AML and KYC for gambling operators: thresholds, checks and reporting

Gambling operators must identify and verify every customer (KYC), assess money laundering risk, monitor play and payments, and report suspicion to the national financial intelligence unit. In the EU the key figure is EUR 2,000: customer due diligence (CDD) applies to stakes or winnings of that amount or more under Directive (EU) 2015/849, and the same threshold carries into the AML Regulation that applies from 10 July 2027. Online licensing regimes go further and require identity checks when the account is opened.

This page is written for compliance officers, MLROs and founders preparing a licence application. It covers the legal sources, what each check involves, where suspicious activity reports go in the main licensing jurisdictions, and what recent enforcement has cost operators. For the licences themselves, see our guide to gambling licensing jurisdictions.

What do AML and KYC mean for a gambling operator?

Anti-money laundering (AML) is the whole control framework an operator runs to stop criminal funds entering or leaving through its platform; know your customer (KYC) is the identity part of it. Under EU law and the UK Money Laundering Regulations 2017, casino and gambling providers are “obliged entities”, so they must assess risk, verify customers, monitor transactions, keep records for five years and report suspicion.

Regulators treat gambling as a cash-intensive, high-velocity sector. A customer can deposit by card, play a few low-risk spins, and withdraw to a different method, which turns illicit money into apparently clean winnings. Other typologies regulators publish include chip dumping in peer-to-peer poker, collusive betting on low-liquidity markets, mule accounts opened with stolen identities, and third-party funding through prepaid vouchers or cash agents.

Three documents usually sit at the centre of an operator’s programme:

• Business-wide risk assessment: how products, payment methods, markets and delivery channels expose the firm to laundering and terrorist financing.
• Policies, controls and procedures: the written rules for CDD, enhanced checks, monitoring, record keeping and reporting, approved by senior management.
• Customer risk assessment: a score for each player that decides how much evidence is collected and how closely the account is watched.

Licensing authorities also check this framework before granting a licence. The Malta Gaming Authority and the UK Gambling Commission both ask for named AML officers and documented procedures as part of the application.

Which law sets the EUR 2,000 gambling threshold?

Article 11(d) of Directive (EU) 2015/849, the Fourth Anti-Money Laundering Directive, requires providers of gambling services to apply customer due diligence when collecting winnings, wagering a stake, or both, in transactions of EUR 2,000 or more, whether carried out in one operation or in several that appear linked. Every EU state transposed that figure, and AMLR Article 19(5) restates it from 10 July 2027.

The threshold is a floor, not a target. Online licences in most European markets require full identification when the account is registered, long before EUR 2,000 is reached, because the operator holds a continuous business relationship with the player. Sweden’s penningtvättslag (2017:630) applies the EUR 2,000 rule in chapter 3, section 5, while the Swedish gambling act separately requires identity checks at registration.

Member states could exempt low-risk gambling services under Article 2(2) of the 2015 directive, but never casinos. Most used it for small lotteries and land-based amusement machines. The new regulation narrows that choice further, as the next section explains.

Great Britain is no longer bound by EU directives and has moved its figure into sterling. Regulation 27(5) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 requires a casino to apply CDD to stakes, remote-gambling deposits and winnings collections of £2,000 or more, single or linked; the amount was substituted with effect from 30 June 2026 by S.I. 2026/621. Regulation 27(7) adds that uncollected winnings re-used in play do not count towards the total.

What changes when the EU AML Regulation applies in 2027?

Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation (AMLR), applies directly in every EU member state from 10 July 2027 and replaces most national AML rulebooks with one text. Article 4 lets a member state exempt gambling services it has shown to be low risk, but never casinos, and not providers whose main activity is online gambling or sports betting, except online services run by the state or whose organisation, operation and administration are regulated by the state.

The package has three parts, and operators deal with each of them differently:

Under the regulation, gambling providers that run physical venues may identify customers at the door, provided their systems tie later transactions to that customer (Article 19(8)). Online operators gain no such shortcut. Member states that intend to grant any exemption must first notify the European Commission, which can prohibit it within two months (Article 7).

For a business already licensed in Malta, Sweden, Denmark or the Netherlands, the practical impact is less about the threshold and more about harmonised detail: common rules on beneficial ownership, politically exposed persons and outsourcing, plus technical standards AMLA will draft. Operators with group entities in several EU states can expect fewer national variations to map after July 2027.

How does customer due diligence work in practice?

Customer due diligence for an online gambling account has four core steps, set out in Article 13 of Directive (EU) 2015/849 and repeated in the 2024 regulation: identify the customer, verify that identity from a reliable independent source, understand the purpose and intended nature of the relationship, and monitor the account on an ongoing basis. Each step is scaled to the customer’s risk score.

1. Identification at registration. Full name, date of birth, residential address and, in many markets, a national identity number. Sweden requires electronic identification (BankID or similar) under chapter 12 of the gambling act, and Denmark ties accounts to MitID.
2. Verification. Electronic checks against credit-reference, population or bank data, or document checks with liveness testing. In Great Britain the Commission has required age and identity verification before a customer can deposit or gamble since 7 May 2019.
3. Risk scoring. Country of residence, payment method, deposit velocity, product mix and any adverse media feed into a low, medium or high rating.
4. Purpose and intended nature. For a gambling account this usually means expected spend, occupation and income band, gathered by questionnaire or inferred from data.
5. Enhanced due diligence. Triggered by high-risk scores, PEP status, high-risk third countries or unusual patterns: source of funds, source of wealth and senior management sign-off.
6. Ongoing monitoring. Transaction rules and behavioural alerts, periodic refresh of documents, and re-scoring when circumstances change.
7. Record keeping. Evidence and transaction records held for five years after the relationship ends (Article 40 of the 2015 directive; regulation 40 of the UK 2017 Regulations).

Germany adds sector-specific rules for online gambling in section 16 of the Geldwäschegesetz (GwG): a player account in the customer’s own name is mandatory, and money may only move to and from payment accounts held in that name. That design prevents third-party funding by construction, and it is one reason German payment flows look different from those on a Curaçao or Anjouan licence.

How does an operator track a cumulative threshold?

A threshold applied to “linked” transactions means the operator must aggregate deposits rather than look at each payment alone. The FIAU’s Implementing Procedures for Malta’s remote gaming sector let a licensee count deposits of EUR 2,000 either cumulatively from the start of the relationship or over a rolling 180-day window, and expect the system to flag the moment the line is crossed.

A worked example with the rolling method shows why aggregation matters:

Winnings and balance do not count under the Maltese deposit test: a player who wins EUR 5,000 from EUR 300 deposited has not reached it. Many operators still escalate such accounts because a large withdrawal against small deposits can itself be a laundering indicator. When the required information is not provided, the procedures expect the operator to stop the relationship, restrict or close the account and consider a suspicious transaction report.

When must an operator ask for source of funds or source of wealth?

Source of funds (SoF) is evidence of where the money for a specific deposit came from, such as a payslip or bank statement; source of wealth (SoW) explains how the customer built their overall assets. Both are enhanced due diligence measures under Article 18a of Directive (EU) 2015/849 and the 2024 regulation, and regulators expect them whenever spend is out of line with the customer’s known profile.

Triggers differ by operator, but supervisors repeatedly criticise firms that set them too high or apply them too late. Common triggers include:

• cumulative deposits or net losses passing an internal monetary line within a set period;
• spend inconsistent with the stated occupation or income band;
• a sudden step change in deposit size or frequency;
• multiple payment methods, especially cards in different names, appearing on one account;
• high-risk residency, PEP status or adverse media.

In Great Britain, AML source-of-funds checks overlap with safer-gambling affordability duties, and the Commission’s enforcement notices often cite both in the same case. Our page on responsible gambling requirements covers the financial-risk side; the AML file still has to answer a different question, which is whether the money is legitimate.

How are PEP and sanctions screening handled?

A politically exposed person (PEP) holds or recently held a prominent public function, such as a minister, senior judge or board member of a state-owned company. Article 20 of Directive (EU) 2015/849 requires senior management approval, source of wealth and funds checks, and enhanced monitoring for PEPs, their family members and close associates. Sanctions screening is a separate, absolute duty with no threshold.

Operators normally screen at registration and then re-screen the whole customer base whenever a list changes, typically overnight. The lists that matter depend on where the operator is established and which currencies it touches: EU consolidated restrictive measures, the UK’s OFSI consolidated list, the UN Security Council list and, for anything involving US dollars, the US Treasury OFAC list. A sanctions match means freezing and reporting, not risk-based judgement.

False positives are the operational problem. A common name returns dozens of hits, so screening tools are tuned with date of birth and nationality, and every discounted alert is documented with the reason. Supervisors sample these decisions during inspections.

Where do suspicious activity reports go?

Every obliged entity must report knowledge or suspicion of money laundering to its national financial intelligence unit (FIU) without delay, and must not tip off the customer. The receiving body differs by country: the National Crime Agency in the UK, the FIAU in Malta, FIU-Nederland in the Netherlands and the Finanspolisen unit of the Swedish Police in Sweden.

Italy’s UIF publishes anomaly indicators that help obliged entities decide when to report. Its provvedimento of 12 May 2023 set 34 indicators, applicable from 1 January 2024, including ones aimed at gaming accounts. The topic is not new there: in April 2013 ADM circulated UIF operating schemes for spotting anomalous behaviour in gaming to its concessionaires, the subject of an earlier article on this site.

In the UK, a DAML request matters when the operator is about to pay out funds it suspects are criminal property. Section 335 of the Proceeds of Crime Act 2002 gives the NCA seven working days to refuse consent; if it does, a further moratorium period follows. Paying out before that window closes can expose the business, and the MLRO personally, to a principal money laundering offence.

How do AML obligations compare across licensing regimes?

All major regimes require risk assessment, CDD, monitoring and reporting, but the trigger for full verification and the supervisory model vary. As of October 2026, the UK, Sweden, Germany and the Netherlands require identity verification before or at the start of play online, while the EUR 2,000 test mostly governs land-based and occasional transactions.

Founders comparing jurisdictions should weigh these duties alongside fees and market access; our MGA vs Curaçao comparison sets out the wider trade-off.

What have AML failures cost operators?

AML failings are among the most expensive enforcement findings in gambling. In Great Britain, William Hill companies paid a record £19.2 million in March 2023 for social responsibility and AML failures, after Entain’s £17 million settlement in August 2022. In Australia, the Federal Court ordered Crown Melbourne and Crown Perth to pay A$450 million in July 2023 in AUSTRAC proceedings.

The pattern across these cases is consistent: the regulators did not find that the operators set out to launder money, but that controls were missing, under-resourced or overridden for valuable customers. Our enforcement tracker follows newer decisions as they are published.

How do crypto and alternative payments change KYC?

Crypto deposits do not remove KYC duties; they add payment-side ones. In the EU, Regulation (EU) 2023/1113 has applied the travel rule to crypto-asset transfers since 30 December 2024, and the MiCA Regulation (EU) 2023/1114 became fully applicable the same day, with transitional periods ending by 1 July 2026.

For transfers of more than EUR 1,000 to or from a self-hosted wallet, the crypto-asset service provider must assess whether the wallet belongs to its customer. A licensed gambling operator that accepts crypto through a regulated processor therefore inherits originator and beneficiary data it can match to the player account. Operators that accept crypto directly face a harder test: they must evidence wallet ownership and screen addresses against sanctions and risk data themselves. The payments section covers processor models and chargeback exposure in more detail.

Prepaid vouchers, e-wallets and open-banking payments raise their own questions about who the true payer is. A sound programme records the payment instrument holder on every deposit and blocks or reviews mismatches with the account name.

What should an operator build before launch?

A new licensee needs a documented AML framework before taking its first deposit: a business-wide risk assessment, approved policies, a named MLRO with authority, screening and monitoring systems, staff training records and a reporting route to the national FIU. Regulators in Malta, Great Britain and Sweden review these documents during the application, not after go-live.

• Appoint the MLRO and a deputy, and document their access to the board.
• Map products, payment methods and target markets to risk ratings in the business-wide assessment.
• Configure CDD tiers, threshold aggregation and enhanced-check triggers in the player account management system.
• Contract identity verification, PEP and sanctions screening providers, and test match rates on sample data.
• Register with the FIU’s reporting portal (goAML in Malta, Sweden and Germany; the NCA portal in the UK).
• Train customer-facing and payments staff, and keep signed records.
• Schedule an independent audit of the framework, typically annually.

Platform and payment suppliers carry part of this load through contract. Questions to ask them, and the testing and certification they hold, are covered in the B2B supply chain guide. Unfamiliar acronyms on this page are defined in the glossary.

Frequently asked questions

Is KYC required before a player’s first deposit?

In most regulated online markets, yes. Great Britain has required age and identity verification before deposit or play since 7 May 2019, and Sweden, Germany and the Netherlands verify identity at registration. The EUR 2,000 test in EU law sets the minimum point for full due diligence, not the earliest.

Does the EUR 2,000 threshold apply to deposits or to winnings?

Under Directive (EU) 2015/849 it applies to wagering a stake, collecting winnings, or both, counted together where transactions appear linked. Malta’s remote-gaming procedures apply it to deposits, measured either cumulatively or over a rolling 180-day period.

Does the new EU AML Regulation let states exempt online gambling?

Only in narrow cases. Article 4 of Regulation (EU) 2024/1624 allows exemptions for low-risk gambling services, but casinos are always excluded, and so are providers whose main activity is online gambling or sports betting, unless the service is state-run or its organisation, operation and administration are regulated by the state. Any exemption must be notified to the European Commission first.

Who files suspicious activity reports in a gambling company?

The money laundering reporting officer, or equivalent nominated officer, decides on and files reports with the national FIU after staff raise internal concerns. Staff must not tell the customer that a report has been made, because tipping off is an offence.

How long must KYC records be kept?

Five years after the business relationship ends or the occasional transaction is completed, under Article 40 of Directive (EU) 2015/849 and regulation 40 of the UK 2017 Regulations. Some national laws allow or require longer retention in specific cases.

Is the AMLA going to supervise gambling operators directly?

No. The Anti-Money Laundering Authority in Frankfurt, created by Regulation (EU) 2024/1620, will directly supervise selected financial institutions. Gambling operators remain under national supervisors, which AMLA coordinates and reviews.