KYC Compliance for Online Gaming and Betting in the EU

Introduction to KYC in EU Online Gaming and Betting

Consumer protection, responsible gambling, and anti-money laundering (AML) regulation intersect in the online gaming and betting industry across the European Union. Gambling regulation in the EU remains primarily a matter of national law, unlike financial services, where a single EU-wide supervisory framework governs most activities. Licensing requirements, KYC obligations, and responsible gambling standards are set by each member state, producing a fragmented but increasingly converging regulatory landscape.

Baseline KYC and AML obligations on gambling operators across all member states are still imposed by EU-level instruments — most notably the Anti-Money Laundering Directives (AMLD). Key compliance requirements that online gaming and betting operators must satisfy when serving EU customers are examined in this guide. Foundational identity verification concepts are covered in our resource on what is KYC.

The EU AML Framework and Gambling

AMLD Applicability to Gambling

Gambling services were brought within the scope of EU AML obligations by the Fourth Anti-Money Laundering Directive (4AMLD, Directive 2015/849). Providers of gambling services are designated as obliged entities under Article 2(1)(3)(f). Thresholds were lowered and the scope of obliged gambling operators expanded when the Fifth Anti-Money Laundering Directive (5AMLD, Directive 2018/843) further tightened requirements.

Certain gambling services may still be exempted by member states from AML obligations on the basis of a proven low risk, but the overall direction is toward broader coverage. Full CDD programmes are now required in most member states of online casinos, sports betting operators, poker platforms, and lottery providers.

The Upcoming EU AML Package

Obligations across member states will be further harmonized by the EU's AML legislative package — comprising the Anti-Money Laundering Regulation (AMLR) and the establishment of the Anti-Money Laundering Authority (AMLA). National implementation differences will be eliminated by the AMLR, as a directly applicable regulation, which will impose uniform CDD, record-keeping, and reporting requirements on gambling operators throughout the EU. Centralized supervision of the highest-risk obliged entities will be provided by AMLA, potentially including major cross-border gambling groups.

Customer Due Diligence for Gaming Operators

When CDD Must Be Applied

CDD measures must be applied by online gambling operators, under the AMLD framework as transposed into national law, when:

1. Establishing a customer account: Any registered player account triggers CDD obligations. In practice, identity verification must occur at or shortly after registration.
2. Processing transactions above applicable thresholds: Some member states set specific thresholds (e.g., EUR 2,000 in cumulative deposits or withdrawals) that trigger enhanced verification if it has not already been completed.
3. Suspecting money laundering or terrorist financing: Transaction size does not matter.
4. Doubting previously obtained identification data: Re-verification requirements are then triggered.

Identity Verification Requirements

At a minimum, operators must collect and verify:

• Government-issued identity document — passport, national ID card, or driving licence
• Residential address
• Date of birth — critically important for age verification as well as AML purposes
• Full name of the player

Reliable and independent sources must underpin verification. Automated identity verification is essential given the digital nature of online gambling. Player identities can be verified in real time through document authentication, biometric facial matching, and liveness detection on Joinble's AI-powered verification platform — creating a seamless onboarding experience that satisfies both AML and responsible gambling requirements.

Enhanced Due Diligence Triggers

EDD must be applied by gaming operators in cases involving:

• Unusual patterns: Rapid deposit-withdrawal cycles with minimal play, or accounts used primarily as transfer mechanisms.
• Players from high-risk jurisdictions: As identified by the European Commission's delegated acts or national risk assessments.
• Politically Exposed Persons (PEPs): Standard PEP screening and enhanced monitoring obligations apply.
• High-value players (VIPs): Customers who deposit or wager large amounts require additional scrutiny, including source of funds verification.

Age Verification: A Dual Obligation

Regulatory Requirements

Both consumer protection and AML purposes are served by age verification in EU online gambling. Minors are prohibited from gambling in every EU member state, with the minimum age set at 18 in most jurisdictions (though some, like certain German states, set it at 21 for casino games).

Strict liability for allowing underage gambling falls on online operators. Severe penalties — including licence revocation — are imposed by national regulators for failures in age verification. Age verification must be completed before a minor can access gambling services, unlike AML-driven CDD, which may in some cases permit a risk-based delay.

Practical Implementation

A simple date-of-birth declaration is not enough for effective age verification. Across the EU, regulatory expectations increasingly demand:

• Biometric age estimation: Emerging technologies that estimate age from facial images, used as a supplementary (not primary) check.
• Database checks: Cross-referencing against national population registries, credit reference agencies, or electoral rolls.
• Document-based verification: Automated validation of the date of birth on a government-issued ID, cross-referenced with the player's declared age.

The person registering is both of legal age and the genuine holder of the identity document presented when document verification is combined with biometric liveness detection — as offered by platforms like Joinble.

AML-Specific Risks in Online Gaming

Money Laundering Typologies

Distinct money laundering risks in the gaming sector must be addressed by operators through their transaction monitoring systems:

• Peer-to-peer transfers: Where platforms allow player-to-player transfers, these can be used to move value between parties without adequate scrutiny.
• Bonus abuse for laundering: Promotional offers are exploited to convert illicit deposits into apparently clean winnings.
• Multi-account abuse: Multiple accounts (often with stolen identities) are used to layer funds and obscure their origin.
• Minimal play schemes: Funds are deposited, limited low-risk betting is placed, and the balance is withdrawn to create a seemingly legitimate paper trail.
• Chip dumping in poker: Funds are deliberately lost to an accomplice at the table to transfer value.

Transaction Monitoring Obligations

Real-time or near-real-time transaction monitoring capable of detecting the typologies above must be implemented by operators. Among the key indicators:

• Players who consistently bet on opposing outcomes across different platforms
• Withdrawal requests to different accounts or payment methods than those used for deposits
• Frequent deposits from multiple payment methods
• Accounts with high deposit volumes but minimal gaming activity
• Deposits that are significantly disproportionate to the player's known financial profile

National Regulatory Landscapes: Key Jurisdictions

Malta (MGA)

One of Europe's most established gambling regulators is the Malta Gaming Authority. Malta's Prevention of Money Laundering Act (Chapter 373) and the MGA's dedicated AML/CFT guidance for remote gaming operators must be complied with by MGA licence holders. Full CDD is required in Malta before a player can withdraw funds or once cumulative deposits reach EUR 2,000.

United Kingdom (Gambling Commission)

The UK Gambling Commission's approach heavily influences EU regulatory thinking, even though the UK is no longer an EU member state. Customer identity must be verified by operators before gambling is allowed, with a particular focus on source of funds checks for high-spending customers. Affordability assessments have been introduced as part of the KYC process by recent regulatory updates.

Germany (GlüStV 2021)

A centralized player blocking system (OASIS) and strict deposit limits of EUR 1,000 per month across all licensed operators were introduced by Germany's Interstate Gambling Treaty (Glücksspielstaatsvertrag 2021). Full identity verification is mandatory before any gambling activity, and players must be cross-referenced by operators against the OASIS database.

Spain (DGOJ)

Identity must be verified by operators using the national DNI or NIE within 30 days of account creation, as required by Spain's Dirección General de Ordenación del Juego. Funds cannot be withdrawn by players until verification is complete. Targeted inspections have recently been used by the DGOJ to increase its focus on AML compliance.

France (ANJ)

Online gambling in France is supervised by the Autorité nationale des jeux. Government-issued documents must be used by French-licensed operators to verify player identity, and AML obligations under the Code monétaire et financier apply. Online gambling in France is restricted to sports betting, horse race betting, and poker — online casino games remain prohibited.

Responsible Gambling and KYC Integration

Operators are increasingly expected by EU regulators to integrate responsible gambling obligations into their KYC processes. Identity verification is therefore not only about preventing financial crime but also about:

• Behavioural monitoring: Player behaviour patterns that may indicate problem gambling are tracked, with proactive intervention.
• Affordability assessments: CDD-gathered financial information is used to set appropriate deposit and loss limits.
• Self-exclusion checks: Whether a player appears on national or cross-border self-exclusion registers is verified before account creation is allowed.

These integrated workflows are supported by Joinble's identity verification platform, which combines AML-grade identity checks with the data points operators need for responsible gambling assessments — including age verification, document authentication, and cross-referencing against exclusion databases.

Record Keeping and Reporting

CDD records and transaction data must be retained by gambling operators, under the AMLD framework, for at least five years after the end of the customer relationship. Suspicious Transaction Reports (STRs) must be filed with the national Financial Intelligence Unit (FIU) in each member state where the operator is licensed. Reporting obligations to several FIUs simultaneously may apply to operators active across multiple EU jurisdictions.

FAQ

Are all types of online gambling subject to AML obligations in the EU?

Providers of gambling services are obliged entities under 4AMLD and 5AMLD. Certain low-risk gambling services may, however, be exempted by member states based on a national risk assessment. That discretion is expected to be reduced by the upcoming AMLR, which will apply uniform AML obligations to a broader range of gambling activities. Foundational KYC concepts relevant to gaming are covered in what is KYC.

When must age verification be completed for online gambling in the EU?

Age verification is required by most EU member states before a player can access gambling services or, at a minimum, before they can deposit or wager real money. Verifying age at registration, before any gambling activity occurs, is best practice — and the regulatory trend. A brief grace period for verification is allowed in some jurisdictions, but functionality is restricted until identity and age are confirmed.

What are the consequences of failing KYC compliance for a gaming operator?

Financial penalties, licence suspension or revocation, public enforcement actions, and potential criminal liability for senior managers are typical, though consequences vary by jurisdiction. Multimillion-euro fines have been imposed by several EU regulators on operators for AML and KYC deficiencies in recent years.

How can online gaming operators handle KYC for players across multiple EU countries?

The CDD requirements of each licensing authority must be complied with by operators licensed in multiple jurisdictions. A centralized identity verification platform that supports multiple document types and national databases is essential. Documents from all 27 member states must be verified by MGA-licensed operators serving customers across the EU, for example, and the strictest applicable standard applied.

Does the EU require source of funds checks for all gambling customers?

Under the AMLD framework, source of funds (SoF) checks are not universally required for all customers — they are primarily an EDD measure for high-risk situations. SoF checks are required by several national regulators (notably the UK Gambling Commission and increasingly MGA and DGOJ) when customer deposits exceed certain thresholds or when affordability concerns arise. Broader application of SoF requirements across the EU gambling sector is the trend.