How a casino tracks suspicious transactions

Online casinos are obliged to prevent money laundering, terrorist financing and financial fraud, while maintaining a completely comfortable user experience. In practice, this means continuous collection of signals, their automatic analysis, escalation of alerts to investigations and, if necessary, a report to the regulator. Below is how this "radar" works in practice.

1) Data on which monitoring is based

Transactions: Deposits, withdrawals, cancellations, chargebacks, payment methods, currencies, rates.

Player profile: age/CCM status, country/address, source of funds (with EDD), limits.

Behavior in the product: frequency of sessions, bets/winnings, "chase," night activity.

Device and network: device fingerprint, IP/ASN, proxy/VPN, device changes, geo-drift.

Connections: the same cards/wallets for different accounts, common devices/addresses, referral chains.

External lists: sanctions, PEP, negative media.

2) First level rules (deterministic)

Classic velocity and threshold rules catch obvious violations and launch "fast" alerts:

N series of short-term deposits (structuring).
Map country and geolocation mismatch, IP/ASN jumps.
Quick withdrawal after a large deposit/rare bets (pass-through).
Multiple cancellations/chargeback pattern.
Minor/suspicious document (KYC mismatch).
For live/strategy games - collusion: the same betting patterns in sync.

Each rule has a threshold, time window, severity and action: "lock/stop payment," "pause and manual review," "continue but lower limits."

3) Second level models (scoring and ML)

When one set of rules is not enough, risk scoring is turned on:

Behavioral scoring: frequency/rhythm of sessions, "chase," abnormal volatility of bets.
Geo-scoring: location stability, network quality, ASN reputation.
Payment profile: mix of methods, rare PSP, repetition of chargebacks.
ML models: autoencoders/isolation scaffolding for anomalies, gradient boosting for "fraud/non-fraud."
Cut-off calibration: At business risk to keep FPRs (false positives) at an acceptable level.

4) Graph analytics and risk clusters

Connections between accounts are a powerful signal:

Shared devices/browser signatures that match IP/proxy.
Financial edges: one card/wallet for several accounts, "overflows" via P2P.
Social ribs: referrals, chats, simultaneous entrances.
Algorithms: connected components, PageRank by risk, community detection - find "farms" and collusion.

5) Alert → case life cycle

1. Rule/model triggered → alert with metadata.

2. Deduplication (one incident instead of 20 duplicates), priority/severity.

3. Case management: checklist for analyst (KYC, payment logs, IP reputation, relationship graph).

4. Solution: cleared/escalation/restrictions (limits, output freeze, request for documents).

5. Documentation: causes, artifacts, screenshots, timeline.

6. Model feedback: True/false labels for retraining and fine tuning.

6) When STR/SAR is generated

Signs of structuring/smurfing, lack of a convincing source of funds.

Links with sanctions/RAP risks and negative media updates.

Systematic pass-through (input → minimum activity → output).

Collusion/organized bonus abuse.

The duties and timing of filing vary by jurisdiction; the player is not notified (tipping-off is prohibited).

7) Protection of cash and conclusions (operations with money)

Money idempotency: unique 'txn _ id' + 'Idempotency-Key' to prevent replays/attacks from creating takes.

Signed Webhooks PSP/KYC (HMAC) and anti-replay (timestamp/nonce).

Limit split: deposits/withdrawals, daily/weekly thresholds, step-up KYC for upgrade.

Stop-loss and vager validation before withdrawing bonus funds.

"Cooling" of large leads and selective manual check.

8) Balance of UX and control

Step KYC: minimum entry barrier + risk EDD.

Alert triage: light - auto-cleaning for secondary verification; heavy - in priority queue.

Transparency: verification/ETA status, clear requirements for documents; fewer support calls.

Soft nudges with risk patterns (night peaks, "chase").

9) Monitoring quality metrics

TPR/FPR by alert and by case; Precision/Recall.

Alert-to-Case ratio and average TTR (time to resolution).

SAR rate and cases confirmed by the regulator.

Chargeback rate, fraud-loss%, ROI from fraud filters.

Customer friction: average withdrawal time, proportion of "clean" customers affected by checks.

10) Typical scenarios (from practice)

Quick Deposit → Instant Withdrawal. Triggers: rare PSP, new device, IP from high-risk-ASN. Action: hold + EDD.

Spraying deposits into multiple accounts from the same card/device. Triggers: graph match, velocity. Action: linking cases, block before explanation.

Live Game Collusion: Synchronous Betting, Shared IP/Devices. Action: Investigating with provider, rolling back T&C winnings

Bonus abuse: a bunch of registrations with the same templates. Action: closing the "farm," blacklisting, KYC step-up at the entrance.

11) Privacy and security in investigations

Minimizing access: RBAC/ABAC, JIT rights, audit case reading.

PII/KYC encryption: individual keys (KMS/HSM), short retention of KYC media.

Immutable logs (WORM): fitness for forensics and checks.

DPIA/DSR: GDPR processes (access/fix/delete).

12) Frequent errors

The same thresholds for all markets and payments.

No sanctions/REP rescreening (lists are updated daily).

No alert deduplication → noise, team burnout.

Ignoring graph links - farm schemes take a long time.

Twist WAF/bot checks - break CCP/payments and increase FPR.

There is no feedback in the model - ML is not learning, the quality is not growing.

13) Launch and maturity checklist (save)

Set of threshold rules + time windows covering key risks
Risk scoring (behavior/geo/payments) and ML anomalies with periodic calibration
Device/Wallet/Card/Referral Graph Analytics
Case management with checklists, SLAs, deduplication, and auditing
Money idempotence, webhooks with HMAC, anti-replay
Step-up KYC/EDD, limits and lead cooling
SIEM, dashboards (p95 box office latency, alerts/cases/TTR)
Sanctions/REP and adverse media rescreening
Retention/encryption policies, WORM archives
Post-sea and regular backtesting of rules/models

Tracking suspicious transactions is not one filter, but an agreed complex: deterministic rules, behavioral scoring, graph communication, the correct investigation process and privacy. Strong operational discipline (idempotency of money, signed webhooks, case management) and constant calibration of models allow you to reduce losses and false positives at the same time - while maintaining player confidence and compliance with regulatory requirements.