Talk to usTry the demo

Online Gaming and Casinos: Customer Due Diligence for Gambling Operators

KYC, AML and digital identification

For: Compliance officer, MLRO or product owner at an online gaming, betting or casino operator, or at a provider that serves one

When a gambling operator must verify a customer under the EU AML Regulation (from 10 July 2027) and the UK casino rules, what the UK regulator found, and where remote verification is weakest.

For information; not legal advice.

An online casino has a sign-up form, a payment page and a customer it will probably never meet. Two questions follow from that. When does the law require the operator to identify and verify the person, and what do supervisors find when they inspect how operators do it? This article answers both from primary texts: the EU Anti-Money Laundering Regulation, the UK regulations for casinos, and the publications of the UK Gambling Commission, which supervises casinos in Great Britain for money laundering and has published detailed findings.

Timing matters, and it separates the two regimes. Article 90 of the Regulation says it applies from 10 July 2027. Every rule of the Regulation described in this article is therefore a rule that starts on that date, and it is kept apart below from the obligations that apply today. The obligations in force today for an operator in the European Union come from national law, which this article does not describe and which differs from one country to the next. The obligations in force today in Great Britain, for casinos, are the British Regulations described in the part on the British regime and in the regulator's findings.

It is about customer due diligence, not about age checks. For the age side of gambling, read the article on what regulators ask of age assurance. For the wider frame of the EU rules, see the article on customer due diligence measures under the EU AML Regulation.

Who is covered

In the EU Regulation (applies from 10 July 2027)

Regulation (EU) 2024/1624 lists providers of gambling services among its obliged entities in Article 3. Its definition of a gambling service is a service which involves wagering a stake with monetary value in games of chance, including those with an element of skill, such as lotteries, casino games, poker games and betting transactions, provided at a physical location or by any means at a distance, and at the individual request of a recipient of services. The definition is wide on purpose: it follows the product, not the channel.

Article 4 lets Member States exempt providers of gambling services, in full or in part, on the basis of proven low risk. The exemption cannot apply to casinos, or to providers whose principal activity is online gambling or sport betting, other than online gambling services operated by the State or regulated by the State in the way the article describes. The recitals explain the logic: lotteries and State-administered gambling may carry low risk, but no exception should be granted for activities associated with higher risks, which the recitals name as casinos, online gambling and sport betting. A Member State that uses the exemption must carry out a risk assessment, and must monitor so that the exemption is not abused. The Commission may approve a national decision or reject it where the exception is not justified by proven low risk, as the recitals put it.

In plain terms: from 10 July 2027, an online casino or betting operator in the EU should assume it is in scope of the Regulation in full. Whether a particular lottery product is exempt in a given country is a question for the national law.

In Great Britain

The British regime is narrower. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 apply to casinos, and the Gambling Commission describes casinos, remote and non-remote, as having additional legal responsibilities because they must comply with the Regulations for casino gaming, gaming machines and any money service business activity they offer. All gambling operators must still assess money laundering risk and have controls under their licence conditions, but the full customer due diligence regime of the Regulations is a casino regime. The 2026 risk assessment notes that HM Treasury and the Home Office must consider, when compiling the national risk assessment, whether providers of gambling services other than casinos should continue to be excluded from the Regulations.

The point matters for a vendor and for a product team. The same customer journey can be a legal obligation in one market and a licence-condition expectation in another.

When customer due diligence applies

The EU triggers, from 10 July 2027

Article 19 of the EU Regulation sets the general triggers: establishing a business relationship, an occasional transaction at or above a threshold, a suspicion of money laundering, and doubts about the veracity of earlier identification data. Paragraph 5 adds a rule for gambling: providers of gambling services apply customer due diligence upon the collection of winnings, the wagering of a stake, or both, when carrying out transactions amounting to at least EUR 2 000, whether in a single operation or through linked transactions.

The recitals add two points that shape a system design. First, the threshold is met whether the customer makes one transaction of that amount or several smaller ones that add up to it. Second, providers should be able to attribute transactions to a given customer even before the customer's identity is verified, so that they can tell whether and when the threshold has been reached, and so they should have systems that allow attribution and monitoring of transactions before the due diligence requirement is applied. An operator that counts deposits per verified account only will not see a customer who has not yet been verified.

Paragraph 8 gives physical premises an alternative. A provider may identify the customer and verify identity on entry to the casino or other physical gambling premises, provided systems attribute transactions to specific customers. The recitals explain that checking identity at every transaction can be impractical in a casino. No equivalent relief exists for a remote product; at a distance, the account is the entry point.

What due diligence consists of, from 10 July 2027

Article 20 lists the measures. They cover identifying the customer and verifying identity, and identifying the beneficial owners and taking reasonable measures to verify their identity. They cover understanding the purpose and intended nature of the relationship or the occasional transaction, and the nature of the customer's business or occupation. They cover verifying whether the customer or the beneficial owners are subject to targeted financial sanctions, which for a legal entity includes whether sanctioned persons control it or hold more than half of its proprietary rights. They cover ongoing monitoring of the relationship, including where necessary the source of funds. They cover determining whether the customer, the beneficial owner and, where relevant, the person on whose behalf or for whose benefit a transaction is carried out is a politically exposed person, a family member or a person known to be a close associate. They cover identifying and verifying natural persons for whose benefit a transaction is conducted, and verifying that anyone who purports to act for the customer is authorised and has been identified and verified. Article 20(2) says the extent of the measures follows an individual analysis of the risk, and Article 20(4) says the obliged entity must be able to demonstrate to its supervisor that its measures are appropriate. Where the entity cannot complete the measures, Article 21(1) says it shall refrain from carrying out a transaction or establishing a business relationship, shall terminate the business relationship, and shall consider reporting a suspicious transaction to the financial intelligence unit. Article 21(3) requires it to keep a record of the actions taken, including the decisions and their justification, and this also covers the cases where it refuses or terminates a relationship.

The British trigger

Regulation 27 of the British Regulations says a casino must apply customer due diligence in relation to a transaction of GBP 2,000 or more, whether in a single operation or in linked operations. The transactions covered are the wagering of a stake, including the purchase of tokens, payment for use of gaming machines and the deposit of funds required to take part in remote gambling, and the collection of winnings, including the withdrawal of funds deposited for remote gambling. Winnings from a previous transaction that were not collected and are being re-used are left out when determining whether the threshold is reached. The legislation.gov.uk page for the provision stated at the time of reading that it was up to date with all changes known to be in force on or before 27 October 2026.

The regime also applies customer due diligence when a business relationship is established, which is the point the regulator's findings turn on, as the next part shows.

What the regulator found

The Gambling Commission publishes bulletins on what it sees in compliance and enforcement work. The casino bulletin of October 2025 is a list of failures that are useful as a design checklist, because most of them are about when and how the checks run, not about whether they exist.

Checks that start at a threshold

The Commission found licensees that began customer risk profiling and risk-based due diligence only once a financial threshold was reached, although other risk factors were clear from the start of the relationship. It found some thresholds set at an inappropriately high level for the business model and customer base. The result, in its words, was that customers with significant risk factors could use the casino without appropriate due diligence, or until they had deposited and withdrawn large sums. Its answer is not to drop thresholds: they are a useful tool, but they must not be relied on in isolation and must be set according to the operator's own risk assessment. At the commencement of the relationship the operator should consider who the customer is, what they do, where they live and do business, and the nature of the product required, and so determine the level of initial and ongoing due diligence. The 2026 assessment of remote casinos lists inappropriate anti-money-laundering thresholds, including thresholds that are not appropriate for the customer base or are predominantly loss based, as a high risk, and it lists lack of adequate due diligence on customers who are not physically present as a new high risk.

The EU Regulation's attribution rule, which applies from 10 July 2027, points the same way from the other side: a threshold is a trigger for the obligation, not a licence to know nothing about the customer before it.

Documents that are collected but not read

The Commission found cases where documents were collected but the risk indicators in them were not identified or acted on. Its examples include bank statements showing significant third-party deposits or outgoings higher than income, and documents with indicators that they were false or fraudulent where enhanced due diligence was not carried out. It cites Regulation 33(1)(e): enhanced due diligence and enhanced ongoing monitoring apply where the operator discovers that a customer provided false or stolen identification and proposes to continue to deal with the customer. It also found weak record keeping on document reviews, which makes it hard to show the regulator what was decided and why, and it states that records must be made at the time of the decision. The Commission describes its approach to assessments as show me, don't tell me.

Artificial intelligence on both sides

The April 2025 emerging risks bulletin records an increase in the scale and sophistication of attempts to bypass customer due diligence checks using false documentation, deepfake videos and face swaps generated by artificial intelligence. It cites the National Crime Agency's observation that accounts successfully created using AI are more likely to be used for criminality. Operators must scrutinise documents received and train staff to spot false and AI-generated documents. The 2026 assessment repeats the concern and adds that the use of AI tools to generate documents or videos sits inside its false or stolen identity documentation risk, which it rates high.

On the control side, the October 2025 bulletin warns about operators' own algorithms. Operators did not always understand how an algorithm worked as an AML control; some models needed a level or length of activity before they scored a customer, which left early activity outside the control; and in some cases the team handling an escalation could not see why the account had been escalated. The Commission says it will ask about the methodology, including what is scored, how it is weighted, the thresholds and how escalations are triggered, and that trained AML staff are still required.

Documents that are not evidence of identity

The April 2025 bulletin lists two cases that are specific to onboarding. It describes companies paying consumers for their personal details so that the company can open multiple gambling accounts in the consumer's name, and it reminds licensees of the licence condition to obtain and verify identity information before a customer may gamble and to keep it accurate. It also states that an application registration card issued by the Home Office to asylum claimants is not evidence of identity and must not be accepted as identity documentation. Both cases are policy questions as much as technical ones: which documents the operator accepts has to be written down, and staff and systems have to follow it.

Third parties

Several findings concern reliance. The April 2025 bulletin says that operators must scrutinise funds received through payment terminals themselves and must not rely on the third-party terminal provider or payment processor to check them. The October 2025 bulletin says that, for white-label partners, a failure to carry out customer due diligence is the licensee's responsibility, not the partner's. It also found risk assessments and policies drafted by third parties, including consultancies and AI tools, in which the operator did not know the content of its own policies. The licensee remains responsible. The same principle runs through the EU texts and is the subject of the article on EBA guidelines for banks, where the institution keeps the responsibility for an outsourced onboarding process.

What the 2026 risk assessment says about remote casinos

The Commission's 2026 assessment was published on 30 July 2026. It rates remote casinos as high risk, the same rating as in the previous assessment. It points out that the remote sector faces challenges because customers are not present for verification, including false documentation and the risk of mule accounts, and that the sector is exposed to higher risk payment methods such as e-wallets, pre-paid methods and funds linked to cryptoassets. New risks it lists for remote casinos include inadequate controls on linked or duplicate accounts and failure to scrutinise source of funds documents.

Two of its case studies show how onboarding and monitoring interact. In one, a customer deposited about GBP 40,000 over 6 months by creating accounts with the details of 5 different individuals. In another, a customer whose account had been blocked on suspicion of money laundering got past the identity checks at sign-up and opened a new account, because the operator's controls did not detect small discrepancies in the sign-up data fields. The first is a linked-account problem and the second a matching problem; neither is solved by a better photograph alone.

At national level, the 2025 national risk assessment records that the money laundering risk in the casino sector rose from low to medium, driven by customer, geographical and transaction risks and by the growth of funds moving through remote casinos. It records 247 casino licensees in 2024, of which 97, or 39 percent, the Commission had identified as posing a higher risk. It also notes a rise in the reported use of false identities in attempts to gain access to casinos and the use of VPNs to hide a customer's real location.

What to build into the flow

This section is an inference from the texts above and not a requirement of any of them.

  • Attribute before verifying. Count activity per person or device from the first deposit, so that a threshold can be tested before the identity is verified. This follows the recital on attribution.
  • Profile at the start. Capture the facts that drive risk at registration, such as country, occupation and payment method, and not only after a spend trigger.
  • Read documents, not only collect them. Define which documents are accepted, which are not, and what indicators in a statement lead to enhanced due diligence.
  • Look for linked accounts. A new account can be matched against blocked and earlier accounts, including on small differences in fields.
  • Log the decision. Keep a record of each review made at the time of the decision, because the regulator asks to be shown.
  • Keep responsibility in house. A payment provider, white-label partner or verification vendor can supply a signal, but the operator carries the decision.

Questions for your own file

  • Which legal regime applies to each product and market, and where is that recorded?
  • At what point does the first identity check happen, and what is checked before it?
  • How are linked transactions counted before verification?
  • Who reads the documents, how are they trained, and where are the decisions recorded?
  • What happens when a customer is found to have provided false documents and the operator wishes to continue the relationship?
  • Can the team explain why an automated control escalated an account?

Where this sits in a verification flow

A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The face match step compares the selfie with the portrait on the document in a one-to-one comparison, and includes foreign-face detection and an age check against the date of birth. The liveness step is active: the person moves the face closer through two ovals. Deepfake and face-swap detection works inside the selfie and liveness steps. Document anti-fraud checks, covering screen photos, photocopies, printouts, glued photos, drawn-on elements, erasures, edited images and logical data errors, are included in every package. NeuroVision's international AML screening covers PEP checks that include relatives and associates, as part of a package with sanctions and adverse media. These steps cover the identity part of the checks. Source of funds, transaction attribution and the decision on a risky customer remain with the operator, as the regulator's findings above make clear.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us