Navigating the EU's New AML Regulation: Implications for the Gambling Industry

One of the most significant changes introduced by the regulation is the overhaul of customer due diligence (CDD) requirements for gambling service providers. The regulation requires operators to monitor transactions below the EUR 2,000 threshold, aiming to detect cumulative or fragmented deposits designed to elude scrutiny. This shifts the focus beyond specific high-value transactions, extending obligations to processes such as stake wagering, the collection of winnings, and linked transactions across various betting channels. Systems capable of comprehensive transaction attribution - encompassing both online and offline activities - must now be implemented to ensure full compliance with these new standards. 

Strengthening customer due diligence requirements

For gambling operators, this shift presents a substantial technological and logistical challenge. Until now, compliance practices for some operators, such as national lottery companies, were relatively straightforward. For instance, winners only needed to fill out a few forms upon claiming prizes that exceeded a set threshold. However, with the introduction of the new CDD rules, the approach becomes far more complex. Gambling providers must now track the customer from the very first purchase of a betting slip, whether made in person at a retail point or online. Moreover, they are required to attribute and link that ticket purchase to the same person’s subsequent online transactions, if applicable, to detect whether the EUR 2,000 threshold is met across cumulative activities. 

This transformation not only requires advanced technological systems but also highlights significant operational difficulties for gambling companies, especially for those with vast networks of third-party retail points where customer identification has traditionally been impractical. Without robust systems to monitor individual actions at scale, achieving compliance with the regulation will require substantial investments in IT infrastructure and sophisticated risk-monitoring platforms. 

In addition, the regulation significantly strengthens Enhanced Due Diligence (EDD) requirements for gambling operators, introducing new layers of scrutiny for higher-risk customers and transactions. Key changes include mandatory EDD application in cases involving politically exposed persons (PEPs), customers operating from high-risk geographic areas, suspicious ownership structures, or cash-intensive entities. Unlike previous frameworks, which largely focused on basic identity checks, operators are now required to detect discrepancies in customer information, assess the origin and destination of funds, and link fragmented transactions below the EUR 2,000 threshold across channels. 

Risk assessments and regulatory expectations

Additionally, the regulation empowers AMLA to develop regulatory technical standards by July 2026, providing minimum criteria for group-wide policies, innovative compliance technologies, and risk mitigation frameworks. These standards aim to ensure harmonized practices, but they remain unfinalized and will reflect evolving international guidelines. The regulation’s emphasis on transparency and technological innovation signals significant operational challenges ahead for gambling operators, requiring substantial investments in monitoring systems, data integrity solutions, and compliance infrastructure. While the broader framework is clear, some detailed aspects will only be determined once AMLA issues its guidelines. 

Periodic risk assessments are a cornerstone of the compliance framework, and they carry significant implications for gambling operators. These assessments aren’t just about identifying vulnerabilities - they’re an opportunity for management to proactively address risks and, in some cases, achieve exemptions from certain regulatory requirements. 

Member States are required to conduct national risk assessments to comprehensively evaluate gambling services, focusing on critical factors like transaction volumes, exposure to higher-risk geographical areas, and payment methods, including electronic instruments such as cryptocurrencies. Gambling operators must also perform their own business-wide risk evaluations. By demonstrating proven low-risk operations based on these assessments, gambling companies may qualify for exemptions or reduced requirements under the regulation. 

For example, if a gambling provider primarily handles state-administered activities or operates within tightly regulated environments, the risk assessment could highlight mitigants - such as limited cross-border accessibility, secure payment practices, and low transaction complexity - that reduce exposure to financial crime. A strong risk assessment process isn’t just a compliance requirement; it’s a strategic tool to minimize regulatory burdens while ensuring the business stays ahead of emerging threats. 

Technology and cross-border challenges

Operators of gambling services spanning multiple jurisdictions face increased scrutiny under the new regulation, particularly for cross-border transactions and operations. To address these challenges, enhanced monitoring technologies, combined with a risk-based approach, must form the foundation of their AML strategy. While the regulation outlines the need for robust systems to ensure compliance across diverse operational footprints, certain details, including technical standards for group-wide policies and procedures, are yet to be finalized by AMLA, with guidelines expected in the coming months. 

The regulation recognizes the increasing reliance on technology within gambling services and the dual risks linked to these advancements. Innovations in payment systems - particularly the proliferation of digital wallets and cryptocurrencies - pose unique challenges that must be proactively addressed. The Anti-Money Laundering Authority is positioned to play an integral role in tracking and documenting these emerging risks and issuing binding guidelines. Gambling operators must align their systems with AMLA standards and prepare to incorporate tools capable of detecting and reporting suspicious activity arising from such innovations. 

Preparing for implementation

The regulation sets clear deadlines for compliance, with full implementation expected by July 2027 for most obliged entities. For gambling operators, early compliance preparation is critical as enforcement immediately applies regardless of Member States' readiness. Failure to meet requirements risks substantial penalties - including fines up to €10 million or 10% of annual turnover. Unlike football agents and clubs, no grace periods apply to the gambling sector, emphasizing the need for proactive compliance efforts beginning well before enforcement dates. Perhaps even more importantly, stringent player identification requirements may increase churn rates, making it critical for operators to balance compliance with player retention. 

Beyond compliance obligations, the regulation offers gambling operators an opportunity to enhance governance and fortify trust among stakeholders. Establishing robust risk management frameworks, leveraging customer data aggregation technologies, and fostering transparent collaboration with regulators represent critical steps to prepare for the regulation’s requirements. By positioning themselves as leaders in transparency and security, gambling operators can also address public and industry concerns about financial crime risks. 

The regulation signals a shift towards disciplined oversight, making compliance more than just a legal necessity. It becomes a pathway to fostering long-term resilience and credibility within the gambling sector. 

Access the full EU AML Regulation here and explore the detailed requirements impacting gambling operator!

Looking for broader Financial Crime perspectives? Explore how Deloitte supports organizations in managing evolving risks and strengthening compliance frameworks.