US Casino AML Rules: 31 CFR 1021 Program and SAR Guide

A casino or card club in the United States is a financial institution for Bank Secrecy Act purposes, which means it must run an anti-money laundering (AML) program, file suspicious activity reports (SARs) and report large cash transactions. The core rules sit in Part 1021 of Title 31 of the Code of Federal Regulations: 31 CFR 1021.210 for the program and 31 CFR 1021.320 for suspicious transaction reporting. This guide sets out what those sections say and where casino rules differ from other sectors. For a related sector, see our guide to the US money services business AML rules.

The regulation text below is taken from the Cornell Legal Information Institute's copy of the CFR. Some operational detail comes from a FinCEN FAQ (FIN-2012-G004, 13 August 2012), which is old guidance, so check current FinCEN material before relying on it.

Which casinos are covered

FinCEN's FAQ says a casino or card club that is duly licensed or authorised to do business as such, and has gross annual gaming revenue in excess of $1 million, is subject to the casino requirements. The definition itself sits in the general definitions of the chapter, which we did not read in full, so confirm the current text if your status is borderline.

The AML program under 31 CFR 1021.210

Under section 1021.210, a casino is treated as meeting the program requirement in 31 U.S.C. 5318(h)(1) if it implements and maintains a written compliance program. The program must be reasonably designed to assure and monitor compliance with the Bank Secrecy Act and its regulations. The section sets out six minimum elements:

1. Internal controls. A system of internal controls to ensure ongoing compliance.
2. Independent testing. Internal or external independent testing, with scope and frequency matched to the money laundering and terrorist financing risks of the casino's products and services. The section sets no fixed testing interval.
3. Training. Training for casino personnel, including how to spot unusual or suspicious transactions where reporting is required by the chapter, other law, or the casino's own policies.
4. Compliance individuals. One or more people responsible for day-to-day compliance.
5. Information procedures. Procedures for using all available information to determine when a person's name, address, Social Security number and other details are required and verified, whether a transaction or pattern must be reported under section 1021.320, and whether a record must be made and kept.
6. Automated systems. For casinos with automated data processing systems, use of automated programs to help ensure compliance.

Suspicious activity reporting under 31 CFR 1021.320

Every casino must report suspicious transactions to FinCEN, and may also report voluntarily. A transaction is reportable when it is conducted or attempted by, at or through a casino, involves or aggregates at least $5,000 in funds or other assets, and the casino knows, suspects or has reason to suspect that it:

• involves funds from illegal activity, or is meant to hide such funds, including as part of a plan to evade federal law or reporting requirements;
• is designed to evade Bank Secrecy Act requirements, including through structuring;
• has no apparent lawful purpose or is out of character for the customer, and the casino knows of no reasonable explanation; or
• uses the casino to facilitate criminal activity.

The deadline is no later than 30 calendar days after initial detection of the facts. If no suspect is identified, the casino may take up to 30 more days, but no more than 60 calendar days in total. For urgent matters such as ongoing money laundering, the casino must also notify law enforcement by telephone straight away. A copy of each report and its supporting documentation must be kept for five years from filing.

The report and any information revealing its existence are confidential. Casinos generally cannot disclose them and must decline subpoenas or requests for them while notifying FinCEN. Permitted disclosures include those to FinCEN, law enforcement and Bank Secrecy Act regulators, and sharing the underlying facts with another financial institution for a joint report. A report is not required for a robbery or burglary that is committed or attempted and reported to law enforcement. Our guide to suspicious activity reports and tipping off explains the same principle in the UK.

Cash reporting and logs

Subpart C of Part 1021 also covers reports of transactions in currency, with sections on filing obligations, identification, aggregation, structured transactions and exemptions. We could not read the operative text of those sections, so we rely on FinCEN's 2012 FAQ for the headline points. It says cash-in or cash-out of more than $10,000 requires a currency transaction report, that cash-in and cash-out are aggregated separately and not offset, and that a casino has 15 gaming days, not calendar days, to file a complete report. It also says casinos must keep currency transaction logs and multiple transaction logs, that paper multiple transaction logs cannot be destroyed before the five-year retention period ends, and that exemption from currency reporting does not exempt a transaction from suspicious activity reporting.

A note on 2026 proposals

FinCEN's proposed rule on AML and countering the financing of terrorism programs, published in the Federal Register on 10 April 2026 (91 FR 18704), lists casinos and card clubs among the institution types it covers. A law firm summary of the proposal says it would add explicit risk assessment processes, written approval of the program by a governing body or senior management, and a compliance officer located in the United States. It is a proposal, and a BDO tracker current to August 2026 reported that no final rule had been issued. Until a final rule is published, section 1021.210 as described above stands. You may also be interested in our guide to casino and gambling clients for accountants for the UK angle.

Practical steps

These are our suggestions, not legal requirements.

• Check your program document against each of the six elements and note where each is evidenced.
• Record the date of first detection on every case, so the 30-day and 60-day limits can be shown.
• Keep the paper logs your regulator expects for the full retention period.
• Choose the scope and frequency of independent testing by reference to your own risk assessment, and write down why.
• Train floor, cage and surveillance staff on spotting unusual patterns, with examples from your own business.

For continuing professional development in this area, see the Learnsignal CPD courses.

What we could not confirm

We did not read the current text of the casino definition, the currency transaction reporting sections, or FinCEN's casino guidance after 2012. The $10,000, 15-gaming-day and $1 million figures come from the 2012 FAQ and should be checked against current regulation. The effective date and final wording of the 2026 program proposal could not be confirmed from primary text.

Frequently asked questions

What is the SAR threshold for a casino?

Section 1021.320 sets it at $5,000 in funds or other assets, involving or aggregated in the transaction.

How long does a casino have to file a SAR?

Thirty calendar days from initial detection, extended to no more than 60 calendar days in total where no suspect is identified.

Does section 1021.210 fix how often independent testing must happen?

No. It requires testing with scope and frequency matched to the casino's risks and sets no fixed interval.

Is the 2026 program proposal law?

Not when we checked. It was a proposed rule, so the current text still applies.

Learnsignal publishes this guide for general education only. It is not legal advice.