EU AMLA Tightens iGaming AML Rules After July Hearing

⏱ 3 min read

The EU's Anti-Money Laundering Authority (AMLA) held a pivotal public hearing on 2 July 2026 — five days ago — finalising draft guidelines on the ongoing monitoring of business relationships under Regulation (EU) 2024/1624. For every licensed iGaming operator serving European players, this is the single most consequential regulatory event of the year: it sets the practical day-to-day compliance bar that will govern transaction monitoring, customer file reviews, and AML enforcement fines of up to 10% of annual turnover when direct supervision begins in January 2028.

The stakes are not abstract. Since AMLA transferred the entire EU AML mandate from the European Banking Authority (EBA) on 1 January 2026, the Frankfurt-based authority has been building fast — from roughly 120 staff in early 2026 to a target of 432 by end-2027. Three mid-tier operators have already exited European markets this year, citing AMLA readiness costs. Industry estimates put full compliance at an 8–15% uplift to operational costs for mid-sized platforms, accelerating a consolidation wave that is redrawing the competitive map across Malta, the Netherlands, Germany and beyond.

---

What the 2 July hearing decided

On 2 July 2026, AMLA concluded its public hearing on draft guidelines for ongoing monitoring of business relationships, developed under Article 26(5) of Regulation (EU) 2024/1624. The Malta Gaming Authority urged all licensees to participate; Sweden's Spelinspektionen issued a formal notice directing operators to engage. The consultation itself remains open until 3 September 2026, with final guidelines expected in Q4 2026.

The draft guidelines cover three areas: general cross-sector principles; Guideline 1, covering how operators keep customer files current through periodic and event-driven reviews; and Guideline 2, covering transaction and activity monitoring. Together they replace the patchwork of 27 national implementations of earlier AML directives with a single, directly applicable EU rulebook — eliminating the jurisdictional arbitrage that allowed lighter-touch regimes to undercut compliant rivals.

---

What operators must actually do

Under the incoming framework, all online gambling operators classified as "obliged entities" face four core obligations:

• Maintain up-to-date customer due diligence records, refreshed on a risk-based schedule — not just at onboarding.
• Run continuous transaction monitoring capable of detecting unusual patterns in real time, replacing manual batch reviews.
• Apply enhanced due diligence to customers from jurisdictions on the EU high-risk third-country list, politically exposed persons (PEPs), and any relationship involving complex beneficial ownership structures.
• Retain all transaction and CDD data for a minimum of five years in a standardised, on-demand accessible format for supervisors.

Payment service providers that process gambling transactions are now equally in scope — a significant expansion that affects the entire payments stack behind a licensed operator, not just the operator itself.

---

EU AMLA fines and enforcement timeline

AMLA is not solely a standards body. It carries direct enforcement powers: fines of up to 10% of annual turnover or €10 million, whichever is higher, for material AML failures. The authority can also issue public sanction notices naming the operator and breach. Denmark's Spillemyndigheden previewed the enforcement posture when it issued three compliance orders against 25syv A/S in April 2026 for failures in risk assessment and customer screening — an early indicator of how national supervisors operating under AMLA's common methodology will proceed. The Dutch KSA blocked more than 1,200 unlicensed gambling domains in Q1 2026 alone, demonstrating the technical enforcement toolkit that sits alongside monetary sanctions.

The UK Gambling Commission — operating outside the EU but aligning with comparable standards — fined 13 operators in the second half of 2025, including one £10 million penalty, signalling the direction of travel across the wider European market.

---

Market impact: who wins, who exits

The compliance cost squeeze is already reshaping the operator landscape. Large publicly traded groups — Flutter, Entain, and Kindred — have invested heavily in compliance technology and dedicated AML teams, positioning them to absorb the new requirements with minimal disruption. Smaller operators, particularly those running legacy technology stacks on Malta or Curaçao licences, face a steeper climb.

Three mid-tier operators have already left EU-facing markets this year. In the KYC vendor space, the pressure is creating its own consolidation: Corsair Capital paid $295 million for a majority stake in Munich-based IDnow in March 2025, and Sumsub achieved unicorn status at over $1 billion in January 2026 — both moves driven by guaranteed demand for identity and AML checks that are now licence conditions, not optional spend.

Operator Tier	AMLA Readiness Outlook	Estimated Cost Impact	Key Risk
Large listed (Flutter, Entain, Kindred)	Well-positioned; compliance investment already made	Low — absorbed into existing infrastructure	Competitor exit creates market share gain opportunity
Mid-size (MGA / EEA licensed)	Requires significant platform upgrades	+8–15% to operational costs	Legacy tech stack; real-time monitoring gap
Small / offshore (Curaçao)	High adjustment burden; exits already occurring	+15%+ or full exit cost	Licence model incompatible with EU single rulebook
Payment service providers	Now in scope as obliged entities	New compliance overhead at transaction layer	Processors serving non-compliant operators face own liability

---

Key AMLA dates every operator needs

The regulatory calendar from here to the start of direct supervision is tight and non-negotiable:

• 2 July 2026 — AMLA public hearing on ongoing monitoring guidelines concluded.
• 10 July 2026 — AMLA deadline for submitting final Regulatory Technical Standards (RTS) on business relationships and linked transactions to the European Commission.
• 3 September 2026 — Public consultation on ongoing monitoring guidelines closes.
• Q4 2026 — Final ongoing monitoring guidelines expected to be issued.
• 10 July 2027 — Full application of Regulation (EU) 2024/1624 across all 27 member states; national transposition of AMLD6 also due.
• 1 January 2028 — AMLA begins direct supervision of selected high-risk obliged entities, including cross-border iGaming operators.

---

Sources

Primary sources consulted for this article, listed in order of authority. Regulatory texts and official authority releases are cited first.

Overregulating and over-taxing will cripple legal operators, which will diminish the net consumer protection. If licensed products become unattractive or awkward, players drift elsewhere.

— Industry expert cited in iGaming Business, European Gambling Regulation Outlook · January 2026