AMLA keeps €2,000 gambling check, sets linking rules

The EU's Anti-Money Laundering Authority (AMLA) has not lowered the €2,000 threshold at which gambling operators have to run customer checks in its draft standards, "at this point in time", but it has spelled out how they must add up separate transactions toward it. The rules are in a final report dated 30 September 2026, containing draft regulatory technical standards that AMLA has sent to the European Commission.

The €2,000 figure itself is not new. It is already written into the EU's Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), which says gambling providers must apply customer due diligence "upon the collection of winnings, the wagering of a stake, or both" of at least €2,000. Customer due diligence means checking who a customer is, and where needed where their money comes from, before or while doing business with them. Some trade coverage this week read as if AMLA had introduced a new €2,000 check; it did not.

No lower thresholds

AMLA had a mandate to name high-risk sectors that should face lower thresholds than those in the AMLR. It decided against adding any. "No conclusive information has emerged" since the AMLR entered into force that further lower thresholds are necessary and proportionate, the report says, and keeping the existing ones "supports legal certainty".

When bets count as linked

The part that is new is the list of criteria for "linked transactions". The AMLR applies its thresholds whether a sum is paid in one go or "through linked transactions", meaning two or more transactions with the same or a similar origin, destination and purpose, or other shared characteristics, over a specific period. The point is to stop people splitting money into smaller amounts to stay under a check.

Under the draft standards, operators must make an overall assessment and take into account, among other things:

• transactions by the same person;
• customers who are family members, business partners or acting in concert, for example arriving together or coordinating before or during a transaction;
• use of the same digital infrastructure, such as an IP address, device identifier or geolocation;
• common intermediaries or service providers that facilitate the transactions;
• transactions within a loyalty programme run by the operator;
• transactions within a short time frame, judged against how fast and often transactions normally happen in that business.

Gambling gets one extra criterion of its own: when judging whether transactions have a similar purpose, providers must consider whether they involve games provided by the same provider.

No single criterion is decisive, AMLA stresses, and several of them apply only to information the operator already has; operators are not required to collect extra data just to find linked transactions. Gambling-sector respondents warned in the consultation that loyalty schemes and gambling-specific transaction patterns could produce many false positives. AMLA replied that the list is "not to establish automatic linking rules" and amended the text to make the overall-assessment approach clearer.

A separate rule covers gambling operators with physical premises: providers must at least take engagement through a voluntary membership scheme into account as a criterion when considering the "element of repetition". After consultation feedback, AMLA clarified the article so that the relevant criterion concerns voluntary membership.

What it means for players

For most online players, the practical effect is limited. Under the AMLR, due diligence also applies whenever a business relationship is established, which the regulation defines as one expected to have "an element of repetition or duration". The €2,000 threshold mainly matters for occasional, one-off transactions. That is our reading of how the two rules fit together; national regulators may add stricter requirements, as Spain did with payment-method ownership checks.

Our reading: where players could notice it is at the cashier. If the standards are adopted, operators could look at deposits and withdrawals across family members, a shared device or a run of quick transactions, not just one payment at a time. That could mean an identity or source-of-funds request earlier than a player expects.

Timing

The standards are a draft. The European Commission has to adopt them before they are published in the Official Journal of the EU. They would then enter into force 20 days after publication and apply six months after that. The AMLR itself applies from 10 July 2027. AMLA consulted on an earlier version between 9 February and 8 May 2026.

The AMLR is EU law. It does not apply in the UK, Canada, Australia or other markets outside the EU and the EEA, which have their own anti-money laundering rules. Norway is an EEA state. According to EFTA, the AMLR is marked as EEA-relevant but is still under scrutiny for incorporation into the EEA Agreement, so it is not yet in force there. Norwegian operators follow Norway's Anti-Money Laundering Act (hvitvaskingsloven) for now. For how regulators elsewhere are acting, see our coverage of the FATF's gambling risk indicators, the UKGC's £5m settlement with Rank and Star Entertainment's A$260 million AUSTRAC penalty.