AMLA and iGaming: The New EU AML Rules Land on Your PSP First

AMLA, the EU's Anti-Money Laundering Authority, selects no company for direct supervision in 2026. Its first selection must start by July 1, 2027. It plans to name up to 40 high-risk groups and entities, drawn only from credit and financial institutions, and to take over their AML supervision by July 2028. Gambling operators come under the EU's single AML rulebook in Regulation (EU) 2024/1624 (the AMLR), which binds them directly across the EU from July 10, 2027.

The payment institutions, e-money institutions and crypto-asset service providers that move gambling money count as financial institutions, so AMLA can select them, and the sixth AML directive (AMLD6) makes member states set a higher minimum fine ceiling for them than for operators. AMLA's regime therefore reaches gambling by two routes: harmonized rules at the operator, enforced by national supervisors, and direct supervision of the cross-border PSPs that AMLA selects.

Can AMLA supervise gambling operators?

No. Articles 12 and 13 of the AMLA Regulation, (EU) 2024/1620, limit direct supervision to credit institutions and financial institutions that operate in at least six member states and carry a high-risk profile. Gambling providers are obliged entities under the AMLR, but they enter through Article 3, point (3)(g), the non-financial branch of the list, and no legal route leads from that branch onto the selection list.

The first selection runs on eligibility data that national supervisors gather on cross-border credit and financial institutions, and the provisional list of eligible entities that AMLA builds from it stays internal. Under Article 13(4) the selection must end within 6 months of its start, and Article 13(2) lets AMLA select more than 40 where more entities meet the criteria.

AMLA will run that selection with a staff set to grow from 120 at the end of 2025 to 432 by the end of 2027. The authority has existed legally since June 26, 2024, and began operating in Frankfurt in summer 2025, when its founding regulation applied in full. Its Chair, Bruna Szego, took office in February 2025.

AMLA and AMLR timeline for gambling operators and PSPs

AMLA delivers its Level-2 rulebook in stages.

AMLR rules for gambling operators from July 10, 2027

The AMLR gives gambling services their first statutory definition in a directly applicable EU regulation and ties the due-diligence trigger to the payment flow, which makes it a cashier project for operators.

Article 19(5) is the provision a cashier team builds around. Customer due diligence is mandatory "upon the collection of winnings, the wagering of a stake, or both" for transactions of at least EUR 2,000, carried out in a single operation or in linked transactions. The trigger works on money going in and money coming out, and the linked-transactions clause stops a player from dodging the threshold by splitting. The draft standard AMLA finalized on October 1, 2026, under Article 19(9), sets the criteria for identifying linked transactions. Catching 4 x EUR 600 across 3 days is therefore a transaction-monitoring job for the payment stack.

Two other provisions call for a compliance owner's attention now. Article 4 lets member states exempt some gambling services on proven low risk, but it excludes casinos, online gambling and betting from any exemption, so the core of the sector cannot be carved out anywhere in the EU. Article 34 sets the enhanced due diligence measures for higher-risk customers, extra checks on source of funds and source of wealth among them, and VIP programs at gambling operators fall under those general rules. The extra layer for the very wealthy in Article 34(5) applies to higher-risk relationships where at least EUR 5 million in assets runs through personalized services for a customer holding at least EUR 50 million, and it binds only credit institutions, financial institutions and trust or company service providers.

AMLA direct supervision of PSPs and EMIs: selection criteria and fines

For a payment institution, e-money institution or CASP, selection turns on two criteria: activity in at least six member states and a high residual risk profile under the draft selection methodology AMLA finalized on December 18, 2025. AMLA has published no sector list and named no candidates. An EMI that serves merchants in six or more member states under its passport, with a book weighted toward gambling and crypto, fits both criteria.

A selected PSP answers to AMLA directly, and Article 22 of Regulation 2024/1620 lets AMLA fine it up to 10% of total annual turnover for breaches of customer due diligence, internal policies or reporting duties. An unselected PSP stays with its national supervisor under the same harmonized rules. AMLA's December 2025 draft standard under Article 40(2) AMLD6 sets how that supervisor will score the PSP's risk. Under Article 53(10) AMLD6, the draft standard AMLA finalized on July 8, 2026, grades breaches on a four-tier gravity scale, and the top two tiers count automatically as "serious, repeated or systematic," the trigger for maximum sanctions.

Either way, a PSP's AML controls will be examined against one European grid, and a PSP that fails it puts the settlement of the operator's float at risk. An operator that runs most of its volume through one acquirer or one bank, the concentration trap in iGaming treasury, now carries that regulatory risk on top of the commercial one.

AMLA risk methodology for gambling operators under Article 40(2) AMLD6

From July 13 to September 27, 2026, AMLA consulted on the draft RTS under Article 40(2) of AMLD6 that gives national supervisors a common methodology to score the inherent and residual ML/TF risk of non-financial obliged entities. Gambling, online and land-based, is covered expressly. AMLA held the public hearing on September 10 and next sends its final report to the European Commission. Under the draft, AMLA collects calibration data from a sample of entities in 2027, and the methodology applies from December 31, 2028.

A Maltese or Swedish operator keeps its national AML supervisor. From that date the supervisor scores the operator on AMLA's methodology, and AMLA oversees the supervisor.

What iGaming operators should do before July 10, 2027

Wire the EUR 2,000 stake-and-winnings trigger into cashier monitoring instead of leaving it to a back-office lookup, and build the linked-transaction aggregation to the standard AMLA finalized on October 1, 2026. A monitoring change like that takes a year to build and tune.

Put the AMLA question to every EU payment partner at the next commercial review: whether it expects to meet the six-member-state criterion, what its residual-risk self-assessment shows, and what its plan is if selection puts it under AMLA supervision in 2028. The answer prices the continuity risk on the operator's float. Of the 78 providers rated here, 69 run their own automated or semi-automated KYC and AML tooling, and the same review should ask how that tooling will score on the harmonized inspection grid.