $120,000 and expects occasional $2,000 trips. Later the account receives repeated $75,000 third-party transfers followed by minimal play and rapid withdrawal. The issue is not that the customer won or lost. The activity is inconsistent with the established purpose and needs review.
Ongoing Monitoring and Refresh
CDD is not completed forever at onboarding. Names, addresses, occupations, ownership structures, sanctions exposure, PEP status, payment behavior, and gambling patterns can change. Review frequency should reflect risk, and event-driven refreshes should occur when alerts or material changes appear.
Monitoring should connect activity across departments. A host may know the customer’s occupation, the cage may see unusual cash exchanges, surveillance may see chip passing, and finance may see wires. Fragmented knowledge can hide the overall pattern.
Enhanced Due Diligence
Enhanced due diligence, or EDD, is deeper review for higher-risk situations. Measures can include senior approval, additional identity evidence, source-of-wealth verification, explanation of transaction purpose, open-source research, adverse-media review, and more frequent monitoring.
EDD should produce a reasoned decision: accept with controls, restrict certain services, request more information, decline, terminate, or escalate for reporting consideration. Collecting documents without evaluating them is not effective diligence.
Privacy and Fair Treatment
CDD involves sensitive information, so access should be limited, retention should follow law, and data should be protected. Staff should explain requests in neutral language and avoid implying that a review means an accusation.
Customers can be frustrated when a withdrawal is delayed or information is requested after years of play. Good communication explains that regulatory and risk obligations continue throughout the relationship. It should not reveal internal alert logic or whether a suspicious-activity report is being considered.
From the Casino Side
Effective casino CDD requires clear ownership among compliance, cage, credit, hosts, finance, online operations, and management. Front-line staff need practical escalation triggers, not a demand to become investigators. Compliance needs access to complete information and authority to pause or restrict activity.
Auditability matters. The file should show what was known, what was requested, what was received, how risk was assessed, who approved the decision, and when the next review is due. A conclusion without supporting reasoning is difficult to defend.
Illustrative Red Flags
- Multiple people funding one customer without a credible reason.
- Large buy-ins followed by little gambling and rapid cashout.
- Activity far above the known income or business profile.
- Frequent conversion among cash, chips, tickets, wires, and accounts.
- Unclear company ownership or reluctance to identify controllers.
- Inconsistent explanations, altered documents, or unexplained third-party accounts.
A red flag is a reason to investigate, not automatic proof of money laundering.
Common Mistakes
- Equating CDD with ID collection. Identity is only one component.
- Applying the same review to everyone. Risk should determine depth.
- Ignoring beneficial ownership. The visible customer may not control the funds.
- Keeping departments separate. Important patterns can cross systems.
- Failing to refresh. A profile becomes stale as circumstances change.
- Collecting evidence without analysis. Documents must be assessed for plausibility and consistency.
Beneficial Ownership and Entity Customers
When a company, trust, junket, or other legal arrangement is involved, the casino must look beyond the name on the account. The beneficial owner is the natural person who ultimately owns or controls the entity or on whose behalf activity is conducted. Layers of companies, nominees, or unclear control can raise risk.
Documents may include incorporation records, registers, trust deeds, partnership agreements, ownership charts, and identification for controllers. The objective is not to collect every document available; it is to reach a reliable understanding of ownership and control and to resolve inconsistencies.
Recordkeeping and Decision Quality
A strong CDD record allows another qualified reviewer to understand the decision without interviewing the original analyst. It should distinguish customer statements from verified facts, identify missing evidence, explain risk judgments, and record any conditions placed on the relationship.
Checklists help consistency but cannot replace reasoning. Two customers can submit the same documents and present different risk because their transaction patterns, geography, products, counterparties, or explanations differ. The final decision should connect the evidence to the actual casino activity.
FAQ
Is CDD the same as KYC?
KYC is often used for identity and customer understanding; CDD is the broader risk-based process that includes verification and monitoring.
Does CDD mean a customer is suspicious?
No. Standard CDD is a routine compliance requirement.
What is EDD?
Enhanced due diligence is deeper review applied when risk is higher.
Can a casino delay a withdrawal?
Rules vary, but an operator may need to complete lawful verification and risk checks before release.
How often is CDD updated?
Frequency depends on risk and events. Material changes can trigger an immediate refresh.
Related Reading
Continue with Source of Funds, Source of Wealth, Suspicious Activity Report, Currency Transaction Report, and Sanctions Screening.