(Originally published in the January 2016 edition of the Cleveland Metropolitan Bar Journal)
The legal landscape surrounding the two main DFS websites, FanDuel and DraftKings, presents banks with a number of compliance risks. The increased scrutiny from state governments and ongoing legal battles started by individuals, as well as federal government investigations, requires banks to proceed with caution to ensure their risk management programs are appropriate while the legislature and courts resolve the legal issues.
Before looking at how banks can respond to the evolving world of DFS, a brief overview of the latest legal developments is necessary. The overall question is whether the websites involve games of skill or chance. The general rule is that games of skill are legal, while games of chance may run afoul of gambling laws. In reality, the application of this rule is much more complex. The legal challenges highlight the tension between state and federal laws, and represent a crossroads between internet gambling regulations and sports betting prohibitions. The Unlawful Internet Gambling Enforcement Act (UIGEA) states that financial institutions may not knowingly accept credits, electronic fund transfers, monetary instruments, or the proceeds of such transactions in connection with unlawful Internet gambling. FanDuel and DraftKings use the UIGEA to argue that their websites may continue operating because it defers to other federal and state laws. This argument rests on the UIGEA definition of a bet or wager. 1 The UIGEA defines a bet or wager as “the staking or risking by any person of something of value upon the outcome of a contest of others, a sporting event, or a game subject to chance, upon an agreement or understanding that the person or another person will receive something of value in the event of a certain outcome.” 31U.S.C.§5362(1). The Wire Act prohibits wire communications to place bets on sporting events or to receive winnings resulting from sports-related bets. 18 U.S. C. §1084.
Many states, however, passed laws to specifically address gambling. One such example was New York, which prohibits “any other kind of gambling, except lotteries operated by the state and the sale of lottery tickets in connection therewith as may be authorized and prescribed by the legislature.” N.Y. Const. Art. I, §9. This provision takes an extremely restrictive view on gambling. On the other hand, Kansas, passed a law allowing DFS to operate if it meets certain guidelines. K.S.A. 21-6403(d). The differing state laws make compliance efforts even more complicated.
Even though DFS presents new legal issues, the situation is similar issues to associated with offshore betting sites. As internet technology develops, residents of states prohibiting DFS may circumvent controls designed to prevent them from accessing such sites. An article in the NY Times recently examined the world of offshore sports betting through websites such as Pinnacle Sports.2 The NY Times investigators identified at least 1,700 American accounts on the website in violation of the website’s terms of use. Pinnacle Sports require users to verify that the user is located where such bets are lawful and that the user does not reside in a country where online gambling is prohibited. The users of such sites in the United States are seemingly in violation of federal laws that prohibit online sports gambling.
As a result, the money from offshore gambling sites and DFS sites could easily enter our financial institutions as illegal gambling proceeds in violation of state or federal laws. With inconsistent state laws and potentially conflicting federal laws, financial institutions have little guidance to ensure their compliance programs address these risks.
There are three main areas of risk associated with DFS. The first risk, as discussed above, involves the legality of the operations. Compliance departments must take steps to keep current information about legal developments. Banks should ensure their compliance departments understand the laws and latest legal trends surrounding gambling activities. Since the cases and complaints are quickly evolving, banks must find ways to monitor the situation. For example, banks may consider implementing measures to receive relevant news updates.
The second main area of risk associated with DFS involves the bank’s ability to identify the proceeds from DFS sites. If the courts find DFS sites are illegal in certain states, then it may become difficult to monitor whether the customer’s funds received from such sites are, in fact, illegal gambling proceeds. This is the same risk banks face with proceeds from offshore gambling sites. The websites may transfer winnings in small amounts to accounts through third-party payment processors such as PayPal. This method of transferring funds leads to what is essentially a blind spot, in which transaction monitoring fails to identify the true source of the proceeds. However, standard transaction monitoring efforts would be sufficient for large winnings because the DFS sites use wire transfers to transfer the funds.
Banks may be able to use existing Bank Secrecy Act/Anti-Money Laundering software programs to detect transactions from FanDuel and DraftKings. In the event a customer received
funds from or sent funds to DFS sites, the transactions would trigger the rule which would warrant further investigation. Subsequently, the customer’s account activity could be reviewed to determine whether the activity is appropriate based on the customer’s state of residence.
The third area of risk associated with DFS is the possibility of individuals misrepresenting their state of residence or providing other misleading information to gain access to the DFS sites to place bets. The NY Times article provided evidence that people already do this for gambling websites hosted in other countries. For example, an individual who lives in New York, where the websites have stopped accepting bets from residents, lists her address as a different state, thereby being allowed to place the bet anyway. If the individual wins a contest, and receives the funds in the New York resident’s bank account, there are tainted funds within the financial institution. The bank would have no way to verify the information the individual provided to the DFS sites when she registered.
In this scenario, the best option is to use due diligence. Banks already have significant amounts of information available about their customers which enables the financial institution to detect potentially suspicious or unusual activity. When opening an account, customers may have to provide information about the source of funds and expected activity in the account. The customer must also include an address. This information is invaluable when the customer conducts transactions that are out of pattern with the expected activity. If the customer’s account was alerted through the normal transaction monitoring processes, the relevant investigation should include inquiries into the source of funds and due diligence to confirm the individual’s address. If the bank personnel verify the individual resides in New York, and received funds from one of the DFS sites, bank personnel could reasonably infer that the transaction involved illegal funds, which would trigger the normal reporting requirements and bank policies for handling such transactions.
In light of the risks DFS present to financial institutions, banks should return to the basic principles of their compliance programs: to identify risk, to evaluate the risk, and to create processes and controls to reduce those risks. One key component of the process is to evaluate the bank’s risk tolerance level. Each financial institution has a different risk tolerance level. Oftentimes, the financial institution’s risk tolerance is based on factors such as prior government examination results, organizational culture, customer demographics, and geographic location. For example, a bank with a history of violations and FinCEN enforcement actions may have a different risk tolerance than a bank located in a rural area with less frequent high-risk transactions and customers.
Once the bank has identified these risks and any other risks associated with DFS, the compliance department needs to ensure proper procedures and policies are in effect. For example, a review of due diligence and know-your-customer efforts may be necessary.
Banks should consider whether they are asking sufficient questions about expected activity when a customer chooses to open an account. In some cases, where illegal gambling proceeds regularly fund the account, the bank may need to consider closing the customer’s account and terminating the relationship.
In times of uncertainty and complexity, returning to the basics of a strong compliance program will provide a certain measure of confidence to banks. Financial institutions should continue taking steps to identify the proceeds from such operations and ensure compliance with the relevant laws and regulations related to these activities.