An online gambling operator answers to the regulator on two fronts. The first is protection against money laundering, known as AML. The second is responsible gambling, which means protecting the players themselves. This article covers the procedures that are mandatory on each front in the EU, the UK, Malta, Curaçao and Estonia, where the two overlap, and what regulators are penalising now. Everything is based on primary sources: laws, regulators’ rules and their decisions.
Checked on 23 October 2026. Rules and sources are current as of this date.
Two regimes, checked separately
For the regulator these are different topics with different documents and different inspectors. For the operator it is one system, because both use the same data about the player.
AML
Preventing money laundering. The operator checks who the customer is, where the money comes from, and whether gambling is used to legalise funds. The sources are the anti-money laundering law, the financial intelligence unit’s supervision and international standards.
Responsible gambling
Protecting the player from harm. The operator checks age, provides control tools, notices signs of problem gambling and intervenes. The sources are the gambling regulator’s rules and licence conditions.
Where they meet
The player’s source of funds, payment methods, a sudden rise in stakes, attempts to get round self-exclusion. These signals matter for both player protection and AML, and decisions on them must be recorded.
Which rules are yours
The rules depend on your licence, not on where you sit. Below we take five systems: the EU, the UK, Malta, Curaçao and Estonia. If you hold another licence the structure is the same, but check the details in its rules.
AML: the mandatory minimum
General customer checks are covered in our article on KYC and KYB. Here we cover only what is specific to gambling.
Business risk assessment
The operator assesses risk across its games, payment methods, player countries and acquisition channels, and records the assessment. In the UK the Gambling Commission publishes its own risk assessment of the industry for operators to use when preparing theirs.
Customer due diligence
The operator establishes the player’s identity and verifies it against documents. From 10 July 2027 the EU’s AMLR (Regulation (EU) 2024/1624) applies and defines gambling as a distinct service for the first time. Checks are required when a stake is placed or winnings are collected at EUR 2,000 or more, in a single transaction or linked ones (recital 64).
Source of funds
If a player deposits and withdraws large sums, the operator finds out where the money comes from and checks it against documents. Regulators look at whether you follow your own procedures, not only at whether they are written down.
Sanctions and PEPs
Players are screened against sanctions lists and checked for politically exposed person (PEP) status, meaning officials, their relatives and close associates. Such customers get deeper checks. In Malta this is expressly part of the FIAU (Malta’s financial intelligence unit) guidance for remote gaming.
Monitoring and reporting
The operator tracks transactions that do not fit the player’s profile and reports suspicious ones to the financial intelligence unit. In the UK this is done under the Proceeds of Crime Act (POCA), in Curaçao through the goAML portal.
AML officer
Someone must be responsible for AML and for reporting suspicions: in Malta this is the MLRO, in Curaçao the compliance officer. Curaçao publishes the requirements for the role in a separate document.
| System | Basis | What matters |
|---|---|---|
| EU | AMLR, from 10 July 2027 | Checks at a stake or winnings of EUR 2,000 or more. Online gambling, casinos and sports betting cannot be exempted as low-risk (recital 63). Until 2027, national laws apply. |
| FATF (the international anti-money laundering standard-setter) | Recommendation 22 | International standard. For casinos, checks at transactions of USD or EUR 3,000 or more, and customer data must be linkable to the customer’s transactions. An ID check at the door is not enough. |
| United Kingdom | Money Laundering Regulations 2017 and POCA | Casinos, including online, have extra duties. Following the Commission’s guidance is part of licence conditions, and failures can affect the licence. |
| Malta | FIAU Implementing Procedures, Part II for remote gaming | Customer due diligence, ongoing monitoring, PEPs, MLRO. Risk from affiliates is assessed separately. Revised 2 July 2020. |
| Curaçao | LID (Curaçao law on customer identification) and LMOT (Curaçao law on reporting unusual transactions) laws of 2017, CGA regulations as of 10 January 2025 | Apply to everyone offering gambling. Supervised by the CGA since 15 February 2019. Reports go through goAML. |
The EUR 2,000 or 3,000 figure is the minimum for a check, not permission to play unchecked below it. The operator must be able to attribute transactions to a specific customer even before identity verification is complete. The AMLR recitals say so directly.
Responsible gambling: mandatory tools
The player-facing rules run from simple to complex. First age and control tools, then operator intervention.
Age
In Curaçao the operator collects the date of birth and confirmation that the player is over 18, and runs further checks. A photo ID is required at certain thresholds and no later than the first withdrawal. If a minor is found, the account is closed at once and every step is recorded.
Limits
In Malta the operator must offer a deposit or wagering limit, and the regulator encourages both. Players are asked about limits after registration and before the first deposit, and access to them must be easy. In Curaçao a player can set daily, weekly or monthly deposit limits. A limit can be tightened immediately but loosened only after 24 hours.
Breaks and reminders
In Curaçao a cooling-off period of 24 hours, 7 days, one month or 3 months is mandatory. In Malta the operator must provide reality checks. The pop-up pauses play, shows time played, amount wagered and the session’s result, and stays until the player acknowledges it.
Self-exclusion
A player can block their own access for a fixed period or permanently. The operator must not delay it and must not let the player return early. Self-exclusion covers all brands and domains under one licence.
Harm monitoring
The operator tracks indicators of harm, for example a sharp rise in spending, very long sessions or frequent limit changes. One signal proves nothing, so look at the combination. Every intervention is recorded.
Staff, advertising, records
Customer service and responsible gambling staff are trained to spot warning signs, and VIP managers and marketers should be too. Advertising must not target vulnerable people and must carry a responsible gambling message. Exclusions and player interactions are kept on record.
| System | Self-exclusion term and process | Notes |
|---|---|---|
| Malta (MGA) | Fixed term or indefinite. Must take effect without delay, and more than 24 hours counts as non-compliant | Revocation of a fixed exclusion after at least 24 hours, of an indefinite one after 7 days. Applies to all brands under the licence |
| Curaçao (CGA) | From 1 year, options 1, 3, 5, 10 years or lifetime. Fully online | Irrevocable for the chosen term. Reactivation only at the player’s written request after the term ends. Applies to all brands and domains |
| Estonia | 6 to 36 months, register kept by the Tax and Customs Board (EMTA) | Only the person can apply. The term cannot be shortened. Operators must not let the person gamble |
Since 28 February 2025, when a player’s net deposits exceed £150 in a rolling 30 days, the operator must run a financial vulnerability check (LCCP condition 3.4.4, part of the licence conditions code). At minimum this is a search of public records for debts and bankruptcy. If such a check was done in the previous 12 months, it need not be repeated.
We will review your situation and propose a solution for your project.
Where responsible gambling and AML overlap
Regulators increasingly look at both together, because they share data and share failures.
Source of funds and affordability
If a player spends a lot, the operator must understand whether they can afford it, and separately where the money comes from. These are two questions, but checking the player’s finances usually yields data for both.
Self-excluded players and payments
Curaçao requires reasonable measures against duplicate accounts and known payment methods of an excluded player. Malta requires exclusion across all brands under the licence and detection of matching details, IP addresses and devices.
Shared risk signals
A sharp rise in deposits, failed payments, split amounts and several accounts of one person point to two risks at once. A good system does not run two separate rule sets but passes the signal to both functions.
Withdrawals and checks
Curaçao expressly prohibits using responsible gambling measures to delay legitimate withdrawals. In the L & L Europe case the UK regulator separately noted late information requests at withdrawal. Checks are better done early.
You can and should separate the functions in the organisation. But decisions on one player should end up in one place, so the AML specialist sees signs of problem gambling and the responsible gambling specialist sees signs of suspicious transactions.
Regulator practice
Below are two decisions of the UK Gambling Commission (UKGC). They are not EU or Curaçao decisions, but their lessons on AML and responsible gambling apply to any operator.
Grosvenor Casinos, 7 October 2026
A £5 million payment and a mandatory third-party audit. The operator is part of Rank Group. Policies were not updated after the 2020 rule changes, decisions on higher-risk customers were inconsistent, and high-risk funds were accepted without enough scrutiny. Enhanced due diligence was not carried out even where the operator’s own policies required it. On responsible gambling, there was no interaction while one customer lost £50,000, and no record of interaction with a customer who won about £260,000 and lost about £250,000 within 12 days. A customer returning from self-exclusion was not approached until they had lost £25,000.
L & L Europe, 21 October 2026
A £900,000 settlement. The company runs seven sites. AML controls relied mainly on thresholds and sampling, not on risk factors and the customer’s profile. The company did not follow its own due diligence procedures, for example it did not verify that funds in newly opened accounts came from employment, business or savings. Harm alerts were active on only some of the seven sites, and there was no process to assess whether interactions were effective. Separate failings were found on withdrawals: information that could have been requested earlier was asked for at payout.
In both cases the document existed but did not work in practice. The regulator checks not whether a policy exists but whether it is applied to real customers, and whether the mechanisms work the same on every brand.
How to build the procedures
The structure is the same for any licence. Timelines, document names and details differ.
Policies
An AML policy with a business risk assessment, and a responsible gambling policy. In Curaçao the responsible gambling policy is uploaded to the CGA portal and material changes are reported to the regulator.
Responsible people
A separate AML officer (MLRO or compliance officer) and a separate person or function for responsible gambling. In Curaçao the person responsible for responsible gambling (or the compliance officer) reports to management at least once a year.
Records
Licence rules decide what to keep and for how long. In Curaçao, records of operator-initiated exclusions are kept for at least five years, and betting history must be available for at least six months. AML records are kept as required by your country’s law.
Training and testing
Staff training, regular testing of the tools (limits, reminders, self-exclusion) on every brand, and checks that decisions on players are recorded. In 2025 Malta tested self-exclusion with mystery shoppers, so it is worth running such tests yourself.
What to do now
These steps do not depend on which licence you hold.
Work out which rules are yours
Your licence, the markets where you accept players, and your payment partners. List the requirements by source.
Start hereUpdate the risk assessment
Games, channels, payment methods, countries, affiliates. Record the assessment and the review dates.
Put policies and responsible people in order
AML policy, responsible gambling policy, and appointment of an MLRO or compliance officer and a responsible gambling lead.
Test player tools on every brand
Limits, breaks, reminders, self-exclusion. Check that an exclusion applies to all brands and domains and that the player cannot return early.
Link AML and responsible gambling signals
One decision log per player, shared risk indicators, a clear escalation route.
Train and test yourself
Staff training, mystery-shopper tests, an annual report to management and review dates for policies.
Curaçao’s responsible gambling policy was to be fully implemented by the end of September 2026, and the AMLR applies in the EU from 10 July 2027. Build your processes to the stricter of the rules that apply to you.
The regulator asks not only whether you have a policy, but whether it worked on a specific player.LegalBit team
Frequently asked questions
Do I need both sets of procedures with a Curaçao licence?
Yes. The LID and LMOT laws on AML apply to everyone offering gambling in Curaçao, and the CGA separately requires a responsible gambling policy. They are different documents with different checks.
What counts toward the AMLR’s EUR 2,000 threshold?
A single stake or collection of winnings of EUR 2,000 or more, or several linked transactions that add up to it. The operator must be able to attribute transactions to the customer even before identity verification is complete (recital 64).
Can a player return early after self-exclusion?
No. In Curaçao self-exclusion is irrevocable for the chosen term, and in Estonia the term cannot be shortened. In Malta revocation applies only after a pause, 24 hours for a fixed exclusion and 7 days for an indefinite one.
Can I hold a withdrawal while checks are under way?
Responsible gambling measures must not be used to delay legitimate withdrawals, as the Curaçao policy says directly. In the UK, late information requests at withdrawal were among the failings in the L & L Europe case.
Do I need a separate responsible gambling officer?
In Curaçao you need a person responsible for responsible gambling, who can be the compliance officer, reporting to management at least once a year. In other jurisdictions check the licence conditions.
What does an operator risk for failures?
Financial penalties and extra measures. In October 2026 the UK Gambling Commission took £5 million from Grosvenor and required an audit, and £900,000 from L & L Europe.
See also: KYC and KYB for payment providers; Online casino licence; Illegal gambling through third-party card payments; Brazil betting ban. Services: regulatory and compliance.
- EUR-Lex: Regulation (EU) 2024/1624 on preventing use of the financial system for money laundering (AMLR)
- FATF Recommendation 22: customer due diligence for DNFBPs (text published by CFATF)
- Gambling Commission: approach to preventing money laundering
- Gambling Commission: LCCP condition 3.4.4, financial vulnerability check
- Gambling Commission: casino operators to pay £5m (7 October 2026)
- Gambling Commission: L & L Europe pays £900,000 (21 October 2026)
- MGA: mandatory responsible gaming tools for remote gaming
- MGA: thematic review of self-exclusion practices
- FIAU Malta: Implementing Procedures Part II for the remote gaming sector (2020 revision)
- CGA Curaçao: AML/CFT/CFP for gambling providers
- CGA Curaçao: Responsible Gaming Policy, version 1.0, 17 April 2025
- EMTA Estonia: setting restrictions on gambling
This topic is our service
More on how we help iGaming companies:
