Compliance whistleblower cases: an HR playbook for operators

The moment a compliance officer puts a concern in writing, most licensed markets treat that person as protected, and every employment decision taken afterwards is measured against the report date. A claim filed in Nevada on 14 September 2026 by the former compliance director of Resorts World Las Vegas puts 27 days between his report and his dismissal, and the operator denies the allegations and has called the action frivolous. This playbook sets out what HR, compliance and the board should do in the week after an unwelcome report arrives, how protections differ across the United States, Great Britain, the European Union and Australia, and which decisions must be written down at the time rather than explained afterwards.

Key Takeaways

• Preston Banks, who spent close to 16 years at the Financial Crimes Enforcement Network before joining Resorts World Las Vegas as compliance director in September 2022, sued the operator in the United States District Court on 14 September 2026 for retaliation under the Anti-Money Laundering Act of 2020 and tortious discharge in breach of Nevada public policy. He says he delivered a report on a network of patrons on 2 September 2025, that the casino barred 28 of them and referred $12 million to $13 million of unpaid markers for collection nine days later, and that it dismissed him on 29 September 2025. Resorts World denies the allegations.
• Acting on the report does not settle the employment question. The anti-retaliation provision at 31 U.S.C. section 5323(g) borrows the burden-shifting standards of 49 U.S.C. section 42121(b), and Article 21(5) of Directive (EU) 2019/1937 works the same way across the European Union, so once a reporting person shows a protected report and a detriment, it falls to the employer to prove the decision would have been taken anyway.
• In Great Britain, the dismissal is itself a reportable event. License condition 15.2.1 of the LCCP gives a licensee five working days to tell the Gambling Commission that it has dismissed a personal licence holder for gross misconduct, or that one has resigned after disciplinary proceedings began, with a separate five days when anyone stops occupying a key position.

What happened at Resorts World Las Vegas?

A compliance director says he spent close to three years reporting a group of patrons whose money he could not account for, watched the casino act on his findings, and was dismissed 27 days later. These are allegations in a complaint rather than findings of any court, and Resorts World strongly denies them, but the sequence itself is public, and the sequence is what makes the case useful.

Banks joined Resorts World in September 2022 after nearly 16 years at FinCEN. He says he identified a group of gamblers, predominantly Argentinian, in late 2022 whose source of funds could not be verified, and that by 2024 the group had grown to somewhere between 60 and 150 people drawn from Mexico, Paraguay, Uruguay, Italy and Spain, with more than 50 suspicious activity reports filed by September 2024. His account of a committee meeting on 16 September 2024 has the executive vice president of casino operations describing the behaviour as cultural rather than suspicious.

The report that ended the argument went to the chief compliance officer on 2 September 2025. On 11 September, the casino barred 28 patrons and referred between $12 million and $13 million of unpaid markers for collection, so the business plainly took the findings seriously. On 29 September Banks was dismissed, and he says the human resources director told him the instruction came from the C-suite. The complaint goes beyond an ordinary unfair dismissal claim on one point: it alleges that when he attended a Nevada Gaming Control Board meeting in March 2026, the version of his report presented to the regulator did not match the version he wrote.

The case does not arrive at a clean record. The Nevada Gaming Commission approved a $10.5 million settlement of a ten-count complaint against Resorts World on 27 March 2025, the second largest gaming fine in the state’s history, over allowing known illegal bookmakers to gamble at the property. The former president, Scott Sibella, was dismissed in September 2023 and later sentenced on 8 May 2024 to a year of probation and a $9,500 fine for a Bank Secrecy Act violation during his earlier tenure at MGM Grand.

What should you do in the first week after an unwelcome compliance report?

Treat the document as a regulatory record and the author as a protected person from the day it is received, then run the substance and the personnel question as two separate pieces of work with two different owners. Most of the damage in this area comes from one manager holding both.

1. Timestamp and lock the report on receipt. Fix the version that was submitted, record who has permission to edit it afterwards, keep the edit history, and name the person who signs whichever version goes to a regulator. The altered-report allegation in the Nevada complaint is a much larger problem than the dismissal it sits next to, because a compliance report is evidence of what the business knew and when.
2. Acknowledge it in writing and start the feedback clock. In the European Union, the reporting person is entitled to feedback within three months, and Malta’s Protection of the Whistleblower Act sets acknowledgement at seven days on top of that. Nothing in the United States or Great Britain requires either, which is exactly why doing it anyway is the cheapest evidence an employer can create.
3. Put a hold on adverse action, and define adverse action the way the law does. Article 19 of the EU directive covers dismissal, demotion, a withheld promotion, a change of duties or place of work, a reduction in wages, a negative performance assessment, and exclusion from opportunities, so a quiet reshuffle during a restructure counts just as much as a dismissal letter.
4. Move the personnel decision away from everyone the report concerns. Whoever signs it off should sit outside the reporting line of any manager named in the document, and the reasoning should be written down before the decision is taken rather than assembled once a claim arrives.
5. Work out the regulatory notification position at the start rather than at the end. A British licensee has five working days from the event, not five working days from the point somebody thinks to check, and the clock runs whether or not anyone is threatening to sue.

Why do these cases go wrong even when the business acts on the report?

Because acting on the report proves the concern was worth acting on, and that makes a later decision about its author harder to defend rather than easier. Barring 28 patrons and referring millions of dollars of markers nine days after receiving a report is the strongest evidence anyone could offer that the report was right, and it now sits in the file alongside a dismissal 18 days after that.

The calendar does a great deal of work in a retaliation case, and it does it in the claimant’s favour. Once the reporting person has shown a protected report and a detriment, the American and European regimes both hand the employer the job of proving the decision would have happened anyway, and an employer whose paperwork was written after the claim arrived is trying to prove that with documents that did not exist at the time.

A second pressure is on the person writing these reports, running the other way. The same American regime that now gives a compliance officer a retaliation claim also convicted a casino president for failing to report what he knew, so the individual holding the pen is personally exposed if the concern goes unrecorded and protected if it is recorded. Most operators answer that with more training. The outcome depends on who sits in the room when a report is discussed and who those people report to.

The other thing these cases have in common is that nobody sets out to retaliate. A senior person becomes difficult to work with, the relationship deteriorates over months, and a restructure already underway reaches the point where somebody has to name the people in it. A decision that would have been unremarkable in January becomes very hard to explain in October.

Which rules apply outside the United States?

Four systems protect the same act in four different ways, and only one of them makes the dismissal something the gambling regulator has to be told about.

Market	What protects the person who reports	What the employer must have in place	What a dismissal triggers	Who has to prove the reason?
United States (federal)	Anti-Money Laundering Act of 2020, 31 U.S.C. section 5323(g). Remedies include reinstatement with seniority, double back pay with interest and compensatory damages	No prescribed internal channel, though Bank Secrecy Act reporting duties sit underneath it	Nothing automatic, although a state gaming regulator may take its own interest	The employer, under the standards of 49 U.S.C. section 42121(b)
Great Britain	Employment Rights Act 1996, protected disclosures, with uncapped compensation where a dismissal is automatically unfair under section 103A	No headcount threshold in employment law; the LCCP carries the reporting duties	Five working days to notify the Gambling Commission under LCCP 15.2.1, for a gross misconduct dismissal of a personal licence holder and separately for a key position vacancy	The employer must show the reason for the dismissal
European Union, including Malta	Directive (EU) 2019/1937, Article 19, which lists the prohibited forms of retaliation	Internal reporting channel at 50 or more workers, acknowledgement and feedback within three months, and seven days for acknowledgement in Malta	Nothing automatic, though a change of MGA key function holder goes through the authority’s own approval process	The employer, under Article 21(5)
Australia	Corporations Act 2001, Part 9.4AAA, with compensation and civil penalties enforced by ASIC	A whistleblower policy for public companies and large proprietary companies under section 1317AI	Nothing automatic with the gambling regulator	The employer, once detriment and a protected disclosure are shown

Australia supplies the clearest warning about what litigating one of these does to a brand. ClubsNSW brought three Federal Court actions against Troy Stolz, its former anti-money laundering manager of eight years, after he disclosed an internal finding that more than 90 per cent of gaming venues were not complying with money laundering rules, and it discontinued all three in a settlement reported in February 2023. Stolz was being treated for cancer while the proceedings ran. The coverage of the litigation did the organisation far more damage than the original report had.

What should HR and the board put in place before the next report?

Five things, and every one of them is cheaper to build now than to reconstruct during disclosure.

• A protected disclosure flag on the employee relations intake form, marking any case where the employee has made an internal compliance report, filed or escalated a suspicious activity report, or contacted a regulator in the previous 12 months, with the dates recorded at intake rather than remembered later.
• A causation gate before any adverse step, signed by someone outside the reporting line of every manager named in the report, written to the standard the employer will actually have to meet, and dated before the step is taken.
• Version control on compliance reports: read-only on submission, a full edit history, and a named signatory for whichever version is sent to a regulator.
• A notification map, one page per licence, showing which employment events have to be reported, to whom and inside how many days. For a British licence that is five working days under licence condition 15.2.1.
• An exit review for anyone leaving a control function, conducted by someone independent of that function and kept on the record, so that a pattern of departures is visible to the board before a regulator points it out.

Points 1 and 2 belong inside the employee relations process rather than beside it, and TGB’s Employee Relations Case Management Framework (GBP 499, HR & Talent Management) already runs a case from intake to appeal along one documented path. It does not yet carry a protected disclosure track, so the intake flag, the causation gate and the notification map still have to be built alongside it.

Boardroom Questions

1. If one of our compliance staff filed an uncomfortable report this morning, who would know by tonight, and is that person’s name already on a restructure list somebody is drafting?
2. Can we produce a full version history for every compliance report submitted in the past two years, showing who edited each one after submission and who approved the version that reached our regulator?
3. Which of our licences require us to notify a regulator when we dismiss someone in a control function, and how many working days do we have in each of them?
4. Who signs off a decision to dismiss, demote or restructure someone who has filed a report in the previous 12 months, and do they sit outside the reporting line of everyone that report concerned?
5. If we had to prove in a tribunal or a federal court that a dismissal had nothing to do with a disclosure, which document written before the decision would we put in front of them?

Sources

1. Banks v. Resorts World Las Vegas, complaint filed in the United States District Court on 14 September 2026, alleging retaliation under the Anti-Money Laundering Act of 2020 and tortious discharge in breach of Nevada public policy, brought by Michael Volkov and Kathleen Bliss. Reported by Focus Gaming News, Casino.org and NewsNation between 15 and 17 September 2026, including the Resorts World statement denying the allegations. The allegations have not been tested in court.

2. 31 U.S.C. section 5323, the Anti-Money Laundering Act of 2020 whistleblower provisions as amended by the Anti-Money Laundering Whistleblower Improvement Act of 2022: subsection (b) awards of 10 to 30 per cent of monetary sanctions exceeding $1,000,000, and subsection (g) prohibition against retaliation, with remedies of reinstatement with seniority, two times back pay with interest and compensatory damages, a complaint to the Secretary of Labor and a right of action in federal district court where there is no final decision within 180 days, applying the burden of proof standards at 49 U.S.C. section 42121(b).

3. Employment Rights Act 1996, sections 43A to 43L on protected disclosures and section 103A on automatically unfair dismissal.

4. Gambling Commission, LCCP licence condition 15.2.1, reporting key events within five working days of the licensee becoming aware of the event, including paragraph 4 on a person being appointed to or ceasing to occupy a key position and paragraph 13 on a disciplinary sanction including dismissal against a personal licence holder or a person occupying a qualifying position for gross misconduct, or a resignation following the commencement of disciplinary proceedings for gross misconduct.

5. Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, adopted 23 October 2019 and in force from 16 December 2019: Article 8 on internal reporting channels for private entities with 50 or more workers, Article 9(1)(f) on feedback within three months, Article 19 on prohibited retaliation, Article 21(5) on the reversal of the burden of proof, and Article 26 on transposition by 17 December 2021, with private entities of 50 to 249 workers given until 17 December 2023 for internal channels.

6. Protection of the Whistleblower Act, Chapter 527 of the Laws of Malta, as amended to transpose Directive (EU) 2019/1937: internal reporting procedures for employers with 50 or more workers, acknowledgement within seven days and feedback within three months of acknowledgement.

7. Corporations Act 2001 (Cth), Part 9.4AAA, including section 1317AI requiring public companies and large proprietary companies to have a whistleblower policy.

8. Nevada Gaming Commission approval of a settlement of a ten-count complaint against Resorts World Las Vegas on 27 March 2025 for $10.5 million, the second largest gaming fine in Nevada history, reported by The Nevada Independent, Nevada Current and the Las Vegas Review-Journal.

9. United States v. Sibella: guilty plea to a Bank Secrecy Act violation relating to his tenure as president of MGM Grand, sentenced on 8 May 2024 to one year of probation and a $9,500 fine. Scott Sibella was dismissed as president of Resorts World Las Vegas in September 2023.

10. ClubsNSW discontinuance of three Federal Court proceedings against Troy Stolz, reported by Australian Associated Press and the Canberra Times on 7 February 2023.