AML Supervision by the Gambling Regulatory Authority (GRA)
In a Nutshell
The Gambling Regulatory Authority (GRA) is the AML/CFT/CPF supervisor for Singapore’s casinos. It was formed on 1 August 2022 as successor to the Casino Regulatory Authority.
The rulebook is the Casino Control Act 2006 and the Casino Control (Prevention of ML, TF and PF) Regulations 2009. The regime is built around cash and patron due diligence.
Cash drives the controls. Cash transaction reports are required for cash in or cash out of S$10,000 or more in a gaming day. Customer due diligence is required at applicable thresholds, including qualifying cash transactions and deposits of S$4,000 or more.
There are two casino operators, Marina Bay Sands and Resorts World Sentosa. GRA regulates the operators under the Casino Control Act 2006 and the applicable subsidiary legislation.
AML Supervision by the Gambling Regulatory Authority
A casino is a cash machine at scale: chips bought and redeemed, deposits placed and withdrawn, large sums moving quickly with an air of legitimate play. That makes casinos one of the most closely watched sectors in any anti money laundering regime. In Singapore, the two licensed casino operators are supervised for AML compliance by the Gambling Regulatory Authority. This guide explains how GRA does that: its history and legal basis, whom it supervises, the cash and due diligence controls at the heart of the regime, how it inspects and shares information, and how it enforces.
For the full set of supervisors, see the guide to AML supervisory authorities. For the underlying statutes, see the AML laws and regulations in Singapore pillar. This page is about GRA as an AML supervisor of casinos.
Why Casinos Are Watched So Closely
A casino converts cash into chips and chips back into cash, cheques or transfers, at speed and in volume, and it does so for patrons who may travel from anywhere. That is close to an ideal laundering environment: a launderer can buy in with illicit cash, gamble minimally, and cash out with a clean looking record of winnings or move value through deposit accounts and credit. High value international patronage adds cross border risk on top. Those features are exactly why the Casino Control regime wraps the floor in cash transaction reporting, patron due diligence and an onsite regulator, and why the national risk assessment treats the sector as higher risk.
History and Legal Basis
The Gambling Regulatory Authority succeeded the Casino Regulatory Authority on 1 August 2022 under the Gambling Regulatory Authority Act 2022. Its regulatory remit extends beyond casinos. The casino AML framework is principally governed by the Casino Control Act 2006 and the Casino Control (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Regulations 2009, as amended. The framework addresses cash transaction reporting, customer due diligence, record keeping, suspicious transaction reporting, training and independent audits. Amendments to the Casino Control Act 2024 took effect in stages, with a further tranche commencing on 21 September 2026.
It is worth separating two things that share the GRA name. GRA regulates a range of gambling activities, but the AML supervision this guide describes is specifically the supervision of the licensed casino operators under the Casino Control framework. The broader gambling mandate carries its own controls; the casino AML regime is the one with the detailed cash and due diligence rules.
Who GRA Supervises
The regime applies to the two licensed casino operators at Marina Bay Sands and Resorts World Sentosa. Relevant personnel are subject to the licensing, suitability and approval requirements prescribed by the Casino Control Act and its subsidiary legislation. GRA’s regulatory powers and responsibilities should be described by reference to those statutory provisions and its published requirements.
We help operators pressure test patron due diligence, cash transaction reporting and monitoring against exactly what GRA inspects.
How GRA Supervises
GRA regulates casino operators under the Casino Control Act and the applicable subsidiary legislation. Its supervisory and enforcement responsibilities should be described by reference to its statutory powers and published regulatory requirements.
GRA licenses casino operators and regulates relevant personnel, including special employees, under the applicable licensing and suitability requirements. It oversees casino operators’ compliance with the Casino Control Act and the applicable Regulations, including their AML controls, patron due diligence, cash transaction reporting, monitoring and record keeping. GRA may take regulatory or disciplinary action where the applicable legal requirements are breached. The nature and extent of its supervisory activities should be described by reference to GRA’s published regulatory powers and requirements, rather than assuming that all supervision is continuous or that every operator is subject to the same inspection cycle.
Casino operators must maintain the AML controls, customer due diligence procedures, transaction records and other documentation required by the applicable legislation and regulatory requirements. They must also comply with the prescribed cash transaction reporting, ongoing monitoring, record keeping, training and independent audit requirements. Specific claims about GRA’s inspection procedures, including the testing of cage, count room or surveillance controls, should be included only where supported by an official GRA publication or applicable legal requirement.
Cash, Customer Due Diligence and Reporting
The casino AML regime is built around cash, and the thresholds are specific. The table below sets out the core triggers; confirm the exact figures and any updates against the current Regulations before relying on them.
Trigger | Obligation |
A single cash transaction involving cash in or cash out of S$10,000 or more | File a cash transaction report |
Multiple cash transactions known to have been entered into by or on behalf of a patron, with aggregate cash in or cash out of S$10,000 or more during a gaming day | File a cash transaction report |
Qualifying payment or receipt of S$4,000 or more by the casino operator | Apply the identification and verification requirements in the Regulations |
Other circumstances specified in the Regulations | Apply the relevant identification and verification requirements in the Regulations |
Higher risk patrons | Apply enhanced customer due diligence as required by the Regulations |
Existing patrons | Apply the applicable ongoing customer due diligence and monitoring requirements |
Transactions or circumstances raising ML, TF, PF suspicion | Submit a suspicious transaction report in accordance with the applicable reporting requirements |
Two distinctions matter. First, a cash transaction report is required when the statutory S$10,000 cash in or cash out threshold is met, regardless of whether the transaction is suspicious. The casino operator must file the cash transaction report with a Suspicious Transaction Reporting Officer before the end of the applicable reporting period. The operator must also submit a copy of the report to GRA when filing or immediately afterwards. A suspicious transaction report is a separate obligation arising where the any suspicion arises and has no threshold amount. Second, enhanced customer due diligence applies to higher risk patrons, including politically exposed persons, in accordance with the Regulations. The measures required, including any steps relating to source of wealth or funds, depend on the applicable provisions and circumstances.
Information Sharing
With effect from 21 September 2026, the Casino Control Act requires casino operators to share prescribed patron risk information with each other for the purposes of addressing money laundering, terrorism financing and proliferation financing risks. The framework is intended to enable operators to respond more quickly when a patron is identified as presenting higher ML, TF or PF risks. This information sharing framework is distinct from the obligation to submit suspicious transaction reports to the Suspicious Transaction Reporting Office and does not replace that obligation. Casino operators must comply with the applicable statutory requirements governing the information that may be disclosed and the safeguards for handling it.
The Casino Compliance Calendar
Casino AML duties include licensing obligations, ongoing AML controls, transaction reporting, customer due diligence, record keeping, training and independent audits. The timing of each obligation depends on the applicable legislation, licence conditions and regulatory requirements.
Duty type | Examples | Cadence |
Licensing and regulatory | Casino licence conditions, relevant personnel licensing and information required by GRA | As prescribed by the applicable legislation, licence conditions or GRA requirements |
Ongoing AML controls | Internal AML framework, risk assessment, training, monitoring and independent audit | In accordance with the applicable Regulations and relevant requirements |
Transaction and patron triggered duties | Customer identification and verification, enhanced due diligence, cash transaction reports and suspicious transaction reports | When the applicable statutory conditions are met |
So, the everyday AML work is event driven, keyed to cash and patron activity on the floor, while the licence and returns provide the fixed points. There is no single annual AML return that stands in for the continuous, transaction level controls a casino must run.
The Gambling Regulatory Authority and the National Strategy
Singapore’s 2024 Money Laundering national risk assessment identifies casinos among the sectors presenting higher money laundering risks. The assessment discusses vulnerabilities arising from the cash intensive nature of casino operations, the use of casino chips to store or move value and the international customer base. These findings support risk based AML measures and supervisory attention to relevant casino activities. Any statements about the FATF and APG Mutual Evaluation, including its findings and assessment cut off date, should be checked against the published mutual evaluation report before publication.
The cross border dimension is relevant to casino AML risk because casino operators may serve patrons from different jurisdictions. Operators must apply the customer due diligence and enhanced due diligence measures required by the applicable Regulations, taking account of the patron’s risk profile and the circumstances of the transactions. The Regulations also require ongoing monitoring and enhanced due diligence for higher risk patrons.
Enforcement
GRA’s enforcement powers include financial penalties and regulatory or disciplinary action available under the applicable Casino Control legislation. Any discussion of statutory maximum penalties should distinguish the maximum penalty permitted by the applicable legislation from the amount imposed in a particular case.
Putting Supervision into Practice
What a GRA Inspector Looks At
Cash transaction reports: whether reports are filed at S$10,000 or more in a gaming day.
Deposit and relationship CDD: whether CDD is performed at deposits of S$4,000 or more and on a relationship basis.
Enhanced due diligence: whether higher risk and politically exposed patrons get enhanced measures.
Source of funds and surveillance: whether high value play is scrutinised and the cage workflow leaves an evidence trail.
Worked example (illustrative)
A patron purchases S$12,000 in chips using cash during a gaming day. This transaction meets the S$10,000 cash transaction reporting threshold. If the patron subsequently makes a S$5,000 deposit, the operator must apply the identification and verification requirements applicable to that deposit under the Casino Control Act and the Regulations. The operator must assess each obligation separately and maintain the records required by law.
Recent enforcement and what it signals
December 2023: GRA imposed a S$2.25 million penalty for customer due diligence failings. The signal is that the cash and CDD thresholds are enforced obligations, not formalities
Your Reporting Line: STRO
Whoever supervises you, you report suspicion to the same place. Casino operators must comply with the suspicious transaction reporting requirements under the applicable legislation and Regulations. Where the relevant reporting obligation is triggered, the operator must submit a suspicious transaction report to the STRO through the applicable reporting process. This reporting obligation is separate from GRA’s role as the casino supervisor.
Conclusion
GRA regulates Singapore’s licensed casino operators under the Casino Control Act 2006 and the Casino Control (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Regulations 2009, as amended. The framework includes cash transaction reporting, customer identification and verification, ongoing monitoring, enhanced due diligence for higher risk patrons, record keeping, training, independent audits and suspicious transaction reporting. Operators must apply the S$10,000 cash transaction reporting threshold and the S$4,000 identification and verification thresholds in the circumstances prescribed by the legislation. They must also comply with the patron information sharing requirements that took effect on 21 September 2026. Source of wealth and source of funds measures must be applied where required by the applicable provisions and the circumstances of the patron relationship.
If you need casino AML controls tested or built, our AML policy documentation service can help, and suspicions go to the Suspicious Transaction Reporting Office.
Be prepared with documented policies, effective client verification procedures and risk based safeguards that support compliance with supervisory expectations.
Frequently Asked Questions
The Gambling Regulatory Authority, formed on 1 August 2022 as successor to the Casino Regulatory Authority, supervises the licensed casino operators for AML, CFT and CPF under the Casino Control Act 2006 and the Casino Control (Prevention of ML, TF and PF) Regulations 2009.
No. GRA has a broad gambling mandate, but the detailed AML regime described here applies to the licensed casino operators under the Casino Control framework. Other gambling activities carry their own controls.
Two, at Marina Bay Sands and Resorts World Sentosa. GRA supervises the licensed casino operators under the Casino Control Act 2006 and the applicable Regulations.
The Casino Control Act 2006 and the Casino Control (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Regulations 2009, which set cash transaction reporting, customer due diligence, record keeping and suspicious transaction reporting obligations.
A casino operator must file a cash transaction report with its Suspicious Transaction Reporting Officer when a single cash transaction involving cash in or cash out reaches S$10,000 or more, or when qualifying multiple transactions meet the aggregate threshold during a gaming day. The report must be filed before the end of the applicable reporting period, which ends 15 days after the relevant single transaction or the last transaction in a qualifying series. The operator must also provide a copy to GRA in accordance with the Regulations.
Potential compliance failures include failing to identify and verify patrons when required under the Regulations, failing to apply the required enhanced customer due diligence measures to higher risk patrons, failing to conduct ongoing monitoring, and failing to maintain the records or AML framework required by law. The regulatory consequences depend on the applicable statutory provision, the nature of the breach and the relevant enforcement powers.
About the Author
Pathik Shah
FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)
Pathik is a Chartered Accountant with more than 26 years of experience in governance, risk, and compliance. He helps companies with end-to-end AML compliance services, from conducting Enterprise- Wide Risk Assessments to implementing the robust AML Compliance framework. He has played a pivotal role as a functional expert in developing and implementing RegTech solutions for streamlined compliance.
