How anti money laundering works in Hong Kong's legal betting system

Background: Legal Betting and AML Obligations in Hong Kong

Hong Kong's gambling policy recognises that there is substantial and persistent public demand for gambling. The public policy choice is to satisfy that demand through limited, authorised and regulated betting channels, rather than leaving it to illegal operators.¹ In practice, that legal channel is the Hong Kong Jockey Club.

The Club offers three main products: horse racing, football betting and the Mark Six lottery. Racing remains the core product, with customers able to bet on Hong Kong race meetings and selected overseas simulcast races. Football betting is offered on authorised matches and competitions. Mark Six operates as a lottery, with customers purchasing number selections for scheduled draws.

Customers bet through several channels. They may place bets at racecourses during race meetings, at off course betting branches, or through remote channels linked to betting accounts. Account based customers can use digital and telephone channels. Retail customers can place cash bets at authorised physical outlets. This means the Club must manage two very different environments at once: identified account activity and anonymous cash-based activity.

AML accountability outside financial sector supervision

The HKJC is licensed under the Betting Duty Ordinance by the Secretary for Home and Youth Affairs. It is not supervised as a financial institution under Hong Kong's Anti Money Laundering and Counter Terrorist Financing Ordinance. That does not mean AML is absent. It means accountability is built through gambling regulation, criminal law, licence expectations and practical cooperation with enforcement agencies.²

This matters because the Club's risk is not the same as a bank's risk. The key questions are practical: who is the customer, whose money is being used, does the betting activity make sense, is the account being used for genuine betting, and should suspicious activity be reported to law enforcement?

This legal position shapes how controls are implemented. The Club's obligations sit across gambling licensing, criminal law, suspicious transaction reporting duties and day to day cooperation with enforcement agencies. The practical test is whether suspicious activity can be identified, assessed and reported quickly enough tobe useful.

Core legal duties

Four pieces of legislation sit at the centre of the HKJC's financial crime obligations.

• Organised and Serious Crimes Ordinance makes it an offence to deal with property known or suspected to represent crime proceeds and requires suspicious transaction reports to be filed with the Joint Financial Intelligence Unit as soon as practicable.³
• Prevention of Bribery Ordinance treats the HKJC as a public body, meaning employees are public servants for bribery offences.
• Drug Trafficking (Recovery of Proceeds) Ordinance imposes equivalent reporting obligations for suspected drug trafficking proceeds.⁴
• ‍United Nations (Anti-Terrorism Measures) Ordinance prohibits the dealing with funds belonging to UN Sanctioned entities.

Suspicious transaction reporting through the JFIU

Suspicious Transaction Reports are filed electronically with the Joint Financial Intelligence Unit, jointly operated by the Hong Kong Police Force and Customs and Excise Department. The JFIU analyses reports, disseminates intelligence to law enforcement and, where appropriate, works with overseas financial intelligence units.⁵

Day to Day AML Controls

Customer identification and account controls

For betting accounts, identity is verified at account opening using official documents. Each account must be registered in the customer's own name and the Club allows one account per person, no corporate accounts, no syndicates and no third-party transfers. From its opening, the account is therefore tied to a named individual.

Cash betting is harder because anonymity is higher. The Club manages this through cash bet limits, ID recording at defined thresholds and staff trained to identify and escalate suspicious behaviour at branches and racecourses.

The practical challenge is proportionality. A legal betting operator must avoid creating unnecessary friction for ordinary customers while still identifying the small number of cases that may involve criminal funds, third party control or attempts to disguise the origin of money. That requires a combination of customer information, transaction monitoring, staff judgement and escalation procedures.

Beneficial ownership and third-party control risk

Beneficial ownership means understanding who controls or benefits from the funds used to bet. In gambling, this often looks different from banking and must be addressed through product design and behavioural monitoring.

The account structure is the main control. Bank accounts linked to the betting account are verified to belong to the betting account holder and must be a local Hong Kong account (i.e. no overseas transfers). Combined with the one account rule and the ban on third party bank and account-to-account transfers, this greatly limits the scope for another person to direct or benefit from account activity.

Where risk remains, group analysis is critical. A pattern where several people deposit cash into the same account across different branches may suggest third party control, illegal bookmaking, loan sharking or organised crime activity. The opposite pattern, where one apparent source supports several accounts, can raise similar concerns.

This is why account level rules and behavioural detection need to work together. A customer's formal identity may be clear, but the real risk question is whether the activity is genuinely that customer's own. Patterns involving repeated cash deposits by different individuals, rapid movement of funds with limited betting, or transactions inconsistent with the customer's known profile may indicate that the named account holder is acting for someone else.

Ongoing monitoring and behavioural detection

Sole operator status gives the HKJC a complete view of each account customer's activity across racing, football and lottery products. That allows behavioural baselines to be built and unusual changes to be identified more clearly than in markets where customers can spread activity across several licensed operators.

Suspicious Activity Indicators

The Club uses the JFIU's SAFE approach,⁶ Screen, Ask, Find and Evaluate, and monitors indicators including:

• Significant or unexplained changes in betting account activity
• Transaction patterns suggesting a customer may be deliberately structuring below ID recording thresholds
• A high number of different off-course Retail branches used to deposit cash to the same account
• Accounts receiving regular deposits with little or no corresponding betting activity
• Funds flowing into multiple accounts from a common apparent source
• Customers whose betting activity is inconsistent with their apparent financial profile or stated explanation

Money laundering typologies in betting accounts

A typical laundering pattern follows placement, layering and integration. Illicit funds are deposited into an account, a small amount is used for genuine betting, and the remaining balance is withdrawn to the customer's linked bank account as apparently legitimate gambling proceeds.

The risk is not that every large bet is suspicious. Serious bettors may place high value bets for legitimate reasons. The concern arises when betting behaviour does not fit the surrounding facts: funds arrive in unusual ways, the level of activity is incommensurate with the customer’s background, the customer cannot explain the source of money, the account is used mainly as a pass-through mechanism, or the pattern appears designed to create a clean looking withdrawal rather than to participate genuinely in betting.

The JFIU has also noted that elevated bank activity on the first banking day after Hong Kong racing may indicate illegal bookmaking settlement, which helps inform monitoring rules.

Escalation, Enhanced Due Diligence and Reporting

When routine controls identify higher risk activity

Enhanced due diligence is triggered by risk, not by a single statutory threshold. Triggers include unusual deposit or withdrawal patterns, group analysis suggesting third party control, Politically Exposed Person status, adverse media, sanctions exposure, or intelligence from the JFIU, Police or Independent Commission Against Corruption.

In practice, enhanced due diligence is an investigative process rather than a single form. It may involve reviewing account history, deposit and withdrawal routes, customer explanations, open source information, adverse media, internal intelligence and previous interactions with front line staff. The aim is to decide whether the activity can be reasonably explained or whether suspicion remains.

Source of funds and source of wealth checks focus on whether the customer's activity makes economic sense. A customer unable or unwilling to explain large cash deposits across multiple branches may itself be creating grounds for suspicion.

Where suspicion is not resolved, the Club can suspend or close the account and file an STR. In active investigations, timing is coordinated carefully with law enforcement to avoid tipping off the subject.

Governance and Assurance

The robustness of the HKJC's AML framework does not rest on a single control. It comes from the way customer controls, transaction monitoring, staff escalation, compliance review, investigation capability and independent assurance operate together. This layered structure helps ensure that concerns can be identified at the point of transaction, reviewed by specialist teams and tested through assurance processes.

• First line: front line operations apply day-to-day controls, including cash limits, ID recording, account opening checks, bank account linkage, device binding, the prohibition on credit betting and the reporting of suspicious behaviour by staff.
• Second line: risk and compliance teams set policy, conduct risk assessments, deliver training, conduct detailed investigations and enhanced due diligence, and coordinate with law enforcement where necessary.
• Third line: internal audit provides independent assurance that controls are operating as intended and that weaknesses can be identified, escalated and remediated.

Issues and Challenges

While the Club has a strong AML framework in place to mitigate such risks, the risk landscape is continually evolving.

Customer and criminal behaviours continually evolve, and it is critical that detection and investigative processes can respond to such changes in a timely manner and remain fit-for-purpose. Regulatory expectations are shifting away from “tick-box compliance” towards governance effectiveness.

Advancements in artificial intelligence has seen criminals shift towards “fraud-as-a-service” where illicit tools, infrastructure, and services are available for rent or sale. This has significantly lowered the barrier to entry by enabling individuals with minimal technical knowledge to commit fraud faster, at scale, at lower cost, and with high credibility. Institutions need to stay continually vigilant, not be complacent, and ensure that risk controls can address emerging risks.

A further challenge is that legal and illegal betting markets can interact. Illegal bookmakers may use legal betting channels for hedging, settlement or to give activity a legitimate appearance. This makes it important for monitoring teams to understand betting behaviour, not just financial transactions. A pattern that looks ordinary in banking data may look unusual when viewed through a betting integrity lens.

Future Development

Monitoring will continue to evolve through machine learning and generative AI. These tools may improve detection of complex patterns, but only if calibrated carefully: too many false positives overwhelm investigators, while overly narrow models miss real risk.

The strongest systems will combine technology with experienced human review. Algorithms can identify links and anomalies at scale, but investigators still need to understand the betting context, the customer's explanation, and the wider intelligence picture. This is particularly important in cases involving suspected illegal bookmaking or organised groups, where activity may be deliberately structured to appear routine.

Hong Kong's wider AML framework is also likely to keep developing in line with peer jurisdictions and FATF expectations. Faster payments, digital wallets, cryptocurrency exposure through illegal offshore betting, and sanctions risk will all require continued monitoring.

Conclusion

The goals for any institution managing AML risk, regardless of sector, are familiar: identify customers, understand funds, detect suspicious activity and support enforcement.

The main lesson is practical: strong controls depend on risk understanding, reliable data, trained staff, technology that supports judgement, and close relationships with law enforcement. Those foundations matter more than the specific legislative route through which obligations arise.

For lotteries and betting operators elsewhere, the broader point is that AML must be adapted to the product, the customer journey and the local legal environment. A framework that works well in banking will not automatically work in betting. The best approach is one that keeps the core AML objectives intact while designing controls around the specific ways in which betting products can be misused.

‍

Lucy Mullens is Executive Manager, Integrity and Financial Crime Risk, at the Hong Kong Jockey Club. She presented on this topic at the WLA/European Lotteries Seminar in May 2026. Contact: [email protected]

‍