EU Gambling AML Rules Rewrite the Compliance Rulebook

⏱ 3 min read

The EU's new anti-money laundering regulation will hand gambling operators their first ever single, bloc-wide definition of what counts as a gambling service — and tie them to uniform due diligence rules — when Regulation (EU) 2024/1624 (the AMLR) becomes directly applicable across all 27 member states on 10 July 2027. The shift, published in the Official Journal on 19 June 2024, moves AML enforcement from a patchwork of nationally transposed directives to a single, directly applicable EU rulebook.

The timing is pointed. On 8 July 2026, the Anti-Money Laundering Authority (AMLA) separately published draft technical standards introducing a common four-tier severity scale for grading AML breaches — applicable to gambling operators as non-financial obliged entities — alongside a public consultation, launched 13 July 2026 and running until 27 September 2026, seeking input from licensed gambling operators on risk-based supervision frameworks. Sweden's regulator Spelinspektionen has already urged its licensees to participate.

---

The First EU-Level Definition of Gambling Services

Previous EU AML directives — including Directive 2005/60/EC (which covered casinos) and Directive 2015/849/EC — addressed gambling without codifying a common definition. Because those instruments were directives, each member state was free to draw the line differently through national transposition.

The AMLR changes that. Article 2(1)(12) of the regulation defines a "gambling service" as any service involving a monetary-value stake in games of chance, including skill elements, such as lotteries, casino games, poker, and betting — whether delivered at a physical location or remotely by any technological means. As a regulation rather than a directive, this definition applies automatically and uniformly in every member state from day one, with no implementing legislation required.

Terence Cassar, gambling, technology and commercial law partner at GTG Legal, writing in an analysis published on the Oxford Business Law Blog on 14 July 2026, described the change as marking "the first time in European legal history" that gambling services have been defined within an EU regulation.

---

What Due Diligence Rules Now Require

Gambling operators classed as "obliged entities" under the AMLR must apply customer due diligence (CDD) in a set of defined circumstances. Key obligations include:

• Identify and verify the customer's identity at or before onboarding.
• Understand the purpose and intended nature of the business relationship.
• Carry out ongoing monitoring of transactions and the customer's risk profile.
• Apply enhanced measures where higher money laundering or terrorist financing risk is identified.

The €2,000 threshold — a single wager or payout, or linked transactions reaching that value — is the trigger for mandatory CDD. Member states may exempt genuinely low-risk gambling services (such as state-run lotteries) from some or all requirements, subject to their own national risk assessment. The rules are not a "maximum harmonisation" regime: as Baker McKenzie notes in a client briefing, member states can still impose additional obligations on a risk-based basis.

---

AMLA's Four-Tier Breach Severity Scale

Until now, the same AML breach in the same situation could draw very different enforcement responses depending on which member state's supervisor was handling it. AMLA's new draft Regulatory Technical Standards, published 8 July 2026, introduce a common step-by-step method for all sectors — financial and non-financial, including gambling. Supervisors first assess gravity against shared indicators (duration, repetition, impact), then classify the breach into one of four levels. The standards are awaiting formal adoption by the European Commission before becoming legally binding.

Category	Severity	Key triggers	Exclusions
Category 1	Lowest	Minor impact; short duration; non-repetitive	Cannot apply if breach facilitated crime, was systematic, or affected financial integrity
Category 2	Moderate	Moderate impact; none of the higher-severity indicators are present	Escalates if persistence or significant impact is shown
Category 3	Serious (floor)	Repeated or systematic breach; significant impact; persisted over a notable period	Can still be escalated to Category 4 if additional aggravating indicators apply
Category 4	Most severe	Very significant impact; structural AML failure; facilitated significant criminal activity	Also applies where breach threatened financial stability or system integrity

---

Indirect AMLA Reach Through Banks

AMLA's direct supervisory remit covers only "selected obliged entities" — the very largest credit and financial institutions. No gambling operator is expected to qualify for direct AMLA oversight on its own. However, gambling businesses are customers of those same large banks, and Cassar argues that how AMLA scrutinises a bank's exposure to gambling clients — particularly cross-border ones — will drive practical compliance pressure on operators regardless.

In his Oxford Law Blog analysis, Cassar wrote that AMLA's supervision of banks servicing gambling customers, especially cross-border operators, "may inevitably drive practical reality and instigate internal market pressures." Operators whose banking relationships are put under a harsher lens could face tightened terms, additional requests for compliance documentation, or restricted access to payment processing at the banking level rather than from gambling regulators directly.

---

What Stays National: Licensing and the Malta Dispute

The harmonised AML framework does not touch licensing. Member states retain full autonomy over which gambling products are lawful and how they are licensed. The AMLR's Recital 63 explicitly states that national gambling regulations are only compatible with EU law where they genuinely pursue public policy, public security, or public health objectives — language that will likely feature in future legal challenges.

That tension is already visible. The European Commission has opened infringement proceedings against Malta over Article 56A of the Gaming Act, which the Commission argues prevents enforcement of court judgments from other member states against Malta-licensed operators. The Malta Gaming Authority (MGA) maintains the provision merely codifies existing public policy on gaming matters. The dispute sits unresolved even as AML convergence advances — illustrating the limits of what the AMLR can unify.

Separately, AMLA's consultation — covering risk profiling and risk-based supervision for non-financial sectors including online and retail gambling — runs to 27 September 2026. With Sweden's Spelinspektionen actively directing licensees to respond, the window for operators to shape the final RTS methodology is open now.

---

Sources

Primary regulatory sources are listed first, followed by legal analysis and industry reporting used to cross-check facts and context.

The AMLR represents the first time in European legal history that a definition of gambling services has been codified within a European Regulation.

— Terence Cassar, Gambling, Technology and Commercial Law Partner, GTG Legal · Oxford Business Law Blog, 14 July 2026