Estonian FIU targets gambling sector cash-in, cash-out risks

The Estonian Financial Intelligence Unit (FIU) has put a specific reference number on a familiar gambling-sector money-laundering risk. Typology notice **10TT202607**, issued on 28 July 2026, focuses on customers who deposit funds, gamble little or not at all, and withdraw soon afterwards.

The sequence matters because a payout from a gambling operator can make funds appear to have come from gambling activity. The FIU is asking market participants to identify that pattern more consistently and report it when the customer explanation and enhanced checks do not remove the suspicion.

The filing trigger

The notice describes a linked sequence rather than a single suspicious transaction:

1. A customer funds an account.
2. The customer does not gamble, or places only limited low-risk bets.
3. The customer withdraws the remaining funds after a short period.
4. The surrounding customer, payment and risk information does not provide a satisfactory explanation.

Where the pattern and wider risk indicators point to suspicious activity, the provider must consider enhanced due diligence. If suspicion remains, the report to the FIU should carry the typology reference **10TT202607**.

Risk factors to connect

The FIU does not present cash-in/cash-out behaviour as a standalone automatic verdict. Its notice identifies factors that can raise risk when considered with the transaction pattern, including:

- remote online gambling;
- customers connected to countries with high or very high money-laundering risk;
- cryptocurrency deposits or withdrawals; and
- foreign-linked service companies that are harder to supervise.

The control implication is a joined-up alert, not another isolated threshold. Transaction monitoring should connect the deposit, gambling activity and withdrawal; the review should then bring in customer risk, payment method, source-of-funds evidence and relevant geographic or corporate links.

What operators should test

Compliance teams should be able to answer four practical questions:

- Can monitoring distinguish meaningful play from nominal low-risk activity between deposit and withdrawal?
- Does an alert retrieve the customer and payment risk factors needed for an explanation?
- Can the case move into enhanced due diligence without losing the original transaction sequence?
- Does the reporting workflow preserve **10TT202607** when suspicion remains?

That last step is operationally important: the code gives the FIU a consistent way to identify reports linked to the typology.

Why the notice matters

The FIU says Estonia's gambling sector carries an above-average money-laundering risk. It also reports a concentrated reporting picture. At the end of 2025 there were 58 gambling licences; of 45 companies actively providing gambling services, 17 filed reports in the previous year, and three Estonian companies submitted 93% of those reports.

Those figures do not prove under-reporting by any individual operator. They do explain why the FIU is trying to make the detection and filing expectation more concrete across the market.

The communication is an AML typology notice, not a new licence category, tax measure or player-protection rule. It sets no separate implementation deadline. Operators should nevertheless test the scenario and reporting reference against their current controls rather than waiting for a later supervisory date.

**Official source:** Estonian FIU typology notice 10TT202607 (28 July 2026).