Casino Final Title 31 Audit Prep: A 4-Week Documentation Sprint

Title 31 audit prep fails most often because the evidence sits in separate places. AML policies live with compliance, cage logs sit with finance, ID procedures stay at the front desk, and training rosters stay in HR. Examiners do not ask whether a casino owns the documents. They ask whether the casino can prove the written program operated the same way every day at every cash touchpoint, which is what Title 31 casino compliance turns on.

Below, you'll find a four-week documentation sprint that organizes compliance evidence by requirement. Week one maps the written program and control owners. Week two reconciles transaction logs and aggregation procedures. Week three verifies patron ID workflows across casino and hotel touchpoints. Week four assembles training records, independent testing reports, and remediation proof into a binder an examiner can follow.

Key Takeaways

• Title 31 audit prep succeeds when a written AML program is proven to operate consistently across every documented control and cash touchpoint
• CTR filing thresholds and gaming-day aggregation rules require reconciled transaction logs, MTLs, and ID verification support at every cash-handling point
• ID authentication must be documented at cage, credit, payout, hotel check-in, and loyalty enrollment to hold the audit evidence trail together
• Training rosters, independent testing reports, and remediation logs are minimum program elements under 31 CFR 1021.210, not optional paperwork
• Document verification tools strengthen audit trails when written into procedures, but they do not replace governance, training, or legal review

Title 31 Audit Prep Requirements Casinos Must Document

Title 31 audit prep rests on five documented elements: a written AML program, internal controls, independent testing, personnel training, and named compliance ownership. Each element needs current documentation that shows daily operation. Casinos must show the same controls work at cage transactions, credit workflows, loyalty enrollment, and hotel check-in. Gaps appear when properties follow different ID rules or when aggregation logic was never written down.

Written AML Program Requirements Under 31 CFR 1021.210

31 CFR 1021.210 requires each casino to develop and implement a written program reasonably designed to assure and monitor compliance with the Bank Secrecy Act. Minimum requirements include internal controls, independent testing, personnel training, and designated compliance ownership. The program must also cover customer identity procedures, transaction monitoring and aggregation, CTR and SAR filing support, and record retention.

Procedures to determine and validate identity information, including name, address, and Social Security number, must be documented and applied the same way at every property. Audit evidence includes the program document, risk assessment, policies, procedures, control maps, and escalation paths.

Internal Controls and Independent Testing Duties

Internal controls turn written policy into daily transaction workflows, ID verification steps, and exception handling. Testing must be independent of the people who run those controls, and the report should record scope, findings, and remediation completion.

Audit-ready evidence includes the testing report, scope memo, remediation log, and sign-off confirming corrective actions closed. Testing frequency should follow the casino's documented risk basis rather than habit or calendar convenience.

Day-to-Day Compliance Oversight and Ownership

Casinos must designate individuals responsible for day-to-day BSA and AML compliance. That owner handles transaction monitoring, training coordination, SAR filing decisions, remediation tracking, and examiner communication.

Documentation must show who holds responsibility at each property and how decisions escalate when unusual activity or a system failure occurs. Multi-property groups need to state whether ownership sits at corporate, property, or both levels. Evidence includes the owner designation memo, escalation procedure, backup owner assignment, and communication records.

Title 31 Audit Prep Runs Better as a Structured 4-Week Sprint

A structured sprint sorts scattered evidence into requirement-by-requirement audit files before examiner questions start. The four-week timeline organizes proof that already exists. It is not a claim that casino and hotel groups can build a compliant AML program from scratch in a month.

Sprint Structure for Organizing Compliance Evidence

Audit readiness breaks down when evidence is spread across AML policies, cage logs, transaction records, ID procedures, training rosters, independent testing reports, and remediation notes. Each week of the sprint takes one evidence category and closes it out.

The output is a control map linking each Title 31 requirement to the document, system, owner, and artifact that proves compliance. Organized evidence lets compliance officers answer examiner questions in minutes instead of searching shared drives.

Weekly Goals and Deliverables

Each week carries one theme, one evidence-gathering list, and one deliverable. The table below shows the full sprint at a glance.

Balancing Speed and Thoroughness

Speed comes from limiting scope to audit-critical evidence and assigning weekly goals to compliance owners, cage managers, training coordinators, and IT staff. Thoroughness comes from checking each Title 31 requirement against current documentation and surfacing gaps early enough to fix them before the examiner arrives.

Week 1 Maps the Written AML Program and Control Owners

Week one starts with the written program and the people accountable for it. The goal is a control map showing each requirement, the policy that addresses it, the owner, and the evidence artifact that proves the control operated.

Documents That Define the Program and Procedures

Compliance officers gather the AML program document, risk assessment, internal controls policy, ID verification SOPs, transaction monitoring rules, and aggregation logic. The control map then becomes the index for the whole audit file.

Each document should be current, signed by the responsible owner, and tied to the specific Title 31 requirement it satisfies. Undated or unsigned policies invite follow-up questions an examiner does not need to ask.

Compliance Owner Identification and Assignment

Ownership must be documented with names, titles, escalation paths, and backup coverage at each property. The owner designation memo should state decision authority for SAR filings, training approvals, remediation sign-offs, and examiner communication.

Multi-property hotel-casino groups also need to show how owners coordinate across locations. Unclear ownership creates risk the moment an examiner asks who approved a specific control or remediation.

Evidence-Gap Tracking Early in the Sprint

An evidence-gap tracker lists each requirement, the expected artifact, current status, the gap, and the remediation owner. A spreadsheet or a project-management board is enough.

Update the tracker weekly and review it with executive sponsors. Common pre-audit red flags include a stale AML program, a missing training roster, independent testing with no remediation, inconsistent MTLs, and undocumented ID exceptions.

Week 2 Reconciles Transaction and Aggregation Evidence

Transaction evidence proves the casino applied the CTR filing threshold, the aggregation rule, and SAR procedures correctly at every cash touchpoint. The week two output is a reconciliation list linking each filing to the underlying logs and ID verification records.

Transactions That Trigger CTR and SAR Filings

31 CFR 1021.311 requires a report for each transaction in currency of more than $10,000. The table below separates the cash-in and cash-out transactions that count toward that threshold.

CTRs must be submitted through BSA E-Filing within 15 calendar days. Recording the identity of a person who conducts more than $10,000 in transactions during a 24-hour period requires current photo ID and a Social Security number. Copies and supporting documents must be retained for at least five years.

Gaming-Day Aggregation Rules

31 CFR 1021.313 treats multiple currency transactions as one transaction when the casino knows they are by or on behalf of the same person and total more than $10,000 during any gaming day. The casino is deemed to know when employees acting within the scope of employment know, or when its own records show the transactions occurred.

Evidence must show how transactions were aggregated by patron, gaming day, and transaction type across cage, table, slot, and hotel touchpoints. Aggregation worksheets, system reports, manual logs, and staff training records demonstrate the knowledge standard was applied correctly.

Records and Logs Essential to Reconciliation

Essential logs include MTLs capturing every transaction over $3,000, front-money and marker logs, cage cash-in and cash-out records, slot-ticket redemption data, check-cashing logs, and aggregation worksheets.

Each CTR and SAR should link to underlying transaction data, ID verification records, and decision documentation. Casinos filed 207,714 SARs across 2019 to 2022, including 62,002 in 2022 against 51,299 in 2019, so filing volume alone will not impress an examiner. Reconciliation quality will.

Week 3 Documents ID Verification Across Casino and Hotel Touchpoints

ID verification supports CTR filing, age controls, credit decisions, loyalty enrollment, and SAR documentation at every patron interaction. Week three maps where identity authentication happens, what staff captures, and how exceptions are escalated.

Critical ID Checkpoints in Casino and Hotel Operations

Every checkpoint needs a documented procedure covering acceptable ID types, verification steps, information captured, and the escalation route when an ID is questioned.

ID Authentication Tools That Support Compliance

FraudFighter ID gives staff a clear answer in under 10 seconds at high-volume transaction points. PALIDIN.ONE presents ID authentication results in less than 10 seconds in cashier and cage environments, which reduces manual judgment and standardizes the workflow across shifts.

Document verification captures required identity information consistently and creates an audit-ready record at the transaction point. It supports the program. It does not replace training, governance, or legal review, and staff still need to know acceptable ID types and escalation steps.

Exception and Escalation Documentation

Keep an exception log showing when an ID was questioned, who made the escalation decision, what alternative verification was accepted, and whether the transaction proceeded.

Escalation procedures should state who can approve an exception and under what circumstances. Documentation failures usually appear when staff verifies ID at the cage without recording evidence, when hotel check-in sits apart from casino risk controls, or when properties apply different acceptable-ID rules.

Week 4 Assembles Training, Testing, and Ownership Evidence

Week four builds the final package: training rosters, independent testing reports, remediation logs, open issues, and the executive risk memo. The binder should be organized by requirement so an examiner can follow it without a guide.

Training Program Documentation and Cadence

Training documentation should cover staff populations, new-hire and refresher cadence, suspicious-activity examples, ID verification steps, and exactly what staff must record at each transaction.

Evidence includes agendas, presentation materials, rosters with signatures or system records, assessment results, and any training issued in response to audit findings or regulatory change.

Independent Testing and Remediation Proof

Testing proof needs the last test date, scope, findings, remediation evidence, and the risk basis for the testing frequency.

The package includes the testing report, scope memo, a finding-by-finding remediation log, verification evidence, and executive sign-off confirming each corrective action closed. Independent testing is a minimum program element, not a discretionary review.

Escalation Paths and Backup Owner Records

Escalation records show the procedure, the owner designation memo, the backup owner assignment, and communication records for escalation decisions made during the review period.

Multi-property groups should also document how escalation crosses properties and who decides when corporate and property positions differ.

ID and Currency Authentication Tools Strengthen the Documentation Trail

Identity authentication tools strengthen compliance documentation when they are written into procedures and used to standardize front-line verification. They capture verification evidence automatically, creating audit-ready records at the transaction point instead of relying on manual checklists.

Customer identification programs set the identity data a casino must collect. Authentication tools make that collection repeatable across shifts, properties, and staff turnover.

Authentication Tools Reduce Manual Verification Errors

Automatic counterfeit detectors check UV, infrared, magnetic ink, and intaglio printing in under two seconds, which removes reliance on untrained staff to spot sophisticated counterfeits.

Tools apply the same criteria at every transaction, record the result, and flag uncertain cases for escalation. That consistency is what an examiner can test and what a manual checklist rarely proves.

Tool Integration With Documented Procedures

Integration means the SOP names the technology, states the verification criteria, defines how results are recorded, and sets the escalation trigger.

Training must teach staff how to use the tool and what to do when it returns an uncertain result. A scanner with no procedure behind it produces data nobody can defend.

Limitations and Proper Expectations for Technology

An ID scanner by itself does not make a casino compliant with Title 31. Technology will not satisfy the obligation without governance, training, testing, and legal review.

Proper expectations treat technology as verification support rather than a compliance guarantee. Human oversight still carries escalation, judgment, and final decisions.

A Cleaner Title 31 Audit File Starts Before the Examiner Arrives

Cleaner audit files come from organizing evidence by requirement, confirming controls operated as documented, and remediating gaps before the audit. Most programs sit somewhere on a four-level documentation maturity scale.

Casino and hotel groups that finish the four-week sprint reduce last-minute scrambles, clarify ownership, and surface remediation opportunities while there is still time to act on them.

Start Your Title 31 Audit Prep With FraudFighter™

FraudFighter™ has built currency and identity verification tools for casino, hotel, banking, and government front-line teams since 2000, and our specialists work with cage, credit, payout, and front-desk workflows every week. From our Santa Ana, California headquarters, we can review where your documentation trail breaks and suggest a dependable counterfeit money detector for each cash checkpoint, then show which ID authentication hardware fits the rest.

Call (888) 664-9325 or request a quote to talk through your four-week documentation sprint with a FraudFighter™ specialist. If cash reconciliation is eating into that timeline, we’d also suggest a dependable money counter machine to speed up the count. Tell us your audit date, and we will work backward from it with you.

Frequently Asked Questions About Title 31 Audit Prep

Q1. How long does Title 31 audit preparation usually take?

A. A focused documentation sprint takes four weeks when the written AML program, transaction logs, and training records already exist. The sprint gathers, reconciles, and organizes that evidence rather than creating policy from zero. Casinos starting without a current written program, risk assessment, or independent testing report need a longer runway and legal review. Start the sprint at least six weeks before the expected examiner date so remediation has room.

Q2. What transaction amount triggers a CTR at a casino?

A. 31 CFR 1021.311 requires a currency transaction report for each transaction in currency of more than $10,000. Multiple transactions count as one when the casino knows they are by or on behalf of the same person and total more than $10,000 during a single gaming day. MTLs separately capture transactions over $3,000, which is what makes aggregation provable. CTRs go through BSA E-Filing within 15 calendar days.

Q3. Which records must casinos keep for a Title 31 audit?

A. Casinos must retain CTR and SAR copies with supporting documents for at least five years. The wider audit file should hold the written AML program, risk assessment, internal controls policy, ID verification SOPs, MTLs, front money and marker logs, cage activity records, aggregation worksheets, training rosters, independent testing reports, and remediation logs. Each record should tie back to the Title 31 requirement it satisfies. Organizing by requirement is what turns a pile of files into an audit binder.

Q4. How often should a casino run independent AML testing?

A. Independent testing is a minimum program element under 31 CFR 1021.210, and frequency should follow the casino's documented risk basis. Many properties test annually, and higher-risk operations test more often or run targeted reviews between full tests. The testing must be independent of the staff who operate the controls being reviewed. Document the last test date, scope, findings, remediation evidence, and the risk rationale behind the schedule.

Q5. Does an ID scanner make a casino Title 31 compliant?

A. No. An ID scanner supports verification, captures evidence at the transaction point, and standardizes what staff record, but it does not satisfy Title 31 on its own. Compliance still requires a written program, internal controls, independent testing, personnel training, designated ownership, and legal review. Authentication technology earns its place in the audit file when the SOP names it, training covers it, and the records it produces are retained.