The rule that actually hits a player is simple. In the EU, a gambling operator is supposed to run customer due diligence when stakes, winnings, or both reach €2,000. What was missing was a shared answer to the obvious follow-up: which bets count as one trip to that line, and which ones stay separate. On 29 October 2026 that follow-up is sitting on the European Commission’s desk.
The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has submitted draft regulatory technical standards under Article 19(9) of Regulation (EU) 2024/1624, the AMLR. The paper is dated 30 September 2026. It is not law yet. It still needs Commission adoption and publication in the Official Journal. Once it is in force, AMLA wants a six-month run-up for most obliged entities. The AMLR itself applies from 10 July 2027.
That calendar is why this is a daily story, not a think-piece. Sweden’s gambling inspectorate has already said it will apply the AMLA standards from 10 July 2027. Operators in Germany, Spain, France, and Sweden already treat €2,000 of stakes or winnings as a trigger. The draft is the EU’s attempt to stop those rooms counting the same session in four different ways.
What actually changed this week
Nothing in your cashier flipped overnight. No operator has to rebuild KYC because a draft landed in Brussels. What changed is the text the Commission will be asked to adopt, and the fact that national supervisors are already lining up behind it.
AMLA consulted on an earlier version between 9 February and 8 May 2026. Gambling firms were loud in that round. They said a simple online registration is often just a technical step, not a business relationship. They said loyalty schemes and ordinary slot sessions would throw false positives if every small bet were glued to the next one. AMLA moved. The final draft keeps gambling in the high-risk, non-financial bucket, keeps the €2,000 threshold that is already in the AMLR, and adds gambling-specific language on how to spot linked transactions.
The threshold itself is not new. Article 19 of the AMLR already sets lower due-diligence lines: €1,000 for certain fund transfers and crypto-asset services, €3,000 for physical-currency transactions, and €2,000 for providers of gambling services when they collect winnings, take a stake, or both. AMLA says it did not pile extra lower thresholds on top. For players, the live question is how a room adds the numbers together.
Providers of gambling services shall, for the purpose of identifying linked transactions, take into account the criterion of games provided by the same provider when considering the element of identical or similar purpose.
That sentence is the one that will show up in compliance decks. It does not mean every spin on every studio is one transaction. It means a supervisor can expect the operator to look at play with the same provider when it decides whether two deposits, two withdrawals, or a stack of bets share a purpose.
How a room is supposed to bundle your play
The draft tells obliged entities to make an overall assessment. No single flag is decisive. The criteria sit in Article 3 of the RTS and they are written for banks as much as for casinos, then specialised for gambling in a short extra paragraph.
In plain language, a licensed room is asked to look at:
- the same person sending or receiving the funds
- family members, business partners, or people acting in concert, when the operator can see that
- shared digital infrastructure — same device fingerprint, same wallet path, same agent network
- common intermediaries
- play inside a loyalty programme the operator itself runs
- transactions finished in a short window, judged against how fast that business normally moves
- for gambling specifically, games from the same provider when the purpose looks similar
AMLA also tells physical premises to treat a voluntary membership as a hint that the relationship is meant to repeat. Forced club cards that exist only because the door will not open without one are not supposed to be enough on their own. That distinction came out of the consultation. Operators asked for it. AMLA wrote it in.
The false-positive warning is in the report too. Loyalty points, a weekend on one slot studio, and a pair of small deposits should not automatically become a structured €2,000 event. The operator still has to look at the commercial context. That is the bit players will feel as slower withdrawals and more document requests on busy weeks, not as a pop-up that quotes Article 19.
What it means at the cashier
If you already play with a name, an address, and a payment method that matches the account, most of this draft is plumbing you will never read. The practical effects sit in three places.
The €2,000 clock is about stakes and winnings, not about how friendly the welcome offer looked. A bonus does not pause due diligence. Clearing wagering on a fat match can push a session over the line faster than a grind without an offer. Read the offer first on the bonus list and the welcome bonuses page, then assume the identity file can still be opened when the numbers add up.
Same-provider play can be bundled. A night on one studio’s slots, then a live table from the same supplier, is the pattern AMLA wants operators to notice. Hopping between unrelated studios does not make you invisible. Shared wallets, shared devices, and loyalty accounts still sit in the overall assessment.
Withdrawals are where the file usually opens. Deposits can look quiet. A payout is when the operator has to decide whether it is staring at one occasional transaction or a string of linked ones. If you care about speed, compare rooms on fast payout casinos and keep the banking method on a page you have actually read, starting from the banking hub.
None of this is a reason to dump documents into a random chat window. Send identity files through the cashier or the official verification vendor the casino names. If a site asks for a selfie in a messenger app, that is a different problem from AMLA.
Sweden, Germany, Spain — the national overlay
EU technical standards do not replace national gambling law. They sit under it. Sweden’s Spelinspektionen published a constructive read of the draft on 22 October 2026 and tied its own application to 10 July 2027. Germany, France, Spain, and Sweden are already named in trade coverage as markets that apply the €2,000 line to stakes, winnings, or both.
Germany is a useful reminder that product rules and AML rules travel on different tracks. The slot-stake cap moving to €5 per spin for players who have been verified for 90 days is a GGL product rule. AMLA’s draft is about how money is counted. You can be inside the German stake cap and still trip a due-diligence review because the session, the loyalty pot, and the withdrawal added up.
Finland is on a different clock again. Licensed online services there are aimed at 1 July 2027, which lands in the same summer as the AMLR. If you follow that file, the earlier piece on the first Finnish online licence talk is the local story. AMLA is the EU layer that those future licensees will inherit.
What is not in the draft
AMLA did not invent a new €500 casino threshold. It did not tell rooms to treat every registration as a full business relationship. It did not say same-provider games must always be added together. The report repeats that no single criterion is decisive, and it pushed the application date for some other obliged entities out to 10 July 2029. Gambling is not in that later bucket.
The draft also does not licence a casino, grade a bonus, or replace a review. A room can implement beautiful AML controls and still pay slowly, still bury max-bet rules, still geo-block you after a win. Due diligence is the floor for keeping dirty money out. It is not a quality mark for players.
And it is still a draft. Until the Commission adopts it and the Official Journal prints it, national supervisors can nod at it without every operator rewriting the cashier. The honest timeline for players is: 2026 is alignment and software, 10 July 2027 is when the AMLR is live, and the RTS follow six months after they enter into force.
What to do with this as a player
Treat identity requests as part of a licensed session, not as a jump-scare. Keep the name on the account, the payment method, and the documents in the same story. If you bounce between a licensed EU room and an offshore lobby, do not expect the offshore cashier to care about AMLA — and do not expect an EU licence to ignore it.
A short list that actually helps:
- Pick the casino first, from a review, not from an ad. The casino hub is the front door.
- Read the bonus after the licence. Wagering, max bet, and game weighting still sit in the terms, AMLR or not.
- Assume a €2,000 week of stakes or winnings can open a file, especially if the play sits with one provider and a loyalty account.
- Use a banking method you already understand. Start at banking.
- If you wanted a room that never asks for documents, you are shopping a different risk. That is the no-KYC list, with tighter limits and less help when a payout sticks.
Play only with a bankroll you can lose. You need to be 18 or older, and you need to be somewhere the casino is allowed to take you. If the session stops being entertainment, close the cashier. AMLA’s job is dirty money. Yours is the loss limit.
Sources: AMLA consultation page and final draft RTS under Article 19(9) AMLR (30 September 2026); Regulation (EU) 2024/1624; Spelinspektionen comment as reported 22 October 2026; industry reports dated 29 October 2026. This is a draft, not adopted law.
Published: 28. October 2026
Anything incorrect or missing?
