Title 31 of the Bank Secrecy Act makes a casino a financial institution, on the hook for internal controls over every dollar that crosses the cage. And every prompt sent to a cloud AI service hands transaction records and suspicious-activity indicators to a third party. We'll build the whole system on your own hardware instead: the agents, the orchestration, and the models that carry your floor's real work, and player data never leaves the property.
We start beside the surveillance shift lead, the cage manager, and the Title 31 compliance officer, because they see the pattern before the system flags it.
Air-gapped AI casino infrastructure eliminates the structural conflict cloud AI creates with Title 31 BSA/AML requirements, NIGC minimum internal control standards, and state gaming commission cybersecurity regulations.
Title 31 of the Bank Secrecy Act (31 CFR Part 1021) classifies casinos with gross annual gaming revenue exceeding $1 million as financial institutions. That classification carries the full weight of BSA/AML compliance: mandatory anti-money laundering programs, currency transaction reporting for cash-in and cash-out exceeding $10,000 in a gaming day, suspicious activity report filing, customer identification programs, and five-year recordkeeping requirements. When a compliance officer pastes transaction data, patron profiles, or SAR draft language into a cloud AI service, that protected financial intelligence travels to infrastructure controlled by a third party. Casinos are one of eleven regulated industries where this structural conflict between cloud AI and data confidentiality is most acute.
The National Indian Gaming Commission's Minimum Internal Control Standards (MICS) under 25 CFR Parts 542 and 543 prescribe detailed controls for accounting transactions, surveillance operations, and financial oversight in tribal gaming facilities. IGRA's overriding mandate is clear: tribal gaming operations must be shielded from corrupting influences and conducted under tribal regulatory authority. Cloud AI processing introduces external infrastructure into that control chain, creating dependency on commercial vendors whose data handling practices fall outside tribal jurisdiction. Tribal data sovereignty demands infrastructure that stays under tribal control.
State gaming commissions compound these requirements. Nevada's NRS 463.0129 cybersecurity regulations require gaming operators to protect patron and employee personal information, conduct risk assessments aligned to frameworks like NIST SP 800-53, maintain documentation for five years, and report cyber incidents within 72 hours. New Jersey, Pennsylvania, Michigan, and other regulated states impose parallel requirements. The common thread: institutional control over data handling infrastructure. Cloud AI processing creates a dependency on vendor infrastructure that complicates compliance across federal BSA requirements, tribal MICS, and state gaming commission cybersecurity mandates simultaneously.
"No data leaves your floor" is a description of network architecture, not marketing language.
Patron data never leaves your network. Transaction records, surveillance notes, and compliance documentation travel from workstation to server over internal network only. No internet connection is required for inference. This is data-sovereign AI for gaming - complete operational control over every inference operation.
This is physical hardware in your server room, running on your power and connected to your network, not a hosted service. You own it outright. No vendor has access to your data or your queries.
After initial setup and model installation, the system can operate entirely disconnected from the internet. An air-gapped AI server for casino operations provides complete network isolation for maximum security posture - critical for facilities handling millions in daily transactions.
A general model read the whole of gaming regulation and knows nothing about your floor. It's never seen your Title 31 aggregation thresholds, doesn't know how your surveillance logs get written, can't tell your cage's buy-in procedure from the one down the strip. We build for the property you run.
Island Mountain builds the agents and the orchestration that carry the work eating your compliance team's week: SAR and CTR narrative drafting off the day's transaction record, surveillance-report summarization across a shift, player-dispute and complaint review, the gaming-commission filing with the citations already mapped. It runs on current open-weight models like Kimi K3, ZAI GLM 5.2, Qwen 3.8+, and Nous Hermes 4, served through Ollama or vLLM behind an OpenWebUI front end, or whatever open weights fit the task. All of it governed by our own agentic orchestration and the Woven Security Fabric, so every action carries an identity, an approval, and a receipt, and the credentials expire when the task is done. Player data never leaves the property to make any of it happen.
When the work needs a model that speaks your floor, we'll build one. Reasoning models and small language models from scratch, trained to orbit your operation's ontology: your compliance calendar, your cage and surveillance procedures, the way your property runs. It learns your terminology and your cadence, not a generic operator's.
It air-gaps completely for the surveillance and Title 31 work that demands it, and reaches the cloud only when a task genuinely needs to. That's your call, workflow by workflow.
Then we hand it back. On-site onboarding, SOPs written for your surveillance, cage, and compliance teams, the keys dropped into your people's hands so they run and rework the workflows without calling us. Want the upkeep off your IT department's plate? We offer tiered support sized to the property, and we plug in wherever that's easiest. This is your property's legacy. We build it alongside you, and we won't call it done until your people can run it without us.
These aren't chat prompts. They're agentic workflows the orchestration runs start to finish, each step carrying its own identity and receipt, and no player data leaves your network.
Draft Suspicious Activity Reports from transaction data and surveillance notes. Analyze patron behavior patterns, flag structuring indicators, and generate compliant SAR narratives. Local AI for casino AML compliance keeps all suspicious activity intelligence on your servers.
Assist with Currency Transaction Report preparation for cash-in and cash-out exceeding $10,000 in a gaming day. Aggregate transaction records, verify patron identification data, and generate compliant documentation under 31 CFR 1021.311.
Analyze internal control documentation against NIGC MICS requirements and state gaming commission standards. Summarize audit findings, identify control gaps, and draft remediation plans without exposing audit details to cloud vendors.
Draft incident reports from surveillance observations. Summarize patron behavior notes, document table game irregularities, and generate shift reports. All surveillance intelligence stays on-premises where it belongs.
Process patron identification documentation for customer identification programs required under 31 CFR 1021.210. Analyze high-value patron profiles and consolidate due diligence records without transmitting PII to third parties.
Draft responses to gaming commission inquiries, FinCEN examinations, and NIGC compliance reviews. Summarize complex regulatory requirements and map operational practices to specific regulatory citations.
The same AI capabilities you want from cloud services, running on hardware that doesn't create compliance exposure.
Analyze historical revenue data across table games, slots, food and beverage, and hotel operations. Generate forecasting summaries and identify seasonal patterns. Proprietary revenue intelligence stays entirely on your servers.
Analyze player club data, comp utilization patterns, and patron spending behavior. Draft personalized marketing communications and loyalty tier recommendations. Patron behavioral data never touches a cloud API.
Generate promotional copy, direct mail content, email campaigns, and social media messaging. Analyze campaign performance data and draft A/B test summaries. All patron targeting data stays in-house.
Draft employee communications, training materials, policy documents, and scheduling summaries. Generate onboarding documentation for gaming floor staff, surveillance operators, and cage personnel.
Analyze F&B inventory data, vendor pricing, and consumption patterns. Draft purchase orders, menu analysis summaries, and cost optimization reports for casino restaurant and bar operations.
For casino-resort properties: analyze occupancy data, draft guest communications, and generate revenue management summaries. Guest reservation data and spending profiles stay on your infrastructure.
On-premises AI running fully open-source models under your operational control. A local model for casino workflows means zero cloud dependency for any AI operation.
Kimi K3, ZAI GLM 5.2, Qwen 3.8+, Nous Hermes 4, and whatever's strongest the month we deploy, served through Ollama or vLLM behind OpenWebUI. Open weights turn over fast, so our answer turns over with them. We run the model that fits the compliance job or the marketing draft, not the one that looked good on a spec sheet last year.
When nothing off the shelf speaks your floor, we build it. Reasoning models and small language models from scratch, trained on your operation's ontology: your compliance calendar and the way your cage and surveillance teams work. Small, sharp, and yours alone.
Every model runs under our agentic orchestration and the Woven Security Fabric. Scoped access, ephemeral credentials, a receipt for every action. Air-gapped when Title 31 work demands it, cloud-connected when a task earns it.
The cloud costs every month and transmits patron data every session. The hardware costs once and keeps everything on your floor.
| Cloud AI | An Island Mountain Deployment | |
|---|---|---|
| Year 1 Cost | $30,000 - $120,000 (50 users) | One-time purchase (quoted to the deployment) |
| Year 3 Cumulative | $90,000 - $360,000 | Electricity only (~$1,200 - $2,400/yr) |
| Year 5 Cumulative | $150,000 - $600,000 | Electricity only |
| Patron Data Location | Cloud provider servers | Your server room. Period. |
| Compliance Risk | Patron data transmitted to third party | Zero transmission. Zero risk. |
| Per-Token Fees | $15 - $60 per million tokens | None. Unlimited use. |
| Model Control | Provider decides models and updates | You choose which models to run |
| Casino System Integration | Some platforms offer integrations | Not included. General-purpose AI. |
| Vendor Lock-In | Complete | None. Permissive open-source licenses. |
Knowing the boundaries matters more than knowing the features.
Island Mountain hardware runs large language models for text-based tasks. It does not process surveillance camera feeds, perform facial recognition, or run video analytics. Those are separate systems from separate vendors. This is a text and document AI system, not a vision system.
Island Mountain hardware does not connect to slot management systems, table game tracking systems, player rating platforms, or cage management software out of the box. The AI runs through OpenWebUI - a browser-based chat interface. Moving data between your casino systems and the AI is a manual process.
The system does not submit CTRs or SARs to FinCEN electronically. The AI assists with drafting and reviewing compliance documentation - but filing is a manual process through your existing BSA reporting systems and the FinCEN BSA E-Filing System.
After the 30-day included support period, your operation is responsible for OS security updates, model updates, and general system maintenance. This is the same maintenance profile as any Linux server in a professional environment. Most casino IT departments or managed service providers can handle it.
A BSA-compliant AI server keeps patron financial intelligence and compliance documentation under institutional control from day one.
The Bank Secrecy Act classifies casinos as financial institutions under 31 CFR Part 1021. The AML program requirements at 31 CFR 1021.210 mandate five components: a system of internal controls, a designated compliance officer, ongoing employee training, independent audit testing, and a customer identification program. Penalties for non-compliance are severe - civil fines up to $50,000 per violation, criminal fines up to $250,000 with imprisonment up to five years, and up to $500,000 with ten years for willful violations involving patterns exceeding $100,000. Cloud AI processing introduces external infrastructure into the compliance chain, creating a third-party dependency that complicates every component of the required AML program.
For tribal gaming operations, the regulatory framework is layered. IGRA (25 U.S.C. § 2701 et seq.) establishes the National Indian Gaming Commission and mandates that tribal gaming promotes tribal economic development and self-sufficiency while being shielded from corrupting influences. The NIGC's Minimum Internal Control Standards under 25 CFR Parts 542 and 543 prescribe detailed controls for cash handling, surveillance, and financial reporting. Tribal Internal Control Standards (TICS) add tribe-specific requirements on top of federal MICS. Cloud AI introduces commercial vendor dependency into this control chain - dependency that falls outside tribal regulatory jurisdiction and undermines the sovereignty principles IGRA was designed to protect.
State gaming commissions add a third regulatory layer. Nevada's NRS 463.0129 cybersecurity requirements mandate risk assessments, five-year documentation retention, 72-hour incident reporting, and alignment with frameworks including NIST SP 800-53 and ISO/IEC 27001. New Jersey, Pennsylvania, Michigan, and other regulated states impose parallel cybersecurity obligations. The common thread across all three layers - federal BSA, tribal MICS, and state gaming commissions - is institutional control over data handling infrastructure. Local deployment returns that control entirely to the gaming operation.
Disclaimer: This section describes the general regulatory environment regarding AI and casino gaming data protection. It is not legal, regulatory, or compliance advice and should not be relied upon for compliance decisions. Consult qualified gaming compliance counsel or your regulatory advisors for guidance specific to your jurisdiction, license type, and operational context.
Power & Installation: All Island Mountain systems require a dedicated 208V/30A power circuit (NEMA L6-30R). This is standard in server rooms and data closets. Most casino properties with existing back-of-house server infrastructure already have this available or can add it for $500-$2,000 through a licensed electrician. The system fits in a standard 4U rack space. Average power draw under typical inference loads is 1.5-2.5 kW.
Yes. Cloud AI transmits patron transaction data and suspicious activity indicators to third-party infrastructure, creating structural BSA/AML compliance risk under 31 CFR Part 1021. The rule requires casinos to maintain comprehensive AML programs with internal controls over financial data. Cloud processing introduces vendor dependency that undermines this control. On-premises AI hardware from Island Mountain eliminates third-party transmission entirely.
Island Mountain hardware supports SAR drafting, CTR preparation, AML transaction analysis, internal audit documentation, patron loyalty analytics, revenue forecasting, marketing campaign drafting, workforce documentation, and F&B analysis. The system runs current open-weight models, and custom models we build for your floor. All processing occurs on hardware inside your facility.
Cloud AI subscriptions for enterprise platforms typically cost $50 to $200 per user per month. For 50 users, that totals $30,000 to $120,000 per year. Over three years: $90,000 to $360,000 cumulative with no ownership and continued patron data exposure. An Island Mountain deployment is a one-time purchase, quoted to your workload after Discovery. Cost parity typically reached within year one.
No. The system is configured and air-gapped before it lands through a web browser. Setup requires racking the server, connecting power and network, and opening a browser. 30 days of hands-on support are included. Ongoing maintenance is standard Linux server administration.
Island Mountain is an engineering practice, not a compliance authority. References to Title 31, the Bank Secrecy Act, NIGC MICS, IGRA, state gaming commission regulations, or related gaming compliance frameworks on this page reflect factual descriptions of data handling mechanics - not legal, regulatory, or compliance advice. Consult qualified counsel for compliance determinations specific to your organization, jurisdiction, and license type.
Tribal casino processing 800 transactions daily across table games and slots. Every SAR draft, every CTR, every patron record stays on tribal infrastructure. BSA compliance and data sovereignty in one system.
Scenario: Tribal CasinoRegional casino-resort with 1,200 slot machines and 60 table games. Patron loyalty data, revenue forecasting, and compliance documentation all run on our servers. No cloud vendor sees our numbers.
Scenario: Regional Casino-ResortMulti-property gaming group operating in three states. Air-gapped inference keeps compliance documentation isolated per property while marketing and operations teams share the same AI infrastructure.
Scenario: Multi-Property Gaming GroupOne conversation. No sales pitch. Tell us about your gaming operation's AI needs and we will spec the right system.
Or call directly: 1-341-441-8740
See all eleven industries we serve or explore: Tribal Nations · Financial Services