“The more activity you have, the greater risk that you have,” said

Alma Angotti,

a former senior enforcer with the U.S. Treasury Department’s Financial Crimes Enforcement Network who now works as a partner at consulting firm Guidehouse Inc.

Traditional casino gambling has long been acknowledged as a risk for money laundering because it is cash intensive and, compared with banks, casinos afford their patrons more anonymity, giving criminals a way to quietly turn cash of dubious origin into winnings.

Online gambling presents similar issues, but with fewer watchful eyes. The U.K. and other jurisdictions have stepped up enforcement, but the U.S., with its complex patchwork of state and federal regulators, hasn’t seen a major enforcement push. Some compliance experts have predicted a looming crackdown as the flow of money into online gambling swells.

In the first half of 2022, U.S. online sports bookmakers generated an estimated $2.8 billion in revenue handling about $42.5 billion in bets, according to the American Gaming Association, a trade group. As of August, Washington and 20 states have allowed online wagers on sports, and six states have legalized the practice but have yet to launch legal wagering, the association said.

Massachusetts, for example, legalized sports betting earlier this month and will levy a $5.2 million five-year license fee on top of taxes, the AGA said. New York state residents have been able to place sports bets online since January, with the state charging an eye-popping $25 million to operators for a license.

Casino-style online gambling, such as digital slot machines, though fully legal in only six states, has also become increasingly important. That segment generated $2.4 billion in revenue in the first half of 2022, up more than 43% from a record set in 2021, the AGA said.

The sophistication of the compliance regimes to make sure money is being wagered for fun, and not for crime, lags behind those at banks, making online casinos attractive targets for criminals, said

Todd Raque,

an anti-money-laundering expert at Featurespace Ltd., a financial crime detection software company.

“They’ve got minimal [compliance] staff,” Mr. Raque said. “Bad guys are going to go there like water—they’re fluid. They’re going to go to the point of least resistance.”

An online gambling site can be used to launder money in a variety of ways. Two confederates can play at being adversaries in a game, for example, with whatever money emerges treated as legitimate gambling winnings.

Criminals wary of a bank’s more onerous know-your-customer requirements can also use an online gambling app—or many of them—to simply deposit money, said

Joseph Martin,

the chief executive of compliance software company Kinectify.

The casino industry as a whole has made efforts to comply with anti-money-laundering laws. The AGA publishes best practices for AML compliance, most recently in July, and larger online operators such as

DraftKings Inc.,

an AGA member, have dedicated compliance teams. But many smaller gambling startups trying to get in on the gold rush don’t know they need an anti-money-laundering program, Mr. Martin said.

Often those startups only learn about AML requirements when

Visa

or

Mastercard,

the payment processors, start to ask questions, he said.

Foreign regulatory enforcement of online gambling has ramped up in recent months, a possible bellwether for operators in the U.S.

The U.K. Gambling Commission announced four fines over online anti-money-laundering failures in August alone, including one £14 million penalty, equivalent to $16.4 million, against

Entain,

which runs ladbrokes.com and other sites.

The commission said Entain failed to adequately assess the risks of its online business and let customers deposit large amounts without checking where they came from—a customer who lived in public housing, for example, deposited nearly $220,000 over six months. The company also paid £3 million over failures in its retail outlets.

Entain admitted its systems and processes weren’t in line with “evolving regulatory expectations” but added that there was no evidence of actual criminal spending within its operations.

In Malta, a hub of online gambling, the Financial Intelligence Analysis Unit in January fined an online company the equivalent of about $384,000 for failing to adequately check where customers were getting money.

U.S. law enforcement, in contrast, hasn’t yet been especially active in policing online gambling. Treasury’s FinCEN, a leading U.S. financial crime enforcement agency, has previously taken action against casinos, but the last time was in 2018, against a 102-year-old card club in California over inadequate controls that the casino admitted exposed it to a risk of money laundering.

FinCEN didn’t immediately respond to a request for comment on what approach it intends to take in the future.

Aidan Houlihan,

an executive at compliance software company Napier Technologies Ltd., said some online gambling operators are taking a heads-down approach akin to another lightly regulated industry, cryptocurrency.

“It’s a little bit of a don’t ask, don’t tell kind of approach,” he said.

Law enforcement eventually tends to catch up, said

Sven Stumbauer,

the leader of the anti-money-laundering and sanctions practice at Grant Thornton LLP. The U.S. has a plethora of agencies that could potentially bring actions against a wayward online gambling operator.

In addition to FinCEN, the Internal Revenue Service also oversees the casino industry. Nevada and New Jersey, two of the most prominent gambling states, both have rules that let them punish companies for anti-money-laundering failures.

But it isn’t yet clear which of the many U.S. enforcers and financial crime regulators might emerge to take a lead role, Mr. Stumbauer said.

“That is the million-dollar question,” he said. “I don’t think anyone in the industry has the right answer to that.”

Write to Richard Vanderford at richard.vanderford@wsj.com