AMLA and iGaming: The New EU AML Rules Land on Your PSP First

A specific wrong version of the AMLA story has been circulating in gambling trade coverage for a year: the EU's new Anti-Money Laundering Authority is about to pick its first directly supervised companies, cross-border iGaming is a target sector, and the selection lands in late 2026. Every element of that is false, and the false version obscures the part that should actually worry a payments team. Until today a compressed form of that claim sat on our own compliance calendar; we have corrected the row and logged the correction, because the real mechanics are better than the rumor and considerably more useful.

Here is the accurate skeleton. The single AML rulebook, Regulation (EU) 2024/1624 (the AMLR), starts applying to gambling operators on July 10, 2027. AMLA, operating from Frankfurt since mid-2025, will directly supervise roughly 40 entities starting in 2028, and the law restricts that list to credit and financial institutions. A gambling operator cannot be on it. The payment institutions, e-money institutions and crypto-asset service providers that move gambling money can be, and the sanction ceiling for them is ten times the operators' floor. AMLA's regime reaches gambling twice: directly at the operator through harmonized rules enforced nationally, and structurally through the PSP layer, where the supervisory pressure is concentrated.

AMLA cannot select a gambling operator. The law says so.

The selection perimeter is written into Articles 12 and 13 of the AMLA Regulation (EU) 2024/1620: direct supervision applies to credit institutions and financial institutions with a high-risk profile operating in at least six member states. Gambling providers are obliged entities under the AMLR, but they enter through Article 3, point (3)(g), the non-financial branch of the list. There is no legal route from that branch onto the selection list. Whatever a national regulator does about gambling AML, the Frankfurt authority will never hold a casino's license file.

Three more corrections to the circulating version, each checkable against primary sources. AMLA has not been "operating since January 2026": it has existed legally since June 26, 2024, its Chair Bruna Szego took office in February 2025, and operations began in summer 2025 when its founding regulation applied in full. There was no "Q3 2026 selection round": what happens in the second half of 2026 is data collection, with national supervisors submitting eligibility data by August 15 and AMLA compiling a provisional list by end of September that is internal and unpublished. And the formal selection starts by July 1, 2027, with the published list expected around the end of that year and supervision, staffed by about 200 supervisors in joint teams, beginning in 2028.

July 10, 2027: what the AMLR actually changes at the cashier

For operators, the regulation's substance is less dramatic than the supervision story and more operational. The AMLR gives gambling services their first EU-level statutory definition in a directly applicable regulation, and it hard-wires the due-diligence trigger to the payment flow.

The load-bearing provision for a cashier team is Article 19(5): customer due diligence is mandatory "upon the collection of winnings, the wagering of a stake, or both" for transactions of at least EUR 2,000, in a single operation or through linked transactions. Both directions of the money matter, deposit and payout, and the linked-transactions clause means the threshold cannot be dodged by splitting. Detecting 4 x EUR 600 across three days is a transaction-monitoring problem, and it lives in the payment stack, not in a policy document.

Two other provisions deserve a compliance owner's attention now. Article 4 lets member states exempt some gambling verticals on proven low risk, but the same article excludes casinos, online gambling and betting from any exemption, so the sector's core cannot be carved out anywhere in the EU. And the enhanced due-diligence rules in Article 34 formalize source-of-funds and source-of-wealth checks for higher-risk cases, with specific mandatory treatment once a customer's assets under service reach EUR 5 million or wealth reaches EUR 50 million. Every serious VIP program will trip the higher-risk branch long before those numbers.

The exposed party is the PSP, and the fine schedule proves it

Payment institutions, e-money institutions and CASPs sit in the AMLR's financial-institution bucket, which makes them eligible for AMLA selection where a gambling operator is not. AMLA's own explainer on direct supervision names payment and e-money institutions among the in-scope entity types. Apply the two published criteria, presence in six or more member states and a high residual risk profile under the methodology AMLA finalized in December 2025, to an EU-passported EMI running a merchant book weighted toward gambling and crypto, and you get an entity that fits the screen on both axes. AMLA has published no sector list and named no candidates, so this is our analysis of the criteria rather than anything the authority has said; it is also the reason "iGaming is a target" rumors keep resurfacing in distorted form. The kernel of truth is real, it just sits one layer down the payment chain from where the trade press put it.

The asymmetry extends past the fine schedule. A selected PSP answers directly to Frankfurt, with AMLA holding its own sanctioning power up to the same 10% ceiling under Article 22 of its regulation. An unselected PSP still gets the harmonized treatment secondhand: the July 2026 Level-2 package standardizes how national supervisors score risk, grade breaches on a four-tier gravity scale, and set fines, with the top two tiers automatically qualifying as "serious, repeated or systematic," the trigger for maximum sanctions. From an operator's chair, the practical translation is that your PSP's AML posture is about to be examined against a single European grid, and a PSP that fails it is a settlement-continuity risk for your float, not just a compliance footnote of theirs. The concentration questions we raised in the treasury breakdown get a new regulator behind them.

September 27 is the date gambling is actually named on

The one live AMLA process that mentions gambling explicitly is a consultation, not a selection. On July 13, 2026 AMLA opened a consultation on the draft technical standard under Article 40(2) of AMLD6: a common methodology for national supervisors to score the inherent and residual ML/TF risk of non-financial obliged entities, with gambling, online and land-based, expressly covered. There is a public hearing on September 10 and the consultation closes September 27, 2026; trade coverage points to the methodology applying from the end of 2028. National gambling regulators have been nudging licensees to respond, and operators with a view on how their sector's risk should be measured have until that date to say so in the record rather than complain afterward.

That consultation is the correct frame for AMLA-and-gambling as a whole: the authority shapes how national supervisors treat operators, it does not replace them. The AML supervisor a Maltese or Swedish operator answers to in 2028 will still be national, working from Frankfurt's methodology, with AMLA overseeing the supervisors rather than the casinos.

The questions to close before mid-2027

The operator to-do list follows from the mechanics. Wire the EUR 2,000 stake-and-winnings trigger, with linked-transaction aggregation, into cashier monitoring rather than treating it as a back-office lookup; a year is roughly what a monitoring change like that takes to build and tune. Put the AMLA question to every EU payment partner in the next commercial review: whether they expect to meet the six-member-state screen, what their residual-risk self-assessment says, and what their plan is if selection lands them under Frankfurt supervision in 2028. Their answer prices a real continuity risk. The capability baseline, at least, is not the problem: 66 of the 74 providers in our catalog advertise their own automated or semi-automated KYC and AML tooling, so the question is whether the tooling survives a harmonized inspection grid, not whether it exists.

The dates worth holding are September 27, 2026 for the consultation, July 10, 2027 for the rulebook, end-2027 for the published selection list, and 2028 for the first Frankfurt-supervised inspections of the payment layer. None of them says "iGaming selection in 2026," and any coverage that does is running the version of the story we corrected on our own calendar today.