Mandatory Player Identification in the Gambling Industry: Lessons from Finland

Regulation 2024/1624 introduces, for the first time, a single EU-wide definition of gambling services and one directly applicable customer due diligence standard, replacing separate national transpositions. Under the new regulations, operators must apply CDD when a customer wagers a stake or collects winnings of at least 2000 EUR, whether in a single transaction or through linked, fragmented transactions designed to stay under the radar. For physical premises, operators need to identify a customer once on entry, provided they have systems able to attribute every subsequent transaction back to that person. AMLA, the EU’s new supervisor body, is expected to publish technical standards detailing specific requirements in the coming months, leaving operators a narrowing window to build the underlying infrastructure before the 2027 deadline.

The EU is taking a relatively stringent approach by global standards. In Ontario, for example, operators must record identifying information for transactions of 3000 CAD or more – a threshold close in size to the AMLR’s 2000 EUR – but the rules do not require operators to aggregate smaller transactions. This means that, unlike the EU framework, fragmented transactions below the threshold do not automatically trigger the same identification requirements. The comparison highlights what makes the EU approach distinctive: it is not simply about setting a threshold, but about building a system that links all transactions to individual players. And this is precisely the direction Finland has been taking since 2021.

Finland’s Road to Mandatory Player Identification

Mandatory identification did not begin as an EU requirement, but originated domestically, as part of a broader effort to reduce gambling-related harm and defend players from unregulated offshore operators. This points to a difference in motivation between the two: Finland's identification requirement was built primarily around player protection, whereas the EU's AMLR is driven mainly by anti-money laundering goals. Even though, in practice, both rely on the same underlying tool.

It should also be noted that Finland's player identification requirement under the Lotteries Act (and its successor, the new Gambling Act, Rahapelilaki 10/2026) is, in legal terms, a gambling-harm prevention measure and is distinct from the AML customer due diligence obligation under the Finnish AML Act (444/2017). In practice, both obligations are underpinned by the same player registration infrastructure and reinforce each other - which is why Finland's experience is directly relevant to operators preparing for the AMLR.

Veikkaus was created in its current form in 2017, merging the country's three previous operators into one state-owned company, and in 2019-2020 Finland's Ministry of the Interior formally launched a project to reform the Lotteries Act and introduce compulsory identification for slot machine players, intended both to strengthen age-limit monitoring and to keep gambling demand channeled into the licensed market rather than lost to offshore operators. Veikkaus moved ahead of the legislative process itself, voluntarily bringing forward implementation of an already-enacted obligation, introducing identification at its distributed slot machines in January 2021, one year ahead of the statutory entry into force.

The Government formally submitted its reform proposal to Parliament in autumn 2021, framed around two goals stated directly by the Ministry of the Interior: preventing gambling-related harm, and strengthening the monopoly’s ability to channel gambling demand into the regulated market. The bill was approved by the President and core provisions entered into force in January 2022, establishing the legal framework for identification to eventually cover all forms of gambling - though implementation was staggered by product type rather than applied all at once. Further measures included in the same legislative package, including payment blocking provisions targeting unlicensed operators, were phased in from 2023 onwards ¹ .

The reformed law built a data and enforcement structure around identification, not just the requirement itself. It introduced compulsory daily and monthly loss limits, and empowered the National Police Board to block payments to unlicensed operators. The reform also tightened marketing rules and enabled Finland's Ministry of Social Affairs and Health and the Finnish Institute for Health and Welfare to access player data from Veikkaus for the national monitoring of gambling-related harm. Identification, in other words, was designed from the outset as the foundation for a wider public health and channelization strategy. Several years before the EU's own AMLR introduced a comparable requirement across the bloc.

Phased Rollout, not a Single Deadline

Finland introduced mandatory identification in phases rather than all at once, giving regulators and operators a rare channel-by-channel view of what identification actually changes. Identification for decentralized slot machines outside casinos took effect in January 2021, when Veikkaus voluntarily brought forward implementation ahead of the statutory deadline of January 2022 followed by retail sports betting at land-based points of sale later that year. Online play was already conducted through identified accounts before this rollout began, so the remaining phases focused on catching up the physical channel: coupon games such as Lotto and Eurojackpot were brought into scope in 2023, and scratch cards (Ässä and other instant-win products) followed in 2024 as the final product group, completing identification across all of Veikkaus's digital and physical channels.

How Veikkaus Framed the Change

Rather than announcing identification as a new obligation, Veikkaus consistently framed each stage as an extension of something players already knew: when scratchcards were brough into scope in 2024, the company told the press that identification was “already a familiar operating method to our customers”, pointing directly to the coupon-game phase earlier as the reference point. Leadership also framed the milestone in competitive rather than regulatory terms. Veikkaus described itself as “the first gaming company in the world that requires identification in all digital and physical channel games”, a message repeated across its press releases. Grace periods softened every transition: tickets and scratchcards purchased before a given deadline remained redeemable without identification for a defined period afterward, so no customer was left holding an unusable ticket.

Building on Existing Infrastructure

On the retail side, the rollout rested on infrastructure Veikkaus already had in place. Every new seller using a Veikkaus terminal completed the mandatory certification course and the company recertified its entire retail workforce annually through a responsible-gaming course covering identification, age-limit control, payment security and anti-money laundering procedures. The new identification requirements therefore were layered onto an existing, recurring training relationship with retail partners, rather than requiring a new one to be built from scratch under deadline pressure.

Lowering the Barrier for Players

To reduce friction for players, Veikkaus accepted several forms of identification most adults already carried: a driving license, the national Kela card (social insurance card), or a mobile card in the Veikkaus app, alongside a free, easily obtained Veikkaus Card that doubled as a loyalty card with its own benefits. The company also paired at least one phase of the rollout with a direct incentive: when scratchcards required identification from 2024, Veikkaus simultaneously introduced a new daily bonus draw for non-winning tickets. This upgraded what had previously been a weekly bonus draw, giving identified players an added reason to comply rather than simply a new requirement to meet.

Key takeaways from the regulatory change in Finland:

• It reveals concentration risks: Identification data from 2021 showed that just 7% of Veikkaus's players generated 50% of its revenue. A finding the operator's own team pointed to as validating its responsible-gambling approach. Identification doesn't reveal that concentration exists so much as confirm it precisely and more importantly, attach it to real players a business can act on. Just for comparison, this level of concentration is not unusual in the industry: across Finland's wider gambling market, including offshore operators, the equivalent figure is 2.5% of players. A peer-reviewed analysis of Norway's national operator, Norsk Tipping, found that its top 10% of players accounted for roughly 52% of total spend across its product range, while a separate multi-country study of online gambling in Great Britain, Germany, Spain, and the Netherlands found that the top 20% of players drove between 79% and 91% of spend, depending on the market. Veikkaus's figure sits within this range and as the earlier point suggests, its real value wasn’t in confirming that concentration exists but opening the door to detailed analysis of healthy play.
• It has a visible cost line: Identification did not arrive alone, it came bundled with the loss limits and self-exclusion tools it made enforceable, and those responsibility measures had effects on Veikkaus’s revenue. The effect is sharpest in slot machines, where mandatory precommitment and loss limits cut the share of revenue from 40% of 683 million EUR in 2019 to around 20% of roughly 200-220 million EUR in 2022, driven by around 50 000 fewer active slot players and a significant decrease in the number of slot machines. At group level, operating profit for the financial year fell 14.5% in 2023 and a further 19.6% in 2024, though Veikkaus itself attributes those declines to a combination of factors: rising lottery tax, restructuring costs, continued investments ahead of market liberalization and the responsibility measures made possible by mandatory identification. The honest reading for operators is that identification’s profitability effect is real but partial – It is one input into a wider financial picture, not the sole driver of margin pressure.

How to Prepare for the Changes

Operators preparing for 2027 should start by getting close to the regulation itself: understanding the AMLR in detail and following AMLA's technical standards as they're published, since the sector-specific rules will shape exactly how the 2000 EUR threshold and linked-transaction requirements apply in practice. From there, the priority is an honest gap assessment. Comparing current identification, monitoring, and reporting capabilities against what the AMLR will require, rather than assuming existing KYC processes are close enough. Part of that assessment should map which games and how much of the customer base will be affected, since, as Finland's phased rollout shows, exposure varies sharply by product and channel rather than hitting the whole business at once. With that picture in place, operators can move to execution: developing or procuring the right technology, updating business processes and internal governance to match, building a communication strategy that explains the change to players rather than surprising them, and working retention into the plan from the start. As we have seen, mandatory identification can shift player behavior, and a well-designed rollout with a retention strategy attached manages that risk.

How Deloitte can Help

Turning what the Finnish example shows into a compliant, resilient business is a broader task than deploying an identification system alone. Deloitte supports gambling operators across every stage of that journey – from understanding where they stand today to embedding compliance into how the operations run. Deloitte offers to:

• Assess AML readiness and define a clear roadmap
• Modernize AML, KYC and transaction monitoring capabilities
• Build resilient risk and governance frameworks
• Deliver end-to-end compliance transformation

Access the full EU AML Regulation here and explore how mandatory identification requirements will apply to your operations.

¹ It should be noted that Finland's framework contains a specific territorial carve-out: Åland (Ahvenanmaa) operates under its own gambling legislation and its own supervisory authority, and certain mainland Finnish provisions, including payment blocking measures, are expressly intended not to apply to Åland, in order to respect Åland's constitutional self-governing competence. This distinction is material for operators or advisers with exposure to the Åland market.