Anti-Money Laundering for Gaming Operators in Tanzania: A Compliance Guide

The risk inside every gaming business

Gaming operators handle millions of transactions, several payment channels and constant cash movements. Without effective controls, a betting platform or casino can become a channel for disguising criminal money.

In Tanzania, the consequences go beyond penalties. Money laundering failures can threaten the gaming license, cost the operator its banking relationships, and damage the reputation of the entire group. For tipping off a customer about a report, the law sets fines for a company of up to TZS 1 billion.

This guide explains what the law requires, what suspicious activity looks like in practice, and how to build controls that hold up when the Gaming Board, the Financial Intelligence Unit or your bank comes asking.

Glenrich Consultants is a financial risk partner for gaming operators and investors in Tanzania. As certified fraud examiners, we help operators establish, test and strengthen their anti-money laundering controls so they work in practice, not just on paper.

Two laws, one program

Gaming operators answer to two laws:

1. The Anti-Money Laundering Act, Cap. 423 (R.E. 2022). An operator of a gaming activity is a reporting person under the Act, and the Gaming Board of Tanzania is one of its named regulators (s. 3). The Act sets the core duties: risk assessment, customer due diligence, record keeping, suspicious transaction reporting, a money laundering reporting officer, training and independent audit. It is enforced by the Financial Intelligence Unit (FIU) and the Gaming Board.

2. The Gaming Act, Cap. 41 (ss. 59–65). This adds gaming-specific rules: cash limits, cash transaction reports, aggregation within a gaming day, record keeping, internal controls and a ban on structuring.

Where the two set different standards, the operator must meet both. In practice, that means the Anti-Money Laundering Act’s stricter timelines and record-keeping periods apply.

Key requirements at a glance

What each rule means in practice

a. Risk assessment comes first

The Act requires every operator to assess its money laundering risks across customers, countries, products, services, transactions and delivery channels (s. 15(6)). New products, technologies and channels must be assessed before launch, and changed products before continued use.

The assessment must be approved by senior management and kept up to date at least once a year (s. 15(3), (11)). Policies and controls must match the risks found, be monitored and audited, and be reviewed regularly. Where risk is higher, enhanced measures apply (s. 15(10)).

For a betting operator, launching a new payment channel, a new game type or a new agent network without a documented risk assessment is already a breach.

b. Customer due diligence

Operators must carry out customer due diligence before starting a business relationship or carrying out an occasional transaction, and again when suspicion arises or earlier information looks unreliable (s. 15A(1)). In practice:

• No anonymous or fictitious accounts.
• No relationship until checks are complete, unless the risk is proven to be low.
• If checks can’t be completed, end the relationship and file a suspicious transaction report.
• Identify beneficial owners of any company or arrangement involved.
• Politically exposed persons need a system to identify them, senior management approval, checks on source of wealth and funds, and enhanced ongoing monitoring (s. 15A(2)).

For cash transactions of TZS 5 million or more, the Gaming Act also requires the player’s name, address and ID to be verified and recorded before the transaction is completed. Non-residents must be verified by passport or another official document (Gaming Act s. 60(3)–(4)).

c. Suspicious transaction reports: 24 hours, any amount

This is where operators most often misread the law.

The Gaming Act requires reports for suspicious transactions above TZS 3 million (s. 62). The Anti-Money Laundering Act goes further. Once an operator suspects, or has grounds to suspect, that funds are linked to crime, it must report to the FIU within 24 hours of forming that suspicion, and wherever possible before the transaction is carried out (s. 17(1)). There is no minimum amount.

Before reporting, the operator should take reasonable steps to understand the purpose of the transaction, where the funds came from and where they’re going, and who ultimately benefits.

The TZS 3 million figure is not a safe harbor. A suspicious TZS 500,000 deposit still has to be reported.

Failing to report is an offence. For a company, the fine is up to TZS 10 million or three times the value of the property involved, whichever is greater (s. 17(4)). Reports made in good faith are protected from claims for breach of confidentiality or contract (s. 22).

d. Never tip off the customer

Staff must not tell the player, or anyone not authorized, that a report may be prepared, is being prepared or has been sent (s. 20).

The penalties are among the heaviest in the Act:

• For an individual: a fine of TZS 100 million to 500 million, or five to ten years’ imprisonment
• For a company: a fine of TZS 500 million to 1 billion, or three times the value of the property involved, whichever is greater

Cashiers and customer service staff need a scripted, neutral way to handle a player who asks why a payout is delayed.

e. Cash limits and cash transaction reports

Above TZS 5 million, a licensee cannot exchange cash for cash, issue a cheque for cash, or send a transfer in exchange for cash (Gaming Act s. 59). This stops the business from being used to turn dirty cash into money that looks like winnings. Genuine winnings may be paid by cheque or transfer to the player who won.

Every cash transaction of TZS 5 million or more must be reported within 15 days (s. 60). Multiple cash transactions by or for one person in a gaming day are added together (s. 61). The business is treated as knowing about them if any owner, officer or employee knows, or if its own records show it.

f. Records: keep them for 10 years

The Gaming Act sets five years (s. 63), but the Anti-Money Laundering Act requires at least 10 years (s. 16). The 10 years run from the last transaction, the end of the relationship, or the completion of a risk assessment.

Records must cover transactions, customer files, due diligence, risk assessments, suspicious transaction reports and the analysis behind them. If a matter is under investigation, records must be kept for as long as the authorities require. An operator that closes its business must hand its records to the regulator.

g. Reporting officer, staff, training and audit

Every operator must (s. 18):

• Screen and vet staff before hiring
• Name an individual as money laundering reporting officer, give them access to the information they need, and require them to report to the FIU when there are reasonable grounds
• Train staff regularly on recognising and handling suspicious transactions
• Have a compliance function that owns these matters
• Arrange independent and regular audit of its policies, procedures and controls

The Gaming Act separately requires a system of internal control approved by the Board (s. 64). For sports betting, the betting system must produce a threshold transaction report for the FIU (Sports Betting Rules, Annex A11).

h. Structuring

Staff, agents and officers must not encourage or instruct a player to split transactions to avoid reporting (Gaming Act s. 65). That includes casual advice such as “take it in two payments and there’s no paperwork.”

What happens when controls fail

If an operator fails its duties on risk assessment, due diligence, records, reporting or internal controls, the FIU or the Gaming Board can impose administrative sanctions (s. 19A):

• A warning or reprimand
• Directions to fix the problem
• Restriction or suspension of business activities
• Suspension of the business license
• Suspension or removal of the staff responsible

Criminal penalties apply on top, and banks may act before any regulator does.

Red flags in betting and casinos

As fraud examiners, these are the patterns we look for. None proves money laundering alone, but each needs attention and, where unexplained, a report within 24 hours.

Deposit and withdraw with little play. Money comes in through mobile money or bank transfer, a few low-risk bets are placed, and the balance is withdrawn.

Betting both sides. Bets on every outcome of an event, or on near-certain results at very low odds. The player accepts a small loss to move money through the system.

Buying winning tickets. A third party buys a genuine winning ticket from the real winner, often for more than its value, and cashes it as their own “winnings.”

Splitting transactions. Repeated deposits or cash-outs just under TZS 5 million, or the same person using several accounts, phones or agents.

Third-party funding. Deposits from accounts in names that don’t match the player. Several players funded from the same source.

Chip walking and refining (casinos). Buying chips with cash, playing little, then cashing out for larger notes, or leaving with chips and having someone else redeem them.

Unusual behaviour for the customer. A student or casual player suddenly staking large amounts, or a dormant account becoming very active.

Politically exposed players. High-value play by public officials or their associates without enhanced checks on source of funds.

Insider involvement. Staff overriding limits, cancelling bets after results, editing tickets or repeatedly serving the same customer.

Building a program that works

A policy document isn’t a program. Regulators and banks look for evidence that controls actually run. Under the law, a working program needs:

1. A documented risk assessment, approved by senior management and updated at least yearly, plus a new assessment before every new product or channel.
2. Policies and procedures that match the risks found, approved by senior management, and by the Gaming Board as part of internal controls.
3. A named money laundering reporting officer with access to the information needed and direct access to senior management.
4. Customer due diligence at registration and before large payouts, with beneficial owner checks and enhanced checks for politically exposed persons and other high-risk customers.
5. Transaction monitoring with alerts for thresholds, gaming-day aggregation, rapid deposit-withdrawal cycles and mismatched payment names.
6. Reporting within 24 hours of suspicion, with cash transaction reports within 15 days, and written reasons for every alert closed or reported.
7. Staff screening and regular training, including retail agents.
8. Records kept for 10 years.
9. Independent audit of the whole program, done regularly.

For online and mobile operators

Most Tanzanian betting now runs through mobile money, which brings specific risks:

• Name matching. Check that the mobile money account name matches the registered player.
• One player, many accounts. Link accounts by phone number, device and payment method.
• Velocity. Watch how fast money moves in and out, not just how much.
• Agent networks. Retail agents handle cash for you. Their actions can be attributed to you, so they need training and monitoring.

For foreign operators: a group policy is not a Tanzanian program

International groups usually arrive with a strong group anti-money laundering framework. The Act expects groups to run consistent group-wide programs, including policies for sharing information within the group (s. 19). But a group program doesn’t automatically meet Tanzanian requirements. Five gaps come up most often:

1. Group risk assessment vs local risk assessment. The Tanzanian company must assess its own risks, approved by senior management and updated yearly (s. 15). Mobile money, cash-based agents and local customer patterns need local analysis.

2. Local thresholds and timelines. Group policies often use USD or EUR limits and allow days or weeks for internal review. Tanzania’s TZS thresholds and 24-hour reporting deadline must be built in.

3. Who reports, and to whom. Reports go to the Tanzanian FIU, through a named money laundering reporting officer. Head office can support the analysis, but the 24-hour clock can’t wait for group approval. Set out in writing who decides, who files and how head office is informed, without breaching the tipping-off rules.

4. Records available locally, for 10 years. Where a sports betting system is hosted abroad, the Board requires a replica server in Tanzania holding transaction and event logs (Sports Betting Rules, rule 17(3)). Group retention policies shorter than 10 years must be extended for Tanzania.

5. Independent testing of local controls. The Act requires independent and regular audit (s. 18(1)(h)). Group audits often sample the largest markets and rarely test how controls actually run in Tanzania.

Common mistakes

Treating TZS 3 million as a reporting threshold. Under the Anti-Money Laundering Act, any suspicious transaction must be reported, whatever the amount.

Waiting too long to report. The deadline is 24 hours from forming suspicion, not after a monthly review.

Keeping records for five years. The Anti-Money Laundering Act requires 10.

Launching products without a risk assessment. New channels, games and payment methods must be assessed before launch.

Paying first, identifying later. Identity must be verified before reportable transactions are completed.

Untrained cashiers and agents. What any employee knows, the business is treated as knowing, and one careless comment can amount to tipping off.

Assuming controls work because they exist. The law requires independent audit for a reason.

Frequently asked questions

Are gaming operators reporting persons under Tanzania’s Anti-Money Laundering Act?

Yes. An operator of a gaming activity is a reporting person, and the Gaming Board of Tanzania is one of the regulators that enforces the Act.

How quickly must a suspicious transaction be reported?

Within 24 hours of forming the suspicion, and wherever possible before the transaction is carried out.

Is there a minimum amount for suspicious transaction reports?

Not under the Anti-Money Laundering Act. The Gaming Act’s TZS 3 million figure sets a mandatory threshold under that Act, but suspicious transactions of any amount must be reported under the Anti-Money Laundering Act.

How long must records be kept?

At least 10 years under the Anti-Money Laundering Act, and longer if a matter is under investigation.

What can happen if controls fail?

Sanctions range from warnings and remedial directions to suspension of business activities, suspension of the business license and removal of responsible staff, with criminal penalties on top.

Your financial risk partner in Tanzania

Most gaming operators already have an anti-money laundering policy, a reporting officer and a betting system with monitoring features. What many lack is independent assurance that those controls actually work, and that’s what the law requires. That’s where Glenrich comes in.

1. Independent control testing. We carry out the independent audit the Act requires, testing your controls as they actually run: due diligence before payouts, gaming-day aggregation, alert reviews, 24-hour reporting, record retention and agent practices. You get a clear report of what works, what doesn’t and what to fix first. It’s evidence your board, head office, bank and regulator can rely on.

2. Ongoing oversight. We review alerts, reports and reconciliations every month, keep your risk assessment current, and give your head office a clear picture of compliance and financial risk in Tanzania.

3. Investigation and strengthening. As certified fraud examiners, we investigate unusual activity, insider abuse and payment fraud, close the control gaps we find, and train your staff and agents. Where controls need building or rebuilding, we design them around Tanzanian law and your actual business.

Operating or investing in Tanzania? Let’s talk.

If you’re a CFO, compliance head or investor outside Tanzania looking for a trusted local partner, we work with international clients by video call, in English, around your time zone.

[Book a free introductory call] · or WhatsApp Thomas at +255 745 50 99 66

Glenrich Consultants · Samora Tower, Dar es Salaam, Tanzania

About the author

Thomas Mubondo, CPA, CFE is the founder of Glenrich Consultants, an accounting, advisory and business structuring firm in Dar es Salaam. He advises foreign investors and growing businesses across Tanzania Mainland and Zanzibar on tax, financial controls and fraud risk.

Sources

• Anti-Money Laundering Act, Cap. 423 (Revised Edition 2022), ss. 3, 15, 15A, 16, 17, 18, 19, 19A, 20 and 22
• Gaming Act, Cap. 41 (Revised Edition 2023), ss. 59–65
• Sports Betting Rules, 2016, rules 17(3)–(4) and Annex A

Related: Gaming Tax in Tanzania · Gaming and Betting Licenses in Tanzania