KYC and AML in iGaming: New EU Rules Tighten Player Verification by July 2027

Online casino players expect deposits and winnings to be processed in seconds. However, this very speed is what criminals seek to exploit for money laundering. To prevent this abuse, regulators worldwide rely on KYC (Know Your Customer) and AML (Anti-Money Laundering) mechanisms. While KYC simply ensures that the person behind the screen is who they claim to be, AML goes much deeper. It involves assessing financial risk throughout the entire duration of the customer relationship. A major shift is approaching in Europe, as the EU has passed a directly applicable rulebook that will partially replace the patchwork of national laws.

Starting July 10, 2027, Regulation (EU) 2024/1624 will take effect. It stipulates that gambling operators must apply mandatory due diligence whenever stakes, winnings, or linked transactions reach a value of 2,000 euros. Previously, there were significant differences: in Great Britain, checks often must occur before the first play, while Malta also uses the 2,000 euro threshold but allows flexibility in implementation. The new EU regulation leaves less room for interpretation and turns the industry into a central pillar of European financial security.

Numbers and facts

The scale of enforcement is evident in recent fines. In 2025, global penalties against gambling companies totaled at least 184.8 million US dollars. A particularly drastic case involved Olympic Casino Group Baltija in Lithuania, which was fined 8.4 million euros (approximately 9.2 million US dollars). The reason was a failure to verify the source of funds for a former fund manager who gambled millions in stolen money. In Great Britain, AG Communications Limited had to accept a regulatory settlement of 1,407,834 pounds because the company relied too heavily on automated spending limits instead of manually reviewing high-risk customers. Furthermore, a Swedish court in July 2026 upheld fines against Betsson Nordic (6.5 million SEK) and other providers for wrongly assuming deposits were merely previous winnings.

„assuming deposits consist of previous winnings is not an enhanced due diligence measure." - Administrative Court in Linköping, ruling in the Betsson Nordic case

Background

Since Directive 2015/849, gambling providers in the EU have been treated as regulated businesses for anti-money laundering purposes. The challenge for operators is that money moved through e-wallets, prepaid cards, or cryptocurrencies is often difficult to trace. Criminals frequently use accounts across borders to split their activities. The Financial Action Task Force (FATF) therefore places online casinos in a special category requiring strict controls at a threshold of 3,000 euros for linked transactions. The EU's new 2,000 euro threshold goes even further. A key player will be the new AMLA (Authority for Anti-Money Laundering and Countering the Financing of Terrorism), which starts its setup in 2025 and takes over European Banking Authority tasks in January 2026.

Why it matters for German players

For players in Germany, KYC processes have been part of daily life since the State Treaty on Gambling 2021 (GlüStV 2021). Identification often must occur immediately after registration, before the first euro is deposited. The monthly deposit limit of 1,000 euros, monitored via the central LUGAS system, serves both player protection and AML purposes. When the new EU regulation takes effect in 2027, little will likely change for German players as local rules are already stricter than EU minimums. However, providers will have to scrutinize the Source of Funds even more closely if players move large sums regularly. The GGL whitelist ensures that only providers with a German license are used, who implement these strict checks legally.

What it means for GGL-licensed casinos

Providers with a license from the Joint Gambling Authority of the States (GGL) are already required to identify every player beyond doubt. Using biometric matching or accessing databases is standard practice. With the rise of European Digital Identity Wallets by late 2026, these processes could accelerate, though casino operators are currently not required to accept these wallets. GGL-licensed casinos must also ensure they submit Suspicious Activity Reports (SAR) to the Financial Intelligence Unit (FIU) when necessary. Violations of these duties in Germany can lead to license revocation, similar to cases in Sweden or Lithuania. German players should avoid illegal providers without a GGL license (often from Curacao or the MGA), as AML and capital protection are often poorly implemented there.