Gambling Commission lifts casino terrorist financing risk to medium in 2026 assessment

The UK Gambling Commission’s 2026 risk assessment moves casino terrorist financing (TF) risk from low to medium and keeps betting and casinos in the highest-risk bucket for money laundering (ML) and TF vulnerabilities. For PSPs, the useful bit is not the headline grade itself but the payment and identity controls the regulator now sees as under pressure.

1. The assessment covers the licensed gambling sector using data from April 2023 to October 2025, and it feeds into HM Treasury and the Home Office’s National Risk Assessment of Money Laundering and Terrorist Financing, as well as the Gambling Commission’s licensing, compliance and enforcement work.
2. Remote and non-remote casinos, along with betting, remain the highest-risk verticals. The National Lottery and society lotteries stay in the low-risk category, but casino TF risk has now been flagged as medium by the Gambling Commission, whereas the last UK National Risk Assessment classified it as low.
3. Peer-to-peer gambling products got special attention. Poker was rated “high” ML risk in both remote and non-remote casino environments, while peer-to-peer betting was deemed high risk in remote settings. The same report also upgraded the gambling software sector from low to medium ML risk, pointing to cross-border supply chains and the risk of licensed software being resold to unlicensed operators.
4. Payments remain the obvious pressure point. The regulator singled out the growing use of e-wallets, pre-paid cards and cryptoasset-linked funds, especially in remote gambling, and said complex payment systems with multiple methods or open-loop structures can help criminals hide the trail.
5. The report also warns about customer due diligence bypass attempts using deepfakes, face-swap videos and other AI-generated identity materials. On the business side, casinos that also provide Money Service Business (MSB) functions such as foreign currency exchange and cheque cashing were highlighted as vulnerable: in 2024, around 3 per cent of remote casino licence holders and 56 per cent of non-remote licence holders operated MSB services, with activity estimated at £7.

The bigger takeaway for PSPs and acquirers is that the regulator is looking at the whole stack now: payment instruments, identity controls, software supply chains and adjacent MSB activity. If your casino portfolio uses crypto-linked funding, e-wallets, or anything that looks like a layered payment flow, this is the kind of assessment that ends up in a due diligence questionnaire pretty quickly.