Within the ever-evolving digital age payments and the gambling sectors have had to adapt to, emerging technologies are forcing the hands of AML, CFT and anti-fraud teams to evolve their defences, while also remaining regulatory compliant.
Piotr Lisak, AML Governance Officer & MLRO at FDJ United, knows this all too well, as he contends with multiple local, continental and global regulatory guidelines that differ from country to country.
Lisak spoke to Payment Expert ahead of SBC Summit Malta (10-12 June), outlining some of the key upcoming AML regulations operators should be taking note of, as well as sharing his thoughts on how AI can be the ‘shield and sword’ when it comes to AML, CFT and fraud defences.
Payment Expert: What are still some of the most common AML compliance pitfalls gaming/betting companies often fall foul too?
Piotr Lisak: Operating in the multi-jurisdiction and multi-license environment is definitely a challenge. For example, companies often face situations in which ensuring compliance with all local requirements is difficult due to local variations of the AML laws.
This is also the case within the European Union (EU), as even though we have had AML directives for many years, there have always been differences in local interpretations and implementations of the provisions of the directives. Take the interpretation of the Ultimate Beneficial Owner (UBO) definition as an example, where in countries such as Luxembourg and Malta, this would lead to different results in determining who the UBO behind the corporate structure is.
Convergence of AML compliance aspects with Responsible Gambling aspects, whereby investigations into the source of funds would need to take place not only because of detection of the ML typologies, but also affordability concerns. This may lead to some difficulties in operating in such environments while ensuring full compliance with all local regimes.
Legacy systems and transaction monitoring systems which are rather rule-based and not focused on behavioural aspects of ML typologies.
PE: Are there certain AML/KYC regulatory developments in Europe operators need to take note of this year and next?
PL: The new EU AML Package includes the sixth AML directive and also the updated AML Regulation is important. This single rulebook aims for more convergence amongst the local AML regimes in the EU.
The creation of the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) will also be crucial in bringing more convergence and uniformity in AML guidance. It will become operational from June 2025. AMLA will also coordinate national authorities to ensure effective enforcement of the national laws.
More for payment providers, the EU Transfer of Funds Regulation (TFR) which extends the so-called ‘travel-rule’ to crypto-assets. This is directly in response to the FATF recommendations in this respect. The Travel Rule would require crypto providers to share specific information about the sender and recipient of funds during transactions. You may compare it to the SWIFT system for interbank transactions.
This also ties with the Markets in Crypto-Assets Regulation (MiCA), which provides a comprehensive framework for regulating crypto and digital assets.
PE: We are seeing rapid developments in AI and blockchain when it pertains to financial security. What are some of the best use cases you have observed where these emerging technologies have mitigated money laundering over the past few years?
PL: The use of AI enabled systems would lead to the reduction of false positives. Such AI enabled tools could also be far more agile and adapt quickly to changing patterns and money laundering typologies.
As an example of efficient tracking through blockchain, it is worth mentioning the case where Chainanalysis played a critical role in helping authorities track down hackers – the Lazarus Group – which stole almost 1.5 billion worth of USD in Ethereum in February 2025.
Another case worth mentioning is TRM Labs. TRM Labs played a role in tracking down a big crypto fraud case in the East Asia region where fraudsters misappropriated over $2.5m from around 20 victims. The victims were lured by a promise of 50% return on investment but the perpetrators misappropriated those funds and laundered them through amongst other cryptocurrencies.
PE: Despite being a key tool in battling money laundering and terrorist financing, how are criminals using AI to perform these crimes?
PL: There are many instances where AI can be a double-edged sword. Starting with deepfakes and so-called synthetic media. Criminals can use this technology to impersonate important people such as decision makers, company executives or even public figures.
AI also enables the creation of synthetic identities for fraud. Imagine that there are tools which enable the generation of an image of a fake passport. Such fake passports could be misidentified as the original by some more traditional systems.
AI can also help to generate audio and video. This allows for large scale scamming operations to be carried out at relatively low costs, with multiple potential victims targeted.
AI is also instrumental in more sophisticated activities, such as malware generation or other malicious software. This generally lowers the costs of fraudulent cyberoperations and makes them more accessible for a common scammer.
PE: What more can be done between operators to enable more cross-industry collaboration when it comes to AML processing?
PL: It is actually a difficult question from a data privacy point of view. Regulatory obligations to share customer databases would be controversial from this standpoint.
Though such attempts at data sharing have been made in the past.
An example I would refer to is the banking industry and the Transaction Monitoring Netherlands (TMNL) project. It was launched in 2020, with the participation of five major Dutch banks to pool transaction data and detect patterns of suspicious activity across these institutions.
However, legal challenges related to GDPR and banking regulations limited its scope. Hopefully under the new EU AML Regulation such corporations could be established within more clear legal frameworks.
As to the remote gambling industry, this does not seem to be the case that such data can be legally shared between different operators. We have obvious examples where some data may be available to all operators, such as customers included on the national RG exclusion registers.
In the current state of play, the cross-industry collaboration can be manifested in active participation of the gambling operators in various public consultations of the legal acts, perhaps also common participation in some industry wide groups and similar endeavours.
PE: For players, what more can they individually do to make sure they are not falling foul of any money laundering or other criminal activity rules?
PL: They should place more awareness on dealing with regulated businesses. Once the player realises that in terms of AML compliance the remote gambling operator is also a subject person, e.g. a bank, this could change the perception of a statistical customer. This is because I think a typical customer would be more willing to share their CDD/EDD documents with a bank versus a remote gambling operator.
It is important for players to answer all CDD/EDD related questions truthfully and provide full, un-edited documents to avoid potential delays. It is also important for customers to remember after all, they operate in an online environment. Therefore, sharing customers personal details with third parties can expose the customer to identity theft, as well as account takeover.
Importantly, players need to ensure they are aware of their ‘healthy limits’ and know when to stop, remembering gambling should be a fun activity.
PE: What key topics are you looking forward to speaking and hearing about at SBC Summit Malta?
PL: I would like to thank the organisers for inviting me to share my expertise during the summit. I think that SBC Summits are good occasions for the industry to get together, network, as well as seeing what is going on in the general industry in terms of providers, solutions offered, and directions taken by various industry participants.
I am looking forward to sharing my expertise in the field of AML in the panels dedicated to the latest regulatory developments, AI and machine learning, and the use of such innovative tools as a shield and also a sword to protect the organisations from ML/TF threats.
Secure your spot at SBC Summit Malta with our discounted ‘Group Pass’. For groups of three or more, you can gain access to three days of networking, exhibition, and conference content for the price of €400 (a discount of €200 off a standard ticket).
Additionally, you can purchase our ‘Expo+ Pass’ for €150. This pass grants you access to the conference and exhibition only. Operators and affiliates can apply for complimentary passes.
Source: Payment Expert