Disponibile in inglese.

Aleksander Wasiak, Karol Chrzanowski

11 novembre 2026

EU AML Regulation (AMLR) for gambling operators | Customer Due Diligence Guide

What the EU AMLR and AMLA's final draft standards mean for player onboarding, age checks and the EUR 2,000 threshold.

Providers of gambling services are obliged entities under the EU Anti-Money Laundering Regulation (AMLR), which applies directly from 10 July 2027.

A gambling operator must apply customer due diligence when it establishes a business relationship and upon the collection of winnings or the wagering of stakes of EUR 2,000 or more, in a single operation or through linked transactions.

Under AMLA's final draft standards, remote verification is expected to use suitable eIDs, including the EU Digital Identity Wallet (EUDI Wallet), or relevant qualified trust services wherever possible.

Written by Aleksander Wasiak (Compliance Officer) and Karol Chrzanowski (Sales Account Executive), Authologic.

Title card reading "AMLR for gambling operators" with the line "Customer Due Diligence Guide"

Key takeaways

The AMLR applies from 10 July 2027, and providers of gambling services are obliged entities under it.
Gambling operators apply customer due diligence to winnings collected or stakes wagered of EUR 2,000 or more, single or linked (Article 19(5) AMLR).
Under AMLA's final draft standards, games provided by the same provider are a criterion when assessing whether gambling transactions are linked.
In Authologic’s conversations with gambling operators, those entering new markets say that adapting verification to each market matters more than the price per check.
Under the draft CDD RTS, remote verification is expected to use suitable eIDs, including the EUDI Wallet, or relevant qualified trust services wherever possible; alternative remote document checks are subject to conditions and must be justified.

Does the AMLR apply to gambling operators?

Providers of gambling services are obliged entities under the AMLR.

Member States may exempt certain gambling services in full or in part on the basis of proven low risk, but not casinos and, with exceptions, not providers whose principal activity is online gambling or sports betting (Article 4 AMLR).

The AMLR applies directly in all Member States from 10 July 2027. Until then, gambling operators' AML obligations derive from Directive (EU) 2015/849, as amended, and applicable national law.

How the AMLR changes remote onboarding for all obliged entities is explained in How to verify customers remotely under AMLR.

When must a gambling operator apply customer due diligence?

A gambling operator applies customer due diligence when it establishes a business relationship (Article 19(1)(a) AMLR).

In addition, providers of gambling services apply customer due diligence upon the collection of winnings, the wagering of a stake, or both, when the transaction amounts to at least EUR 2,000, whether carried out in a single operation or through linked transactions (Article 19(5) AMLR).

Other CDD triggers, including suspected money laundering or terrorist financing and doubts about identification data, apply independently of this threshold.

When gambling operators apply customer due diligence under Article 19 AMLR

Situation	What the operator must do	Legal basis
Establishing a business relationship	Apply customer due diligence	Article 19(1)(a) AMLR
Collecting winnings or wagering a stake of EUR 2,000 or more, single or linked	Apply customer due diligence	Article 19(5) AMLR
Occasional transaction of EUR 10,000 or more, single or linked	Apply customer due diligence	Article 19(1)(b) AMLR
Suspected money laundering or terrorist financing	Apply customer due diligence, regardless of value	Article 19(1)(d) AMLR
Doubts about identification data, or about whether the person is the customer	Apply customer due diligence	Article 19(1)(e) and (f) AMLR

Under AMLA's final draft standards on business relationships, occasional and linked transactions, registration that grants a customer ongoing access to services may indicate an expected degree of duration, one of the signs of a business relationship.

The draft was submitted to the European Commission on 1 October 2026, and the Commission may still amend it.

What counts as a linked transaction for a gambling operator?

Under the same final draft standards, providers of gambling services must consider games provided by the same provider as a criterion when assessing whether transactions are linked.

The draft also asks every obliged entity to consider whether transactions are carried out within a short timeframe, given the nature of its business. The 1-month period set for some crypto-asset and money transfer services does not apply to gambling, and AMLA did not adopt a separate timeframe for the sector.

The draft does not set a threshold lower than EUR 2,000 for gambling.

What do AMLA’s draft CDD RTS change in remote onboarding?

Under the draft CDD RTS, obliged entities are expected to verify customers remotely using electronic identification at assurance level substantial or high, including the EUDI Wallet, or relevant qualified trust services under eIDAS, wherever possible.

The draft allows alternative solutions where a natural person cannot reasonably be expected to present an identity document in person and has access to neither qualifying electronic identification means nor relevant qualified trust services.

Such solutions must use reliable and independent sources and meet prescribed safeguards. Copies must be retained, time-stamped and stored securely, and the operator must be able to justify why the customer could not be verified through the methods referred to in Article 22(6) of the AMLR.

AMLA submitted the draft CDD RTS to the European Commission on 1 October 2026, and the Commission has not yet adopted them.

If adopted in their current form, the standards would apply 6 months after entering into force.

What the draft changes for all obliged entities is explained in How to verify customers remotely under AMLR.

Where do eIDs and the EUDI Wallet fit for a gambling operator?

Article 22(6) of the AMLR recognises electronic identification means at assurance level substantial or high, as well as relevant qualified trust services, as routes to verify a customer's identity.

Under the eIDAS Regulation (Regulation (EU) No 910/2014, as amended), the EUDI Wallet is an electronic identification means provided under an electronic identification scheme with assurance level high, so it is one such means.

Assurance levels are explained in What is a level of assurance under eIDAS?

For a gambling operator, a qualifying eID or EUDI Wallet can verify identity at registration and before winnings or stakes reach EUR 2,000, but it does not complete full CDD by itself.

Article 22(1) of the AMLR also requires, except in cases of lower risk, the customer's usual place of residence or, where there is no fixed residential address with legitimate residence in the Union, a postal address at which the customer can be reached; where an eID does not return the required address, it has to come from another source, as How do you choose identity verification methods for each country? explains.

From 24 December 2027, private relying parties, except micro and small enterprises, must accept the EUDI Wallet at the user's voluntary request where strong user authentication for online identification is required by law or contract.

Whether this applies to a given gambling operator depends on its services and contracts. The EUDI Wallet does not replace sanctions and PEP screening, beneficial ownership checks or transaction monitoring.

How does age verification fit with AMLR customer due diligence?

The AMLR does not set a minimum age for gambling; minimum ages and how they are checked are set by national gambling law.

The person identification data in the EUDI Wallet includes the date of birth, and many national eIDs return it too, so one verification at registration can confirm both identity and age.

Not every eID method returns the date of birth, so this needs checking market by market.

What do gambling operators ask about AMLR onboarding?

Many of the gambling operators that Karol Chrzanowski, Sales Account Executive at Authologic, speaks to rely on one of a few large document and selfie vendors. Others built KYC in-house and now find it hard to cover new countries. Decisions about verification often involve payments teams as well as compliance.

Their first questions are practical: what would change if they already have a provider, whether players will actually use an eID, and what the AMLR changes for onboarding and whether it applies to them.

The answer depends on the market.

Where national eIDs or bank IDs are widely used, as in Poland or the Baltic states, players can sign up in an app they already have.

In July 2026, monthly active users of widely used identity apps ranged from the equivalent of about 7% of adults in Germany (AusweisApp) to about 64% in Denmark (MitID), according to the estimates in eID Adoption Race H1 2026.

For operators licensed in several markets, the main cost is usually adapting verification each time they enter a new country rather than the price per check.

Completion, retries and manual review often matter more, and in some markets the platform provider decides the technology stack instead of the operator. The metrics he suggests watching are first-pass rate, manual review rate, time to verify and cost per approved player.

Readiness varies.

Several compliance teams Karol has spoken to have not started preparing for July 2027, while others are already looking at wallets, and for some the trigger is expansion into a new market rather than the AMLR.

Our advice: treat verification as part of the product from account creation, because players, especially younger ones on mobile, expect sign-up to take seconds. List, market by market, where your players can use an eID and where they cannot, because that is where your fallback volume will sit.

Five questions to ask your current provider

Which methods do you support in each of our markets?
Which attributes does each method return?
What is logged per verification?
What happens when a method fails?
How ready are you for EU Digital Identity Wallets?

How should a gambling operator prepare for the AMLR?

Map where players register, where winnings are collected and stakes wagered, and where transactions may be linked across games you provide.
Offer qualifying eIDs and the EUDI Wallet first in the markets you serve, assess bank IDs separately, and use remote document checks as a justified fallback only where permitted.
Record which method verified each player and, for alternative remote document checks, why the player could not be verified through the methods referred to in Article 22(6) of the AMLR.
Check the data set against Article 22(1) of the AMLR, including the usual place of residence or, where permitted, a postal address, and the date of birth needed for national age rules.

A full self-assessment is in Are you ready for July 2027? A 32-question SCA & AMLR readiness checklist, and how identity platforms compare on AMLR requirements is covered in Best AML and KYC identity verification platforms.

The same rules for crypto-asset service providers are covered in EU AML Regulation (AMLR) for crypto-asset service providers, and key AML terms are defined in the AML and KYC Glossary.

Authologic builds eID-native identity infrastructure that helps regulated businesses identify, onboard and authenticate their customers.

FAQ

Do gambling operators have to verify players below EUR 2,000?

Gambling operators apply customer due diligence when they establish a business relationship, regardless of amounts. In addition, the AMLR requires customer due diligence upon the collection of winnings or the wagering of a stake of EUR 2,000 or more, whether in a single operation or through linked transactions (Article 19(5) AMLR). Suspicion of money laundering or terrorist financing triggers customer due diligence regardless of value.

Can a gambling operator onboard players with the EUDI Wallet?

A gambling operator can use the EUDI Wallet to verify identity as part of onboarding; other CDD obligations still apply. The EUDI Wallet is an electronic identification means, and Article 22(6) of the AMLR recognises electronic identification means at assurance level substantial or high, as well as relevant qualified trust services, as routes to verify identity. Every Member State must provide at least one EUDI Wallet by 24 December 2026.

Does the AMLR set a minimum gambling age?

The AMLR does not set a minimum gambling age. Minimum ages and age checks are set by national gambling law. A verified date of birth from an eID or the EUDI Wallet can be used for customer due diligence and, where national law accepts it, for the national age check.

Sources

This guide is for general information and is not legal advice. Legal status reviewed on 11 November 2026: the AMLA draft standards cited here have been submitted to the European Commission and have not been adopted.