Integrity Monitoring Requirements for Sports Betting Operators

Integrity monitoring in sports betting is not one compliance task but three separate obligations stacked on top of each other: internal transaction monitoring inside the operator's own systems, reporting to third-party integrity firms, and formal disclosure to state regulators. Each layer depends on the one beneath it, and an operator keeps its license only when the layers connect, not merely when each exists on its own.

Integrity monitoring as a structured, three-layer system

Start with the three pieces themselves. An operator first has to catch something unusual inside its own betting data. Once it does, that alert has to move to a third-party integrity monitoring firm capable of comparing it against activity at other sportsbooks. From there, if the pattern holds up, it has to reach a state regulator with the authority to investigate, subpoena, and if needed, suspend a license. If any one of those steps is missing, the whole chain stops working, no matter how well the other two function.

The American Gaming Association's integrity factsheet frames this as a joint effort among sportsbooks, leagues, state regulators, and third-party monitors working toward what it calls "360-degree transparency." That phrase describes a system built from multiple vantage points. It is not a single control room watching every bet. No one party, not the operator, not the integrity firm, not the regulator, sees the whole picture alone. Transparency at that scale only exists because the three layers pass information to each other in sequence, and the strength of the system rests on how reliably that handoff happens, bet after bet, report after report.

What the illegal market reveals about the layered system

The three-layer structure exists because the unregulated market offered no equivalent for decades, and the cost of that absence appears in cases that took years to surface. NBA referee Tim Donaghy bet on games he officiated, including through illegal bookmakers, for four seasons before the FBI tipped off the league. Nothing internal caught it, because there was no internal system watching at all; the betting happened entirely outside any regulated structure built to notice it.

Shohei Ohtani's interpreter ran up large illegal gambling losses over roughly two years before any of it became public. Again, no monitoring system flagged the activity as it happened. No transaction monitoring algorithm caught a strange betting pattern in these cases. They surfaced through outside intervention, well after the activity had been running for years.

The American Gaming Association points to the structural reason behind both cases: the illegal market, dominated by offshore websites and organized crime, carries no regulatory oversight and no protections for the integrity of the games being bet on. Suspicious activity placed with an illegal operator can sit unnoticed and unreported indefinitely, because no one in that chain has an obligation, or even the means, to report it. That's the gap that the regulated system's three layers were built to close. But the fix only covers bets placed through licensed operators. As long as an illegal market of meaningful size exists alongside the regulated one, someone looking to fix a game can route the activity offshore and avoid every layer of detection built into the legal system. That's a central reason regulators treat pushing betting volume into licensed channels as an integrity measure in its own right, not just a matter of tax revenue or market share.

Internal transaction monitoring: the trigger for everything else

Everything downstream depends on what an operator's own systems catch first. No alert reaches a third-party firm, a league, or a regulator until the operator's internal monitoring flags something as out of the ordinary. That makes internal transaction monitoring the sensor the rest of the system depends on, and a weak or miscalibrated sensor leaves the other two layers with nothing to act on.

Operators have to watch for sharp line movements that break from how a market would normally behave, for unusually large bets placed on obscure or thinly traded markets, and for coordinated betting patterns spread across multiple accounts that look like one actor working under several identities. Know-Your-Customer rules reinforce this work: KYC checks kick in when a customer opens an account, places a bet above a set threshold, or shows betting behavior that looks suspicious, and operators then have to collect official identification and, in some cases, additional personal and financial details. The American Gaming Association says operators run data analytics, algorithms, and AI across billions of data points and millions of betting transactions worldwide, so they can flag patterns that might point to something suspicious.

Staff training sits inside this layer as a formal requirement, not a cultural extra. Sportsbook employees need to be able to recognize and report suspicious betting behavior themselves, and operators work with leagues so that players, coaches, employees, and officials understand and follow each league's betting restrictions.

Two specific gaps inside this layer deserve attention. Player prop markets carry more structural risk than team-outcome markets because manipulating a single player's statistics takes far fewer corrupted participants than manipulating a game's final result, so you can't screen these bets through transaction data alone. Live, in-play betting carries a separate risk: it accounts for roughly half of total betting volume and is especially exposed to manipulation tied to specific in-match moments, a missed penalty call, a particular corner kick, yet many detection systems now in use were built around pre-game markets and were never designed with in-play incident-level manipulation in mind.

A 2026 case shows what happens when the threat comes from inside the operator. A former DraftKings sportsbook trader faces felony counts from Nevada prosecutors, who say he ran a scheme to profit from manipulated college basketball player-proposition wagers while he was employed at the company. The investigation began after suspicious betting surfaced around a men's basketball game between Fresno State and Colorado State, played on January 7, 2025. The case makes a point that applies well beyond this one incident: an employee with access to how odds and markets are built can exploit the same player-prop vulnerability that outside bettors try to exploit, and internal controls built only to watch customer accounts will miss that threat.

Layer two: how third-party integrity firms aggregate operator alerts

No single operator sees the full market. Suspicious activity coordinated across several sportsbooks at once only becomes visible once those separate reports land in one place and get compared against each other, which is the job the third-party integrity layer exists to do.

Integrity monitoring firms take in Suspicious Activity Reports, or SARs, from their operator members and aggregate them across the industry. The standard flow runs from an operator's internal alert to the integrity firm, then to the relevant league or governing body's integrity department, and from there to a law enforcement referral if the evidence points to an actual crime.

The Sports Wagering Integrity Monitoring Association, known as SWIMA, is the first organization of its kind in the United States and gives operator members a central hub for submitting suspicious bet data. Its founding members include Caesars, William Hill, DraftKings, FanDuel, Bet365, and Hard Rock International, among others, and the model draws on the European Sports Security Association, which performs a similar function abroad.

A 2022 UFC case shows this layer operating as intended. Sportsbooks noticed unusual pre-fight betting activity and contacted an integrity monitoring firm, which analyzed the data and reported its findings to gaming regulators and other sportsbooks a full three hours before the fight began, triggering an investigation into the bout itself. That turnaround, from a flagged pattern at individual sportsbooks to a regulator-facing report within hours, is the clearest evidence available of why this layer matters: the fix would not have surfaced in time through any single operator's data alone.

The American Gaming Association describes the result of this data-sharing as "360-degree transparency into betting patterns, line movements and other events that may signal illegal gambling." That kind of visibility exists once operator data is pooled centrally.

Operators owe the integrity-firm layer a few concrete things in return. Membership in, or a formal relationship with, a recognized integrity monitoring association is the baseline. Timely submission of SARs the moment internal systems flag something is the operational core of the relationship. The flow of information runs both ways: when an integrity firm spots a cross-market pattern, member operators have to confirm immediately whether they've seen anything similar on their own platforms.

Layer three: what triggers immediate state notification

State disclosure turns detection and aggregation into a formal legal obligation, and it's the layer where a failure carries direct consequences for an operator's license.

Colorado's regulatory framework shows how specific this obligation gets in practice. Every sports betting operation has to maintain internal controls that identify unusual betting activity and report it both to the state's Division and to an Independent Integrity Monitoring Association, as directed by the Division Director. That association, in turn, has to share the information across all its member operators, who then have to confirm whether they've experienced anything similar. If the activity rises to the level of "suspicious," every other monitoring provider, every other operator, the Division, and other regulators all have to be notified immediately. That is a rapid escalation requirement, built for real-time response.

Each state's gaming regulatory agency receives SARs directly from operators, and it holds subpoena power to investigate individuals or organizations suspected of influencing game outcomes or misusing inside information. Federal anti-money-laundering law adds a parallel track on top of that: certain suspicious betting activity also has to be reported to the U.S. Treasury Department, making federal financial regulators a second mandatory recipient alongside the state.

The proposed Supporting Affordability and Fairness with Every Bet Act, known as the SAFE Act, points to where federal standardization may be headed even before any vote takes place. The bill would set national minimum standards: operators would have to submit an annual written system of internal controls to the state and undergo independent third-party or regulatory audits at least once every three years.

How the three layers interconnect

Each layer only has value if the other two are functioning at the same time. A highly capable internal monitoring system that never generates a SAR protects no one. An active, well-resourced integrity firm with no timely submissions from operators has nothing to aggregate. A state regulator that receives a disclosure late has lost the window in which an investigation could still change an outcome.

Timing carries the weight of the whole structure. Colorado's rule calls for immediate notification the moment activity rises to the level of suspicious, not a summary filed at the end of the quarter. An operator that treats integrity monitoring as a periodic reporting exercise rather than a continuous one is out of compliance in substance even if all three layers exist on paper.

The live-betting gap described earlier shows what that failure looks like in practice. If an internal monitoring system is still calibrated mainly for pre-game markets while most manipulation attempts are happening in-play, the trigger that should set off the second and third layers never fires, even when the underlying activity is genuinely suspicious.

Prediction markets present the clearest current example of the three-layer framework meeting a gap it was never built to cover. Sports-related event contracts traded on prediction market platforms fall under federal commodity derivatives law and CFTC jurisdiction, not state gaming frameworks, so the state disclosure layer that anchors the whole system doesn't automatically apply to them. That gap carries more weight because sports contracts made up 80% of global prediction market trading volume in 2025. A WilmerHale client alert notes that the gaming regulatory safeguards built for state sportsbook frameworks may not meet the requirements of federal rules, leaving a need for new policies aimed specifically at that federal layer. On February 25, 2026, the CFTC's Division of Enforcement reminded market participants that it still has full authority to police illegal trading practices on any designated contract market, and this covers event contracts tied to sports. On March 12, 2026, the Division of Market Oversight issued a Prediction Markets Advisory stating that sports-related event contracts raise particular integrity concerns and require thorough product review, surveillance, and monitoring.

Leagues are already responding to this gap individually. The NFL and NCAA have asked regulators to pause or restrict certain prediction market offerings until stronger integrity protections exist. MLB signed a first-of-its-kind memorandum of understanding with the CFTC to build a dedicated integrity and information-sharing framework. The NHL and MLS have entered licensing deals with prediction market platforms that include integrity commitments, and the NHL has separately signed its own MOU with the CFTC on integrity and information sharing. States, meanwhile, are testing the question in court: Washington, Massachusetts, Michigan, and Nevada have filed civil suits arguing that sports event contracts amount to unlicensed gaming activity, Arizona has pursued criminal charges, and Minnesota passed a law banning prediction markets outright, though that law is currently blocked by a federal preliminary injunction while the broader litigation continues unresolved.

Satisfying all three layers without gaps

Operators who treat the three layers as separate compliance workstreams, one team handling internal monitoring, another handling the integrity-firm relationship, a third handling regulatory filings, are the ones most likely to show gaps when a regulator or law enforcement agency looks closely during an investigation or audit.

On the internal side, transaction monitoring needs to cover live, in-play markets with the same rigor it applies to pre-game markets, rather than running on logic designed years ago when pre-game betting made up most of the volume. Player prop markets need monitoring logic built specifically around their vulnerability to single-participant manipulation, because that risk doesn't look like the patterns that team-outcome markets produce. Staff training has to extend beyond generic customer-facing awareness and cover each league's specific betting restrictions, so that insider-threat situations like the 2026 DraftKings trader case can be caught before they reach the scale that one did.

On the integrity-firm side, operators need an active, current relationship with a recognized monitoring association, not a dormant membership kept on file for audit purposes. SARs need to move the moment internal systems flag something, and operators need to respond promptly when an integrity firm asks whether a cross-market pattern has shown up on their own platform.

On the regulatory side, disclosure has to match the standard states like Colorado have set: immediate notification once activity is confirmed suspicious, not a summary delivered on the next routine filing cycle. And with prediction markets now drawing CFTC attention and league scrutiny at the same time, operators and leagues active in that space need policies that address federal event-contract rules directly, rather than assuming that protections built for state sportsbook licensing will cover activity the state framework was never designed to reach.