AMLR for iGaming:
what changes on 10 July 2027.

The Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, is the EU's single rulebook for anti-money laundering and counter-terrorist financing. It sets common rules on customer due diligence, beneficial ownership, ongoing monitoring, internal controls and reporting for all obliged entities in the EU, including gambling operators.

The AMLR applies from 10 July 2027. It was published in the Official Journal on 19 June 2024 as part of the EU AML package, giving firms three years to prepare.

Yes. Gambling service providers are obliged entities. They must apply customer due diligence when collecting winnings, wagering a stake, or both, where the amount is €2,000 or more, whether in a single operation or linked transactions. Member States may exempt gambling services of proven low risk, but not casinos or providers whose principal activity is online gambling or sports betting, unless the service is operated or regulated by the State.

€2,000 or the equivalent in national currency, applied when a player wagers a stake, collects winnings, or both, under Article 19(5). Linked transactions count towards the threshold, so operators need to aggregate activity rather than assess each bet on its own.

AMLA's final draft criteria for linked transactions include transactions made remotely or at different establishments, so online and land-based activity by the same player should be assessed together where the same obliged entity runs both. Brands operated by the same licensed entity are one obliged entity, so the same player across those brands is the same person. Where brands sit in separate group entities, each entity applies the rules itself, and group-wide policies govern how information is shared.

Usually not. Most operators already have KYC, screening and some monitoring in place, and the AMLR gaps are narrower: linking players across accounts, brands and channels, aggregating activity towards the €2,000 threshold, and evidencing it. The stack Endida delivers is modular, so operators and platforms can add only the capabilities they need through one API, alongside what they already run.

Yes, indirectly. B2B platform providers are generally not obliged entities in their own right, but the operators they host are, so AMLR-grade requirements on player data, monitoring and audit trails flow into platform RFPs and contracts. Platforms that add linked-player monitoring and FRAML capability can offer it across their whole operator base.

AMLA's final draft standard under Article 19(9), sent to the European Commission on 1 October 2026, asks firms to make an overall assessment using criteria including transactions by the same person, a common origin or destination such as customers acting in concert or shared digital infrastructure, the same purpose, and a short time frame. Gambling providers must also take into account games provided by the same provider. In practice this means identifying when several accounts, devices or payment methods belong to one player.

Yes. Article 22 allows identity to be verified using electronic identification means that meet the eIDAS Regulation (EU) No 910/2014 at assurance level substantial or high, or relevant qualified trust services, alongside verification from documents and reliable independent sources.

Not directly. It applies to EU obliged entities, so it reaches UK, Gibraltar, Guernsey, Jersey and other non-EU groups through their EU-licensed subsidiaries and branches, through group-wide policies set by an EU parent, and through EU banks, payment partners and clients that expect AMLR-grade due diligence from their counterparties.

The AMLR is a regulation that applies directly to firms and sets their obligations. AMLD6 is a directive that Member States transpose, covering supervisors, financial intelligence units and registers. AMLA is the new EU Anti-Money Laundering Authority in Frankfurt, which drafts technical standards, coordinates national supervisors and will directly supervise around 40 high-risk cross-border financial groups from 2028.

AMLA's final draft customer due diligence standards, submitted to the European Commission on 1 October 2026, expect existing customer files to be brought up to the new standard on a risk-sensitive basis, starting with higher-risk customers. Separately, the AMLR requires customer information to be updated at least every year for higher-risk customers and at least every five years for others.

Penalties are set in the Sixth AML Directive (AMLD6, Directive (EU) 2024/1640), which each Member State transposes. For serious, repeated or systematic breaches of the AMLR's rules on internal controls, customer due diligence, reporting and record retention, national law must allow maximum fines of at least €1 million or twice the benefit derived from the breach, whichever is higher, for gambling operators and other non-financial obliged entities; at least €10 million or 10% of total annual turnover for banks and financial institutions; and at least €5 million for individuals. Member States can set higher maximums. Supervisors can also issue public statements naming the firm, order corrective measures, suspend or withdraw a licence, temporarily ban managers, and impose periodic penalty payments of up to 3% of average daily turnover until a firm complies.

Persons trading in goods or providing services may not accept or make cash payments above €10,000, including linked payments. Member States can set lower limits, and existing lower national limits continue to apply.