EU's AMLA Targets iGaming Operators in AML Crackdown

⏱ 3 min read

Europe's online gambling industry is entering the most consequential compliance cycle of the decade. Regulation (EU) 2024/1624 — the EU's unified Anti-Money Laundering Regulation — reached full enforceability in May 2026, and the body created to administer it, the Anti-Money Laundering Authority (AMLA), published its direct-supervision reporting package on 20 May 2026. For licensed iGaming operators across the EU's 27-member single market, the era of jurisdiction-shopping between national regulators is drawing to a close.

AMLA, headquartered in Frankfurt, began operations in January 2026 after absorbing all AML and counter-terrorism financing mandates from the European Banking Authority. The authority's first selection of entities for direct supervision is scheduled for 2027, with data collection from national supervisors due by 15 August 2026. Online gambling — operating across borders by design — sits squarely in the authority's crosshairs, and operators holding Malta Gaming Authority (MGA) or other single-jurisdiction licences while serving customers across multiple EU states face the starkest adjustment.

---

What AMLA Means for iGaming Operators

Until now, EU gambling regulation has been a patchwork. An operator licensed in Malta serving customers in Germany, France, and the Netherlands was primarily subject to MGA oversight — even though German, French, and Dutch regulators had their own AML expectations. Regulation 2024/1624 eliminates that asymmetry. The rulebook is directly applicable across all member states, meaning a Maltese-licensed operator must now meet identical beneficial ownership disclosure, transaction monitoring, and customer due diligence standards regardless of licensing jurisdiction.

AMLA adds a second layer: direct supervision of the highest-risk, most cross-border operators. The authority can access operator transaction data in real time, conduct on-site inspections, and impose fines of up to 10% of annual turnover for AML failures. Critically, it can withdraw a cross-border market access approval — a pan-European enforcement weapon that no single national regulator previously held.

---

Key Dates and the Selection Timeline

AMLA published its reporting package on 20 May 2026 and held a public webinar on 10 June 2026 to walk national supervisors and operators through the standardised template for identifying provisionally eligible entities. The selection process then follows a structured sequence:

• National supervisors submit entity data to AMLA by 15 August 2026
• An error-correction and alignment phase runs through September 2026
• A provisional list of eligible entities is finalised by end-September 2026
• The formal selection exercise takes place in 2027
• AMLA direct supervision begins in 2028 for the first cohort of selected entities

The initial cohort will cover 40 high-risk, cross-border obliged entities across the EU financial sector, with online gambling operators among the most likely candidates given their multi-jurisdictional footprint.

---

New Compliance Obligations Under 2024/1624

The regulation replaces the fragmented national implementations of the 4th and 5th AML Directives with a single, harmonised rulebook. The obligations most material to gambling operators include:

• Enhanced due diligence on all business relationships involving cross-border payment flows
• Real-time transaction monitoring capable of flagging suspicious patterns within minutes, not days
• Beneficial ownership transparency extended to corporate VIP players and payment intermediaries
• Record-keeping in a harmonised format for a minimum of five years, accessible on-demand to supervisors
• A single reporting interface to AMLA replacing multiple national submission channels

Obligation	Pre-2024/1624 (National Patchwork)	Post-2024/1624 (Harmonised)
CDD Threshold	Varied by member state (€1,000–€2,000 common)	Unified threshold across all 27 states
Transaction Monitoring	Periodic batch review typical	Real-time flagging required
Beneficial Ownership	Applied to licensed entity; VIP players often excluded	Extended to corporate VIPs and intermediaries
Record Retention	3–7 years depending on jurisdiction	Minimum 5 years, harmonised format
Primary Supervisor	National regulator only (e.g., MGA, KSA)	National regulator + AMLA (for selected entities)
Maximum Fine	National ceiling varied widely	Up to 10% of annual turnover

---

How National Regulators Are Responding

Reaction across EU gambling regulators has not been uniform. The Malta Gaming Authority, which licenses approximately 40% of EU-facing online operators, has raised concerns about regulatory duplication and increased compliance costs for operators already subject to MGA oversight. Denmark's Spillemyndigheden demonstrated what stricter enforcement looks like in practice when it issued orders against 25syv A/S in April 2026 for AML Act violations covering inadequate risk assessments and failure to screen customers — a sign of the enforcement culture AMLA is set to intensify.

The Netherlands' Kansspelautoriteit (KSA) has taken the opposite view from Malta, welcoming AMLA as a necessary complement to national action that has struggled against cross-border operators. Spain's DGOJ meanwhile imposed €111 million in fines on online betting and gambling operators during 2025, including six sanctions of €5 million each against unlicensed foreign operators — demonstrating that enforcement appetite was already escalating before AMLA took the field.

---

Impact on Players and Operators

For bettors, the near-term effect is more rigorous KYC at onboarding and more frequent source-of-funds checks for high-value activity — particularly at VIP and high-stakes levels. Operators that have historically relied on looser national interpretations may tighten verification requirements or withdraw from certain markets rather than absorb compliance costs.

For operators, the message from compliance analysts is blunt: retrofitting AML infrastructure after AMLA supervision begins will cost significantly more than building it now. Operators running multi-jurisdictional businesses — especially those using an MGA licence as a de-facto EU passport — should treat the 15 August 2026 data collection deadline as a hard planning milestone. Operators that anticipated the shift and invested in robust systems are positioned to benefit from a more level competitive field, as undercapitalised rivals face disproportionate compliance burdens.

One structural change with long-term market implications: AMLA's framework reduces the advantage historically enjoyed by operators choosing Malta or Gibraltar licences as a lower-scrutiny route to EU customers. With harmonised standards and a Frankfurt-based supranational body overseeing the highest-risk cross-border operators, the decades-long model of regulatory arbitrage within the EU single market is effectively ending.

---

Sources

Verified against primary regulatory publications and specialist iGaming legal analysis.

The era of regulatory arbitrage within the EU single market is ending — operators that built compliance infrastructure in anticipation of this shift are best placed to compete as the rules converge around them.

— BSN Team, Bright Side of News · Analysis of AMLA's gambling enforcement mandate, May 2026