iGaming compliance in 2027: what the AMLR means for operators

One rulebook from 10 July 2027

On 10 July 2027, the EU Anti Money Laundering Regulation (AMLR) applies directly in every Member State. For iGaming operators, that means one AML text across all EU markets, with no national transposition and no grace period.

Other deadlines land in the same window. Every Member State must offer an EUDI Wallet by 24 December 2026. Spain's payment method ownership checks apply from 28 October 2026. And private services that are legally required to use strong user authentication must accept EUDI Wallets no later than 24 December 2027.

The EUR 2,000 trigger

Identity verification comes first: you verify the player before the account is active (Article 23). On top of that, Article 19 adds a trigger specific to gambling: CDD applies when a player wagers a stake or collects winnings of at least EUR 2,000, in one operation or through linked transactions.

Linked is the hard part. A player who splits deposits and bets into smaller amounts still triggers CDD once they add up. Your monitoring has to aggregate across sessions, products and channels.

Remote KYC gets an order of preference

Article 22 puts eIDAS electronic identification first for remote verification. Document scans, selfies and video become fallbacks, and you need to explain to your supervisor why you used them.

In practice, that makes ID wallets the reference method. Operators will need a wallet path and a fallback path running side by side, because wallet use stays voluntary for players.

National rules still sit on top

The AMLR sets the AML floor. National regulators keep their own rules:

• 🇪🇸 Spain: the holder of every payment method must match the account holder, from 28 October 2026. Existing players have 6 months, and can't withdraw winnings until the check is done.
• 🇩🇪 Germany: EUR 1,000 monthly deposit limit across operators, checked through LUGAS.
• 🇮🇹 Italy: accounts can only be opened with a valid ID document or a digital identification tool recognised in Italy.
• 🇳🇱 Netherlands: players are admitted only after a check against the CRUKS self exclusion register, with default monthly deposit limits for new players.

The UK sits outside the AMLR, but it shows where things are going: its Gambling Commission will introduce financial risk assessments in stages, starting with the largest operators. The checks run in the background on trusted data, with friction only for the few players who need it.

Get the full guide

Our** iGaming Compliance Guide 2027** explains the AMLR rule by rule for MLROs and compliance officers: the 9 CDD measures, the key dates, national rules in 6 EU markets plus the UK, and a 26 point readiness checklist you can hand to your team on Monday morning.

At** Gataca**, we help iGaming operators verify players through ID wallets with a document fallback, plus iterative verification and trust scoring on every login, deposit and bet. Talk to our team.