EU AMLA Gambling AML Rules Reshaping iGaming Compliance

⏱ 3 min read

The EU's Anti-Money Laundering Authority (AMLA) hit a critical milestone on 10 July 2026, submitting the bulk of its 23 binding Regulatory Technical Standards (RTS) to the European Commission — rules that will legally define how every licensed gambling operator in Europe verifies customers, monitors transactions, and reports suspicious activity from 10 July 2027. For the first time, a single rulebook replaces the fragmented national AML frameworks that operators have navigated — and exploited — for two decades.

Online gambling is explicitly classified as a high-risk sector under Regulation (EU) 2024/1624, the AMLR. The CDD threshold for gambling-specific transactions sits at €2,000 — the point at which operators must verify identity upon wagering a stake or collecting winnings — significantly lower than the €10,000 baseline for most other obliged entities. With AMLA now operational from Frankfurt and capable of imposing fines of up to 10% of annual turnover, the compliance era for EU-facing iGaming has materially changed.

---

What AMLA Submitted on 10 July

The 10 July 2026 deadline was written into the AMLR itself. AMLA was required to deliver 23 sets of Level 2 and Level 3 measures — covering customer due diligence procedures, suspicious transaction reporting formats, business-wide risk assessment guidelines, group-wide requirements, and the criteria for identifying linked transactions — to the European Commission for adoption.

These are not guidance documents. Once the Commission adopts them, the RTS carry the same legal weight as the AMLR itself: directly applicable across all 27 EU member states, no national transposition required. The most operationally significant submission is the CDD RTS under Article 28, which defines precisely what identity data must be collected, how it must be verified, and when enhanced scrutiny is required. A business operating in France, Germany, and the Netherlands will, from July 2027, face identical legal requirements in all three markets.

---

What the Rules Mean for Gambling Operators

Gambling operators are obliged entities under the AMLR — in the same category as banks and payment processors — but with sector-specific thresholds and scrutiny levels that reflect the industry's elevated risk profile.

• €2,000 CDD threshold: Operators must apply customer due diligence when a player wagers or collects winnings at or above this level. Linked transactions must be aggregated — splitting bets to stay below the threshold will trigger the same check.
• Enhanced due diligence (EDD): Mandatory for customers from EU high-risk third-country list jurisdictions, politically exposed persons (PEPs), and any account with complex ownership. Operators serving players from Curaçao, Gibraltar, or offshore jurisdictions face binding expectations on how those relationships are risk-assessed within the group AML framework.
• Standardised SAR format: For the first time, suspicious activity reports across all member states must follow a common format. AMLA estimates this alone could cut compliance costs by up to 20% for operators with multi-market operations.
• Business-wide risk assessments: The guidelines finalised this month set minimum standards for how every operator must document, maintain, and update its enterprise-level ML/TF risk assessment — the foundational document from which all proportionate controls flow.

---

The Enforcement Picture: Fines, Direct Supervision, and Consolidation

AMLA will begin selecting approximately 40 obliged entities for direct supervision in 2027. Cross-border iGaming operators meeting the high-risk, multi-jurisdiction profile are among the most likely candidates. Direct supervision means AMLA can access operator transaction data in real time — a step-change from the periodic audits national regulators have historically conducted.

For entities below the direct supervision threshold, national regulators enforce the same binding standards. Denmark's Spillemyndigheden issued three orders against one operator in April 2026 for AML Act violations — an early indicator of how the framework will be applied. The Dutch KSA blocked more than 1,200 unlicensed gambling domains in Q1 2026 alone.

The compliance cost impact is already reshaping the market. Industry estimates put full AMLA readiness costs at 8–15% above current operational expenditure for mid-sized operators, with EDD requirements driving the largest increases. Three mid-tier operators — two Malta-licensed and one Curaçao-licensed — exited the European market in early 2026, citing AMLA readiness costs among their reasons.

Operator Size	Compliance Cost Increase	Direct Supervision Risk	Primary Challenge
Large (Flutter, Entain, Kindred)	Low — existing infrastructure	High — cross-border profile	AMLA entity selection process
Mid-size (MGA-licensed, 6+ markets)	8–15% operational uplift	Medium	Legacy tech upgrades for real-time monitoring
Small (single-jurisdiction, local)	Lower in absolute terms	Low — national supervisor	SAR format migration, EDD staffing
Offshore (Curaçao, targeting EU players)	Market exit or full compliance rebuild	Enforcement risk via DSA/blocking	No path to AMLA compliance without EU licence

---

The Industry's Missing Voice

The consultations that shaped these rules drew significant participation from banks, fintechs, and professional services — over 1,600 stakeholders attended AMLA's public hearing on the CDD RTS in March 2026. The gambling sector's contribution was, by most accounts, sparse. The European Casino Association's General Secretary Hermann Pamminger raised the alarm at an industry event in June 2026, noting that the consultation on sanctions and enforcement tools — which determines how harshly AML breaches in the gambling sector will be graded — received near-silence from operators.

One further consultation window remains open. Draft guidelines on business-wide risk assessment under Article 10(4) AMLR accept responses until 15 July 2026. These guidelines will define the minimum standards for how operators must document their ML/TF exposure — the document every future AMLA audit will begin from.

---

Key Dates and Compliance Timeline

• 1 July 2025 — AMLA becomes operational in Frankfurt.
• 31 December 2025 — AMLA assumes AML functions from the European Banking Authority (EBA).
• 9 March 2026 — Consultation closes on sanctions and enforcement RTS (penalties up to 10% of turnover).
• 8 May 2026 — CDD RTS and business-relationship thresholds consultations close.
• 15 June 2026 — Group-wide requirements RTS consultation closes.
• 10 July 2026 — AMLA submits 23 RTS packages to the European Commission.
• 15 July 2026 — Final consultation (business-wide risk assessment guidelines) closes.
• Q3 2027 — AMLA begins direct supervision entity selection process.
• 10 July 2027 — AMLR and all adopted RTS become fully enforceable across all 27 EU member states.

---

Sources

This article draws on primary regulatory publications, official AMLA consultation documents, and specialist compliance analysis published between February and July 2026.

Every euro lost to criminal operators is a euro stolen from European citizens, from legitimate and licenced businesses, and from our communities.

— Erwin van Lambaart, Chairman, European Casino Association · ECA Press Statement, November 2025