EU AMLA iGaming AML Rulebook Takes Shape — Industry Barely Showing Up

⏱ 3 min read

Europe's iGaming industry is sitting out one of the most consequential regulatory processes of the decade. The EU Anti-Money Laundering Authority (AMLA) held its inaugural conference on 9 June 2026 in Frankfurt, and a critical consultation on group-wide AML standards closed just six days later on 15 June — yet industry engagement across both events has been, by most accounts, close to silent. The rulebook these consultations will produce is binding across all 27 EU member states from July 2027, replacing decades of fragmented national AML regimes with a single, directly applicable set of obligations for every licensed iGaming operator in Europe.

The stakes are not abstract. Under Regulation (EU) 2024/1624, online gambling operators are classified as high-risk obliged entities — on par with banks and payment institutions. AMLA has the power to fine directly supervised entities up to 10% of annual turnover for compliance failures. Industry analysts estimate that full compliance will add 8–15% to mid-sized operators' operational costs. Three mid-tier operators — two Malta-licensed and one Curaçao-licensed serving EU markets — have already exited since January 2026, citing AMLA readiness costs as a factor.

---

What AMLA Is and Why It Matters for Gambling

AMLA became operational on 1 July 2025, headquartered in Frankfurt, Germany. It was created by Regulation (EU) 2024/1620 as the centrepiece of the EU's sweeping AML reform package, which also includes the Anti-Money Laundering Regulation (AMLR), Regulation (EU) 2024/1624, and the Sixth Anti-Money Laundering Directive (AMLD6). Together, these instruments replace the existing patchwork of national AML transpositions — which varied materially across member states — with a single, directly applicable rulebook.

For iGaming, the structural change is significant. Before AMLA, a licensed operator serving customers in Germany, the Netherlands, Spain, and Belgium navigated four materially different compliance regimes simultaneously: different suspicious transaction report (STR) formats, different record-keeping requirements, and different enforcement thresholds. Under the incoming single rulebook, those differences collapse into one standard. The upside is genuine: administrative costs for multi-market operators will fall once the transition is complete. The downside is that operators who exploited lighter-touch national regimes as a competitive advantage — particularly those using Malta Gaming Authority (MGA) licences as a proxy for pan-European access — face the most significant uplift.

AMLA's first round of entity selections for direct supervision is expected to target cross-border iGaming operators by Q3 2026. From 2028, the authority will directly supervise 40 major EU-licensed entities across financial and non-financial sectors. Gambling operators not selected for direct supervision will fall under indirect supervision via national regulators — but those national regulators will themselves be held to harmonised standards by AMLA.

---

The Open Consultations: What's at Stake

The binding obligations that will govern day-to-day AML compliance for EU iGaming operators are not yet final — they are being shaped right now through a series of active public consultations. AMLA launched three consultations on 9 February 2026, covering:

• Customer Due Diligence (CDD) — verification thresholds, enhanced due diligence triggers, and how online account registration is treated as a "business relationship." Closed 8 May 2026.
• Criteria for identifying business relationships, occasional and linked transactions — directly relevant to how operators structure player accounts and manage bet-splitting red flags. Closed 8 May 2026.
• Pecuniary sanctions, administrative measures and periodic penalty payments — determines how enforcement severity is graded and what fines apply for specific breaches. Closed 9 March 2026.

A fourth consultation, on Regulatory Technical Standards (RTS) for group-wide minimum requirements under Articles 16(4) and 17(3) of the AMLR, closed on 15 June 2026. This RTS is particularly material for any gambling group with cross-border EU operations or licensing arrangements in non-EU jurisdictions such as Curaçao or Gibraltar: it defines binding expectations for how non-EU subsidiaries are brought within a group's AML framework, or ring-fenced from it. A fifth consultation on Business-Wide Risk Assessment guidelines remains open until 15 July 2026.

The Malta Gaming Authority (MGA) issued repeated notices urging its licensees to engage with the consultations and offered to assist with sector-specific submissions before the deadlines. Sweden's Spelinspektionen made similar calls to its licensees in February 2026.

---

Industry Silence — and Its Consequences

Despite the clear operational stakes, industry participation has been sparse. Banking trade associations, payment-services bodies, and asset-management groups have submitted detailed, technically informed responses from the outset. The gambling sector's collective response, according to senior industry observers, has been "close to silence." AMLA held a public hearing on the group-wide RTS in May 2026, attended by over 650 participants — the majority from financial services.

The consequences are practical and lasting. Regulatory technical standards and guidelines, once finalised, are embedded assumptions about how industries operate and what risks they present. If gambling operators fail to make the case for proportionality — for example, distinguishing systemic AML failures from isolated lapses, or arguing for thresholds that reflect the realities of consumer-facing gaming rather than wholesale financial transactions — those distinctions will not appear in the final rules. The consultation on sanctions grading (closed 9 March) has already passed with minimal gambling industry input, meaning enforcement severity for this sector was shaped almost entirely by financial-sector submissions.

Hermann Pamminger, General Secretary of the European Casino Association (ECA), has publicly flagged the problem, describing the industry's failure to engage with EU legislative processes at the point where input actually matters as a persistent and costly habit.

---

Practical Impact on EU-Facing Operators

For operators licensed in the EU or serving EU-resident players, the compliance landscape from July 2027 will look materially different from today:

• Unified CDD thresholds — a single set of customer verification requirements across all 27 member states, replacing divergent national implementations.
• Enhanced due diligence for high-risk customers — mandatory enhanced scrutiny for players from jurisdictions on the EU's high-risk third-country list, politically exposed persons, and accounts with complex ownership structures.
• Beneficial ownership transparency — extended to corporate VIP players and payment intermediaries.
• Record-keeping — minimum 5 years in harmonised format, accessible to supervisors on demand.
• Group-wide standards for non-EU operations — operators with Curaçao or Gibraltar licences serving EU markets must either align those operations to EU standards or structurally ring-fence them.
• Real-time transaction access — AMLA can access transaction data from directly supervised entities in real time.

The compliance cost pressure is accelerating consolidation. Larger operators with established compliance infrastructure view the regulatory tightening favourably, as it reduces competition from less-capitalised rivals that previously competed on thinner regulatory margins. For mid-tier operators without dedicated compliance teams, the window to self-assess and close gaps before July 2027 is narrowing.

---

Key Dates and Compliance Timeline

Date	Event	Significance for iGaming
1 July 2025	AMLA becomes operational (Frankfurt)	Begins developing single rulebook; EBA AML functions transferred
9 Feb 2026	Three AMLA consultations open (CDD, sanctions, transaction criteria)	First opportunity for gambling sector to shape binding obligations
9 March 2026	Sanctions consultation closes	Enforcement grading set; gambling industry input reportedly minimal
8 May 2026	CDD and transaction criteria consultations close	Defines customer verification thresholds and bet-linking red flags
May 2026	AMLR Regulation (EU) 2024/1624 becomes fully enforceable	Single rulebook legally in force; national patchwork begins unwinding
9 June 2026	First AMLA conference, Alte Oper, Frankfurt	Inaugural public-sector and private-sector alignment on enforcement approach
15 June 2026	Group-wide RTS consultation closes	Binding rules for multi-jurisdiction and non-EU subsidiary compliance
15 July 2026	Business-Wide Risk Assessment guidelines close	Final major open consultation; last chance for operator input
Q3 2026	First AMLA entity selections expected	Cross-border iGaming operators likely among first directly supervised
July 2027	Full AMLA framework applies	Single rulebook live; non-compliant operators face fines up to 10% turnover

---

Sources

Primary regulatory sources cited first; independent analysis and industry commentary follow.

This is the moment that matters — not 2027, when the rules will have been finalised and compliance departments are scrambling, but now, whilst submissions are still being accepted and the guidelines are still being drafted.

— Andrew Tottenham, Managing Director, Tottenham & Co · CDC Gaming, 10 June 2026