Navigating the EU AML package: Implications for online gambling service providers

Background

Since the adoption of Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, also known as the fourth AML Directive (“AMLD4”), providers of gambling services including the online gambling services have been in scope of the anti-money laundering and counter terrorism financing rules in the EU/EEA (“AML Rules”). A major shift in the AML Rules with significant impact on gambling service providers has been introduced by adopting the so called EU AML Package (“AML Package”) in May 2024 (details on the AML Package can be read here) meaning that the current model where the AML directives are transposed into the national law by the EU/EEA Member States (“MS”) will be replaced by the key legislative acts, in particular: 

1. Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (“AMLR”) specifying details applicable to obliged entities and their operations, which starts to apply directly in each MS on 10 July 2027, 

2. Regulation (EU) 2024/1620 on establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (“AMLA-R”), setting out the rules for the AMLA, which applies directly in all MS in entirety from 1 July 2025, with exception for article in entirety from Article 103 that shall apply from 31 December 2025,

3. Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (“FTR”), that applies directly in all MS from 30 December 2024,  

4. Directive (EU) 2024/1640 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (“AMLD6”), which shall be transposed by the MS into national legislation by 10 July 2027 at the latest (however, certain parts of it are to be transposed earlier). 

Though the provisions of the AMLR and the AMLD4 appear relatively alike at first sight, gambling service providers will face several important changes:

• a definition of ‘gambling services’ incorporated in the AMLR, being a directly applicable European regulation, instead of national AML Rules transposing AMLD4;

• gambling service providers will need to apply Customer Due Diligence (“CDD”), also known as KYC requirements, in circumstances additional to those relevant for all obliged entities; and

• application of national AML-Rules despite the transition to the AMLR.

Understanding the AML Package 

The AML Package is designed to strengthen the resilience of the financial system against money laundering and terrorism financing (“ML/TF”) and introduces a unified regulatory framework and approach across the EU and aims to (further) harmonize the AML Rules. Even though the AMLD6 and its national transpositions are important and relevant for the obliged entities, including the gambling service providers, the overwhelming majority of the rules applicable to obliged entities have been transferred into the AMLR, making the AMLR the central legislative act for obliged entities. We will therefore in the below mainly focus on the AMLR and its applicability.

Just as the earlier AML directives, the AMLR includes the providers of gambling services into the scope of obliged entities (article 3.3 (g)). The AMLR sets out a definition of gambling service in article 2.12: 

‘gambling service’ - a service which involves wagering a stake with monetary value in games of chance, including those with an element of skill, such as lotteries, casino games, poker games and betting transactions that are provided at a physical location, or by any means at a distance, by electronic means or any other technology for facilitating communication, and at the individual request of a recipient of services.  

Since the AMLR being a European regulation is directly applicable in the MS, there is therefore a need to assess whether the AMLR will apply to your operations, both depending on what operations you conduct but also depending on where you operate. In terms of the former, the AMLR introduces a harmonized definition of ‘gambling services’ that does not need further implementation in national legislation. In contrast, the same definition under the AMLD required national implementation and thus the possibility for MS’ to align the AMLD definition of ‘gambling services’ with national definitions. As a result, there is therefore a possibility that although a ‘game’ offered in a MS does not qualify as ‘gambling’ under local laws, it may be considered as ‘gambling’ under the AMLR.

In terms of location of operations, the AMLR grants the MS the possibility to identify gambling services associated with low ML/TF risk (normally it would be private lotteries and state-administered gambling activities) and decide not to apply some or all of the AMLR provisions to such operators, meaning that some types of operators may be out of scope depending on how each particular MS decides to implement this. However, the AMLR is clear on that activities with higher risk (e.g. casinos, online gambling provided by non-state actors and betting) are not to be exempted by the MS, consequently meaning that these types of activities are subject to the requirements in the AMLR.

Similar to what is applicable today, the gambling service providers will need to undertake the CDD measures in standard situations like, for example, establishing a business relationship. Depending on the jurisdiction, the difference between the current rules and the CDD rules in the AMLR can be significant. In addition to the performance of CDD in standard situations like any other obliged entity, there is an obligation on gambling service providers to conduct CDD measures upon the collection of winnings, the wagering of a stake, or both, at EUR 2.000 (or an equivalent in national currency) for a single transaction or linked transaction when carrying out occasional transactions introduced. Further, under the AMLR a large number of regulatory technical standards will be adopted setting out details in relation to various parts of the AMLR. The first package including inter alia Regulatory Technical Standards specifying information and requirements necessary for the performance of CDD published in March 2025 introduced the draft provisions on what CDD measures are to be undertaken. Even though it is too early to say how the final product will look like, it is clear already now that a large number of adjustments will be necessary to implement for the obliged entities. 

Territorial application

When it comes to the assessment of whether your operations are subject to the provisions of the AMLR based on the country of establishment, it is important to note the following: 

1. If you are established in an EU MS, the AMLR will apply to your activities as gambling service provider. 

2. If you are established outside the EU (i.e. in a third country), the gambling regulations of the MS where you intend to provide your services will be very relevant in the context of the AML Rules. Two scenarios:

   1. Some of the MS’ licence regimes for gambling service providers require that gambling services are only provided by entities established in the EU/EEA, with a gambling licence. If this is the case, you may not be able to provide gambling services, and any breach will likely constitute a criminal offence or result in administrative enforcement. In such case, you do not need to assess whether AMLR will apply because pecuniary sanctions and administrative measures applicable for the breaches of the AMLR will not be as relevant as the criminal offences you may commit for providing the gambling services illegally.

   2. If the MS’ licence regime admits third country gambling service providers, you will be subject to AML Rules, either by interpretation of AMLR or via submission by national laws.

While AMLR aims to harmonize AML Rules throughout the EU, the EU legislator also acknowledges the risk-based approach. In certain cases, MS are permitted to implement additional requirements to mitigate specific risks. The question is, which national AML Rules apply to you?

1. In relation to the additional AML Rules of the MS in which you are established (i.e. in which you have your head office = your home MS) and in which you provide your gambling services, the additional AML Rules of your home MS will apply.

2. If you are offering services in another MS than your home MS, article 8 of the AMLR shall determine which additional AML Rules you will need to adhere to. As a basis, the AMLR suggests that you need to comply with the additional AML Rules of the host MS when you operate in that host MS on the basis of freedom of establishment or under the freedom to provide services, provided you have an infrastructure in that host MS (see recital 26 of the AMLR). For that purpose, the AMLR acknowledges that it is important to clarify what activities amount to an establishment. With view to recital (27), the AMLR does not require an establishment in the form of a subsidiary, branch or agency – instead it is sufficient if you have an office managed by your own staff or by a person who is independent but authorised to act on a permanent basis on your behalf. Also, you need to actually pursue an economic activity at the place of the establishment. Less than that, e.g., just a letter-box or back-office operations, is not sufficient to form an establishment.

   Based on the above, article 8(4) of the AMLR provides that where you operate establishments in several MS, you must ensure that each establishment applies the rules of the MS in which it is located.

   But what if you provide gambling services without having any ‘establishment’ in that host MS? For example, because your only connection to such MS is that you offer a website in that host MS’ official language?

   As a starting point, there is no harmonization in gambling rules across the EU/EEA and providing gambling services in other countries often requires a local license in another MS, if available. Assume therefore for now that you will offer or are offering gambling services – which could be considered as actually pursuing economic activities in host MS’ and thus potentially having ‘establishments’ – in various member states in compliance with local gambling laws and fall within the scope of the AMLR. There is a risk that certain host MS will make compliance with national AML Rules mandatory under national laws, in addition to the AMLR. There is currently little guidance whether this is consistent with the approach to cross-border operations of AMLR. Guidance, for example by AMLA, provided in sufficient time before AMLR and the additional AML Rules of a MS are applicable, would be welcome! 

   The territorial application will be a starting point and an important aspect to assess for all gambling services providers as we approach the applicability date.

Consequences for non-compliance

Obliged entities can be held liable for breaches of the AMLR. AMLD6 entails the provisions on pecuniary sanctions and administrative measures for breaches of the AMLR, meaning that the provisions will be transposed into the national legislative acts in each MS and will thus differ. Being obliged entities, the gambling service providers will therefore be subject to sanctions in cases of non-compliance with the AMLR as set out in the respective MS’ national AML Rules transposing the AMLD6, subject to the territorial applicability as envisaged above. In the recent past, non-compliance has led to various gambling service providers around the EU being warned or fined heavily for breaches of AML-obligations in accordance with the AMLD5 sanctioning regime. As we expect the sanctioning regime in accordance with the AMLD6 be at least similarly severe, compliance with the requirements of AMLR/AMLD6 should be taken seriously.

Besides affecting the obliged entities financially, such pecuniary or administrative sanctions are likely to damage the reputation of the non-compliant gambling service provider. Further, pecuniary sanctions can be imposed, and administrative measures can be applied, not only to the obliged entity itself, but also to the senior management and to other natural persons who under the MS’ national laws are responsible for the breach of the AMLR. In addition, since the AML Package aims to harmonize the applicability of the AML Rules, technical standards and guidelines will be issued by the AMLA setting the standards for thresholds and parameters to apply when determining the pecuniary sanctions and administrative measures, in addition to the national laws transposing the AMLD6, meaning that we may face a situation where such thresholds and parameters may be higher than is currently applicable in certain MS. Since we are still awaiting a large number of technical standards and guidelines (level 2 and 3 documents) to be adopted, it remains currently unclear what measures in particular and up to what level will apply to particular breaches. It is further not impossible that major deficiencies in AML Rules compliance may also lead to license revocation, which we historically seen examples of (even though they are not numerous).    

Next Steps

Despite that we have almost two years to go until the AMLR starts to apply, we recommend starting assessing if your services should be considered as ‘gambling services’ in accordance with the AMLR definition what needs to be adapted to comply with the new rules. Since we still expect a large number of level 2 and 3 documents to be adopted under the AML Rules it is too early to circle in the details and set a clear detailed action plan. Nevertheless, already at this point we recommend starting with a gap analysis of the current AML/CTF governance documentation and routines to get a clear initial understanding of what needs to be done to have a smooth timely transition into the new rules. By taking such proactive steps, the gambling service providers can mitigate risks and safeguard their operations.