High Risk of What? Putting Evidence Ahead of Reputation in iGaming and Crypto

What do iGaming and crypto have in common? Despite a crypto market worth around $3 trillion and an online gambling industry approaching $300 billion, both sectors are still seen as the Wild West of finance, sitting on the fringes of the mainstream economy. For businesses in these sectors, opening a bank account or securing a payment partner is no easier than it was a decade ago, even though our understanding of their risks and the tools to manage them have improved considerably. So why is this? In my experience, reputation and expertise are at loggerheads when it comes to iGaming and crypto – and reputation is winning. 

Take crypto, for example: it runs on a fully auditable on-chain ledger, where every transaction can be traced directly to its source. Add in today’s KYB and identity verification standards, the EU's licensing regime under the Markets in Crypto-Assets Regulation, and the Travel Rule requirements, and you have what would seem a dreamland for AML regulators. But that is not the case. The reputation of crypto supplants understanding. 

In iGaming, the same applies to licensing jurisdictions: regimes with well-documented AML standards and audit oversight are judged on their past reputation rather than their current practice. The mandated, fully transparent trail of corporate structures, licensing, and end-user monitoring is consistent; reputation is not. Full-suite KYC tooling enables compliance more than ever before, and AML subject matter expertise is at its peak. So why are these industries sometimes struck with a black mark?

I firmly believe this is a symptom of a lack of understanding, a reluctance to look deeper than reputation, and ultimately a fear of the unknown. This runs counter to the fundamental principles of risk management.

High risk of what?

“High risk” is one of the most frequently used phrases in financial crime. It is also one of the least useful when we stop to ask a simple question: high risk of what?

My argument is that iGaming and crypto present an interesting challenge for financial crime professionals when distinguishing between the inherent risks associated with a sector and the specific risks posed by an individual customer. Both industries present complex financial crime challenges and legitimate reasons for greater scrutiny. 

In crypto, those reasons include the speed and cross-border reach of transfers, the use of mixers and privacy tools to obscure fund flows, and exposure to sanctioned entities, ransomware, and scam proceeds. In iGaming – deposits withdrawn with minimal play to clean funds, collusion and chip dumping in peer-to-peer games, third-party or unexplained funding of high-value accounts, and the difficulty of verifying source of funds for high-stakes players. Yet none of these risks apply equally to every exchange or operator, let alone to every business connected to these sectors.

The question is how effectively we translate sector-level risk into a contextual assessment of the customer, and subsequent effective risk mitigation.

There is an important distinction between sector risk and customer risk, yet in practice, the two can become blurred remarkably quickly. A business operating in crypto can be treated as high risk because it accepts crypto as a payment mechanism; a gambling business can be treated as high risk because it operates in gambling. An offshore structure can be treated as high risk because of where it is incorporated. At some point, the risk assessment can become less about the characteristics of the business and more about the category into which this company happens to fall. 

Risk appetite is not risk assessment

There is nothing inherently wrong with a financial institution deciding that it does not want exposure to a particular sector. Risk appetite exists for a reason, and a bank, payment institution or financial services provider may decide that the operational, regulatory or financial crime risk associated with a particular industry is outside what it is prepared to mitigate. However, a firm’s decision to exclude a sector from its risk appetite does not necessarily mean that every customer within that industry presents an equivalent level of financial crime risk, or that other firms with different capabilities and risk appetites cannot adequately mitigate those risks. 

Consider two hypothetical crypto businesses. One may operate a regulated exchange with established governance, institutional clients, comprehensive transaction monitoring, and a transparent ownership structure. Another may be an early-stage business with less-clear ownership, complex international flows, and nascent operational controls. Both will be flagged in any risk assessment as “high risk”. Yet even without digging deeper, their risk profiles are clearly not the same.

The same applies to iGaming. A licensed operator, a software provider, an affiliate marketing business, and a professional services firm supporting the sector may all be connected to gambling, but the nature and extent of their financial crime exposure can be materially different. This is where the risk-based approach becomes important. The sector should always inform the risk assessment, but it's not a catch-all when it comes to the contextual understanding and application of risk that an individual business poses. 

When high risk becomes the starting point

The problem becomes more pronounced when a sector classification is used as the starting point rather than one factor within a broader assessment. Once a business has been categorized as high risk, everything that follows can become more difficult: additional documentation is requested, more approvals are required, onboarding takes longer, transaction monitoring thresholds tighten, commercial teams become more frustrated, and customers experience friction. Everybody loses. 

None of these controls are inherently problematic. We tend to ask whether each additional control is responding to an identified risk. If the rationale for additional controls rests solely on sector classification, without sufficient consideration of the customer’s specific risk profile, it is worth examining whether those measures are truly proportionate and appropriately targeted.

There is an irony here. Financial crime frameworks have become increasingly sophisticated: we have better KYC technology, more comprehensive screening, corporate ownership data, transaction monitoring, AI-powered anti-fraud systems, and in the case of digital assets, access to an immutable public transaction ledger. Yet our risk assessment can sometimes remain surprisingly broad.

Wider consequences

Reputation becomes a self-fulfilling prophecy. A few bad actors give an industry a poor reputation, and financial institutions become more cautious about supporting it. When most banks refuse to work with crypto and iGaming businesses, legitimate firms have to go to the few providers that will accept them. Those providers then have a large share of their customers in these two sectors, so their risk exposure looks high. People point to that as evidence that the sectors are risky, and more banks decide to stay away.

Reputation has to be continually tested against the evidence, and this is where financial crime professionals and bespoke tooling have an important role to play. Identifying risk is only the beginning – we must understand it.

The uncomfortable counter-argument

Crypto and iGaming do have genuine financial crime risks that do not disappear as technology evolves. The objective is not to reduce scrutiny, but to make sure that the rationale for that scrutiny is clearly linked to the risks identified and the controls required to mitigate them. If a specific business is high risk, we need to be able to articulate why. If enhanced due diligence is required, we must understand which risk it addresses. If we decline a relationship, we must distinguish between a legitimate risk decision and an assumption about the company’s underlying financial crime risk. 

From reputation-based to evidence-based

Perhaps the real challenge for financial crime professionals is not whether crypto and iGaming are considered high risk, but what that classification actually tells us. The challenge is getting better at distinguishing which risks stem from reputation and which risks originate from a business model. As one of many potential risk vectors, a sector’s history should inform our assessment, its reputation should prompt questions, and its typologies should influence our controls. But none of these should remove the need to understand the individual customer sitting in front of us. The most effective financial crime frameworks should be able to say both “this industry presents elevated inherent risk” and “here is why this particular client does, or does not, present an unacceptable level of risk, and this is the evidence.”

Most of us already hold the information needed to tell the regulated exchange apart from the early-stage business with unclear ownership: KYC files, ownership records, transaction histories and, for crypto, a public ledger. The harder part is using that information properly and documenting why we accepted, declined, or placed a client under enhanced checks. If we can explain in plain terms what a customer’s risk is and how we’re managing it, we’ve done our job. That explanation is what a regulator will ask for, and it’s what a legitimate business needs.