A strong culture of compliance is at the core of the operations of any gaming company, and it is required to obtain and maintain a gaming license or compact.
“Compliance” basically means following the rules and it has a very broad scope. For a casino, the compliance culture usually involves more than just gaming regulatory related compliance with state regulations or tribal minimum internal controls. Most casinos also must comply with a host of federal laws and regulations such as the Bank Secrecy Act, the USA Patriot Act, Foreign Corrupt Practices Act, American Disabilities Act, labor and employment laws, data and privacy laws, advertising regulations and much more.
As recently as October, Jamal El-Hindi, acting director of the Financial Crimes Enforcement Network, issued a blog on the U.S. Treasury Notes Blog site titled “Culture of Compliance and Casinos.”
In the blog, El-Hindi highlighted two recent FinCEN enforcement actions: a $12 million penalty against a Nevada casino and a $2.8 million penalty issued against a casino in California. The underlying BSA failures that resulted in the penalties were based on a weak culture of compliance.
FinCEN issued a similar statement to U.S. Financial Institutions in August 2014 with its “Advisory to U.S. Financial Institutions on Promoting a Culture of Compliance.”
The 2014 FinCEN advisory provided the compliance culture should include:
- Leadership actively supports and understands compliance efforts;
- Efforts to manage and mitigate BSA/AML deficiencies and risks are not compromised by revenue interests;
- Relevant information from the various departments within the organization is shared with compliance staff to further BSA/AML efforts;
- The institution devotes adequate resources to its compliance function;
- The compliance program is effective by, among other things, ensuring that it is tested by an independent and competent party; and
- Leadership and staff understand the purpose of its BSA/AML efforts and how its reporting is used.
The ways casinos create a strong culture of BSA compliance can apply, in theory, to other compliance areas as well. Based on my experience, here are some key ways to ensure compliance across the organization:
- A strong culture of compliance starts at the top with the attitude of upper management, board of directors and other oversight bodies. They need to not only buy into the fact that compliance is important but also should actively support the compliance efforts. This would include receiving regular compliance-related reports, approving compliance policies and having a general knowledge of the rules the casino is subject to. If the casino does not have the right tone from the top, compliance efforts are usually undermined and ultimately fail.
- Adequate resources, both in personnel and systems, are vital to creating a strong compliance culture. The compliance staff should be experienced, able to direct compliance efforts and support the operations in evaluating compliance-related risks. Compliance is not always black and white. There are often shades of gray and knowing how to evaluate and respond to operational issues is the key to successful compliance and operating a casino business successfully. Systems that provide information to assist the casino in complying with its obligations are, for the most part, a necessity.
- Develop written risk assessments, compliance programs, internal controls, policies and procedures that adequately address the regulatory requirements and the casino’s specific risks. Assessing the casino’s risks before drafting the compliance programs assists in identifying key areas where controls are needed. The compliance program should include not only the policy but also how the policy can be implemented from an operational perspective (such as internal controls, standard operating procedures, etc.). This sets the expectation of what is required of employees.
- Providing testing of the training materials will be a good indicator of how well employees understand what is required.
- Procedures should be subjected to an independent review, testing and audits to ensure the compliance system is working as intended. This provides an evaluation of where the casino is in its compliance efforts and an opportunity to correct any deficiencies identified prior to an outside regulatory audit.
- Communication is vital to any organization and sometimes is the most difficult to achieve. However, with compliance-related responsibilities, sharing information is not only helpful but also, in some cases, required. Including the communication expectations within the training program is essential. Communication also includes the reporting of compliance efforts and any deficiencies noted.
Establishing a strong culture of compliance is important for many reasons, including increasing investor/public confidence, avoiding potential regulatory violations, fines and criminal charges, and preventing the loss of a gaming license or compact. Implementing and monitoring a strong compliance program takes a concerted effort and is time consuming, but ultimately will prove to be worthwhile.