Banking High-Risk Sectors: MSBs, Casinos and Cannabis

Why This Topic Matters
Banks and other financial institutions are the gatekeepers of the formal financial system. When they open accounts for businesses that themselves handle large volumes of cash or provide financial services to the public, they inherit a layer of risk they cannot directly observe. Money services businesses (MSBs), casinos and cannabis-related businesses (CRBs) are the three sectors most frequently cited by regulators, FATF and enforcement actions as presenting elevated money laundering and terrorist financing exposure. Understanding how these sectors operate, why they are vulnerable, and how a financial institution should risk-rate, onboard and monitor them is a core competency tested on the CAMS examination under the Financial Crime Risks and Methods domain.

Historically, many banks responded to this risk by simply refusing to bank these customers – a practice known as de-risking. FATF, FinCEN and other regulators have repeatedly warned that wholesale de-risking pushes legitimate activity into less transparent channels and undermines financial inclusion. The expected approach is a risk-based approach: understand the customer, apply enhanced due diligence (EDD) proportionate to the risk, and monitor accordingly. Exam questions are built around this principle.

What Are High-Risk Sectors?
A high-risk sector is a category of customer whose business model inherently involves one or more of the following characteristics:
• Cash intensity (large volumes of currency flowing in or out)
• Rapid movement of funds, often cross-border
• Provision of financial services to third parties whom the bank cannot see (nested or indirect customers)
• Legal or regulatory ambiguity (activities legal in one jurisdiction but illegal in another)
• Historical use by criminals for placement, layering or integration

MSBs, casinos and cannabis businesses each tick several of these boxes, which is why they appear in FATF typology reports, national risk assessments and regulator examination manuals as sectors requiring heightened attention.

Sector 1: Money Services Businesses (MSBs)
What they are: MSBs include money transmitters (remittance firms), currency exchangers (bureaux de change), check cashers, issuers and sellers of money orders, travelers' checks and prepaid access (stored value), and in many jurisdictions virtual asset service providers. In the United States they are regulated under the Bank Secrecy Act, must register with FinCEN, obtain state licenses, and maintain their own AML programs. Internationally they are covered by FATF Recommendation 14 (Money or Value Transfer Services) and must be licensed or registered and supervised.

Why they are high risk:
• Cash-intensive at the point of sale, facilitating placement
• Allow rapid cross-border transfers, facilitating layering
• Many operate through agent networks – the principal MSB is responsible for its agents, but oversight of thousands of small retail agents (convenience stores, grocers) is difficult
• Customers are often occasional or walk-in, making CDD thinner than at a bank
• Structuring is common: senders break transactions below recordkeeping or reporting thresholds (e.g., the USD 3,000 funds transfer recordkeeping threshold or USD 10,000 CTR threshold)
• Unlicensed or unregistered MSBs operate outside oversight entirely, and some informal value transfer systems (hawala, hundi) leave little paper trail
• Nested accounts: an MSB may itself serve other MSBs or foreign exchange houses, so the bank is effectively servicing unknown third parties

How a bank should manage MSB customers:
• Confirm FinCEN (or local) registration and state/national licensing; verify the license covers the services actually offered
• Obtain and review the MSB's own AML program, independent audit results and risk assessment
• Understand the agent network: number of agents, geographic footprint, how the MSB monitors them
• Identify expected transaction volumes, corridors served and customer base, then monitor for deviations
• Look for red flags such as volumes inconsistent with business size, transfers to high-risk jurisdictions unrelated to the stated customer base, round-dollar deposits just under thresholds, or cash deposits far exceeding what the agent locations could plausibly generate
• Note that the bank is not required to perform CDD on the MSB's customers, but must understand the MSB's activity well enough to identify suspicious patterns

Sector 2: Casinos and Gaming
What they are: Casinos, card clubs, racetracks and online gaming operators. In the US, casinos with gross annual gaming revenue above USD 1 million are defined as financial institutions under the BSA and must file CTRs (the casino-specific form) and SARs, maintain AML programs and keep records of certain transactions. FATF Recommendation 22 extends CDD obligations to casinos as Designated Non-Financial Businesses and Professions (DNFBPs) when customers engage in transactions at or above USD/EUR 3,000.

Why they are high risk:
• Extremely cash-intensive – cash in, chips out, cash back
• Provide quasi-banking services: deposit accounts (front money), credit (markers), safekeeping, check cashing, currency exchange and wire transfers
• Chips, tokens and tickets act as bearer instruments inside the casino, allowing value to be transferred between individuals
• A classic laundering method: buy chips with illicit cash, gamble minimally, cash out and request a casino check or wire – the proceeds now appear to be gambling winnings
• Junket operators bring high-net-worth gamblers (often from Asia) to casinos and may handle their funds, creating opacity about the true source of funds and the identity of the ultimate player
• Structuring chip purchases or redemptions below reporting thresholds, often by multiple associates working together
• Use of third parties to cash out another person's chips
• Online gaming adds non-face-to-face risk, use of e-wallets and cross-border payment flows

How a bank should manage casino customers:
• Confirm licensing with the relevant gaming authority and understand the casino's own AML program and reporting history
• Establish a baseline of expected cash deposits, check issuance and wire activity, then monitor for unexplained spikes
• Pay particular attention to wires sent on behalf of patrons, especially to or from high-risk jurisdictions, and to relationships with junket operators
• Red flags include customers who buy large volumes of chips and cash out with little play, patrons requesting checks or wires in third-party names, frequent transactions just under thresholds, and deposits of casino checks into accounts of individuals with no evident income source

Sector 3: Cannabis-Related Businesses (CRBs)
What they are: Growers, processors, dispensaries and retailers of marijuana, plus ancillary businesses (landlords, equipment suppliers, payroll providers) that derive revenue from the cannabis industry. The defining feature is legal conflict: in the United States, cannabis is legal for medical or recreational use in many states yet remains a Schedule I controlled substance under federal law. Similar tensions exist elsewhere – Canada legalized recreational cannabis federally in 2018, while most jurisdictions still prohibit it.

Why they are high risk:
• Because proceeds from a federally illegal activity may constitute proceeds of a specified unlawful activity, banking them can expose the institution to money laundering liability under US federal law
• Many CRBs have historically operated almost entirely in cash because they could not obtain accounts, creating exactly the conditions criminals exploit
• Difficult to distinguish state-licensed, compliant operators from illicit traffickers using a licensed front
• Risk of diversion of product across state lines or to minors, and of revenue being commingled with illegal grow operations

The FinCEN 2014 guidance: FinCEN issued guidance clarifying how institutions may provide services to state-licensed marijuana businesses consistent with BSA obligations. Key elements candidates must know:
• The institution must conduct thorough CDD, including verifying state licensing, reviewing the state license application, understanding the products and customers, and ongoing monitoring of publicly available information and license status
• Marijuana Limited SAR – filed when the institution reasonably believes the business is compliant with state law and does not implicate any of the enforcement priorities set out in the (since rescinded) 2013 Department of Justice Cole Memorandum; it contains only identifying information and the phrase "MARIJUANA LIMITED"
• Marijuana Priority SAR – filed when the institution believes the business implicates one of the Cole Memo priorities or violates state law; includes full narrative detail
• Marijuana Termination SAR – filed when the institution decides to exit the relationship to maintain an effective AML program
• Continuing activity reports are required at the normal 90-day intervals
• The guidance remained in effect even after the Cole Memorandum was rescinded in 2018, and FinCEN has confirmed institutions should continue to follow it

Red flags from the FinCEN guidance: revenue substantially exceeding what the state license and stated capacity would support; deposits far greater than reported sales to state regulators; rapid movement of funds out of the account; inability to explain source of funds; commingling with personal accounts; cash deposits structured to avoid thresholds; the business or its owners appearing in negative news about illicit activity; the business operating in a state where it is not licensed; use of a bank in a state different from where it operates, suggesting an attempt to avoid scrutiny.

Hemp and CBD: Following the US 2018 Farm Bill, hemp (cannabis with no more than 0.3 percent THC) was removed from the Controlled Substances Act. Hemp businesses therefore do not require marijuana-specific SAR filings, though institutions should still verify licensing and apply standard risk-based CDD. Exam questions sometimes test whether candidates can distinguish hemp/CBD from marijuana.

Common Threads Across All Three Sectors
• Risk-based approach, not de-risking: regulators expect institutions to evaluate each customer rather than exiting a whole category
• Enhanced due diligence: licensing verification, understanding of the business model, review of the customer's own AML controls, site visits where appropriate, and documentation of expected activity
• Baseline and monitor: establish what normal looks like for the specific customer and alert on deviations in volume, geography or counterparties
• Cash intensity drives placement risk; the ability to move value quickly drives layering risk
• Nested or indirect relationships are a recurring theme: the bank is often one step removed from the person generating the funds
• SAR/STR filing remains the institution's obligation regardless of the customer's own reporting

Exam Tips: Answering Questions on Banking High-Risk Sectors: MSBs, Casinos and Cannabis

1. Default to the risk-based approach. When a question asks what a bank should do when it discovers a customer is an MSB, casino or cannabis business, the correct answer is almost never "close the account immediately" or "refuse all such customers." Look for the option that involves conducting EDD, verifying licensing, understanding the business and applying appropriate monitoring. Account closure is correct only when the question describes red flags that cannot be resolved or a business that is clearly unlicensed or non-compliant.

2. Know the registration and licensing facts. MSBs in the US register with FinCEN and are licensed by states; casinos above USD 1 million in gaming revenue are BSA financial institutions; FATF treats casinos as DNFBPs with CDD triggered at USD/EUR 3,000; cannabis businesses are licensed at the state level while remaining federally illegal in the US. Questions frequently test whether a bank should verify these licenses as part of onboarding – it should.

3. Memorize the three marijuana SAR types. Limited (compliant, identifying information only), Priority (implicates enforcement priorities or state law violations, full narrative) and Termination (relationship being exited). If a scenario describes a dispensary whose deposits vastly exceed what its state-reported sales could support, the answer is a Priority SAR, not a Limited SAR.

4. Recognize the classic laundering typology for each sector. MSBs – structuring remittances and using agent networks or hawala to move value across borders. Casinos – converting cash to chips, minimal play, cashing out via check or wire to disguise proceeds as winnings, often with junkets or third parties. Cannabis – a licensed front commingling illicit grow revenue or depositing cash far beyond legitimate capacity. When a scenario describes one of these patterns, identify the stage of laundering (usually placement or layering) and the appropriate response (investigate and file an STR/SAR).

5. Understand the bank's duty regarding the customer's customers. A bank is not required to perform CDD on an MSB's remittance customers or a casino's patrons, but it is required to understand the MSB's or casino's business well enough to detect activity inconsistent with that business. Options stating the bank must identify every end user are usually wrong; options stating the bank need not understand the customer's activity at all are also wrong.

6. Watch for de-risking distractors. If an answer choice describes exiting an entire category of customers to eliminate risk, remember that FATF and regulators have criticized this as counterproductive. It is rarely the "best" answer.

7. Separate hemp from marijuana. If a question mentions CBD or hemp products compliant with the 2018 Farm Bill, marijuana SARs are not required. Standard risk-based CDD still applies.

8. Read for red flags, then match to the response. CAMS scenario questions typically bury two or three indicators – deposits inconsistent with business size, activity in unrelated high-risk corridors, third-party cash-outs, structuring – and ask for the most appropriate next step. The sequence is: gather information and conduct EDD, escalate internally, file a SAR/STR if suspicion remains, and consider the relationship. Jumping straight to law enforcement contact or tipping off the customer is wrong.

9. Remember whose obligations are whose. The casino files its own CTRs and SARs; the MSB maintains its own AML program; the cannabis business reports sales to its state regulator. None of this relieves the bank of its own independent monitoring and reporting duty. Questions that suggest the bank can rely entirely on the customer's compliance program are testing this point.

10. Think like a regulator reviewing the file. For any high-risk customer, the examiner expects to see documented rationale for onboarding, verified licenses, an understanding of expected activity, evidence of ongoing monitoring and periodic review. Answer choices that produce this documentation trail are typically the ones the exam rewards.

Quick Recall Summary
• MSBs: cash + cross-border + agents + nesting; verify FinCEN registration and state license; review their AML program.
• Casinos: cash + bearer chips + quasi-banking services + junkets; verify gaming license; monitor patron wires and checks.
• Cannabis: federal/state legal conflict + cash; follow FinCEN 2014 guidance; Limited, Priority and Termination SARs; hemp is different.
• All three: risk-based approach, EDD, baseline-and-monitor, independent SAR obligation, avoid wholesale de-risking.