KYC and AML for iGaming Payments Explained

Every regulated gambling deposit now sits behind two questions the operator has to answer before it can safely keep the money: who is this player, and where did the money come from. KYC answers the first, AML answers the second, and both live inside the payment flow whether the operator wants them there or not.

Get the balance wrong and it costs in one of two directions. Too little checking and a regulator fines you, sometimes into the millions. Too much friction at the wrong moment and the player abandons the deposit and plays somewhere with a lighter touch.

This guide covers what KYC and AML actually require in iGaming, the transaction thresholds that trigger deeper checks, and how the rules change under the EU's 2027 anti-money laundering package. Facts verified as of July 2026.

What is KYC and AML in iGaming payments?

KYC (Know Your Customer) is the process of verifying a player's identity before and during play. AML (anti-money laundering) is the wider set of controls that stop criminal money moving through the operator, of which KYC is one part.

Term: KYC. Definition: The identity verification of a customer - name, date of birth, address and, where risk requires it, documentary proof - carried out to confirm a player is who they claim to be.

Term: AML. Definition: The controls a gambling operator runs to detect and prevent money laundering and terrorist financing, covering risk assessment, customer due diligence, transaction monitoring and reporting suspicious activity.

The two are often said in one breath, but they aren't the same job. KYC is a gate at onboarding and a set of triggers thereafter. AML is a standing programme that runs for the life of the account. A player can pass KYC cleanly and still generate an AML alert three months later when their deposits jump tenfold.

Why are gambling operators subject to AML rules?

Because gambling moves large volumes of money quickly and anonymously enough to attract laundering, international standards treat operators as regulated entities. Under the Financial Action Task Force, casinos are named designated non-financial businesses and professions, alongside lawyers, accountants and estate agents.

The FATF Recommendations set the global baseline, and Recommendation 22 pulls casinos into customer due diligence duties whenever a customer's financial transactions reach or pass a designated threshold of USD/EUR 3,000. National law then builds on top of that baseline.

In the EU, gambling has been an obliged sector since the Fourth Anti-Money Laundering Directive in 2015. In Great Britain, the Money Laundering Regulations 2017 make casinos - remote and non-remote - the obliged entities, while the Gambling Commission's LCCP condition 12.1.1 puts an AML risk-assessment duty on almost every licence type, not just casinos.

So the honest answer to "why us" is that the money leaves a card, an account or a wallet and the operator is the checkpoint. Regulators decided the checkpoint has to look.

What is the difference between KYC and AML?

KYC verifies identity. AML manages risk across the whole relationship. KYC is a component of AML, not a synonym for it - passing identity checks does not clear a player of money-laundering risk.

Think of it as scope. KYC asks a closed question with a yes or no answer: is this the real person, at this real address, of legal age. AML asks an open one that never fully closes: does this account's behaviour make sense for who this person is, and does anything about the money flag as suspicious.

That distinction matters at the payment layer. A deposit can clear KYC and still be the thing AML exists to catch - a mule account, a stolen card that passed 3D Secure authentication, or winnings being cycled out to a third-party account. Identity verified is not risk cleared.

What customer due diligence do iGaming operators have to run?

Operators run customer due diligence (CDD) as standard and step up to enhanced due diligence (EDD) when risk is higher. The trigger points are set by transaction value and by risk indicators, not by the operator's preference.

Under the EU's new Anti-Money Laundering Regulation (Regulation (EU) 2024/1624), providers of gambling services must apply CDD when a player wagers or collects winnings of at least EUR 2,000 in a single transaction or in linked transactions. That last phrase does the heavy lifting: operators have to watch for deposits fragmented to sit just under the line.

The tiers, in plain terms:

• Standard CDD - verify identity, screen against sanctions and politically exposed person (PEP) lists, and understand the intended pattern of play.
• Enhanced due diligence - applied to PEPs, customers linked to high-risk third countries, and any relationship the risk assessment scores high. It means more evidence, senior sign-off and closer ongoing monitoring.
• Ongoing monitoring - transaction review across the life of the account, so a low-risk player who starts behaving like a high-risk one gets re-scored.

The Gambling Commission's April 2025 emerging risks guidance singles out crypto-linked deposits as a high-risk indicator, expecting EDD where player funds trace back to crypto trading. If you take card-funded crypto or on-chain deposits, read our guide to crypto payment processing for iGaming alongside this.

What are source of funds and source of wealth checks?

A source of funds check asks where the money for a specific deposit came from. A source of wealth check asks how the player built their overall financial position. They answer different questions and higher-risk players get both.

Term: source of funds. Definition: Evidence of the origin of the money a player is gambling with - a salary payment, a property sale, a documented win - for a given deposit or set of deposits.

In practice this is where AML and player experience collide hardest. A player on a winning streak who suddenly deposits far more than their history suggests will hit a source of funds request, and if the operator asks clumsily - freezing the account with a vague demand for "documents" - the player treats it as the operator stalling a withdrawal. The friction is legitimate. The delivery is usually where it goes wrong.

My view, after years of watching these disputes: the operators that handle source of funds well are the ones that ask early and specifically, before the balance is large enough to make the player feel trapped. Leaving it until the first big withdrawal is the single most common own goal in the sector.

How do KYC and AML affect payment approval and player experience?

They sit directly in the deposit and withdrawal flow, so every added check is a point where a player can drop out. The cost of AML isn't only the compliance headcount - it's the conversion lost at each verification step.

Two numbers move against each other. Tighten checks and you cut fraud, chargebacks and regulatory exposure. Loosen them and you lift deposit conversion. The operators that win are the ones that apply friction by risk rather than across the board, so a low-risk first deposit clears in seconds while a high-risk pattern gets the full treatment.

This is why KYC and AML belong in the same conversation as approval rates. A blanket document upload at first deposit will cost you more players than most fraud ever would. You can model what a change in deposit conversion is worth to your operation with our approval rate calculator, and the trade-off runs through our wider guide to high-risk merchant accounts.

What changes under the EU AMLR and AMLA in 2027?

From 10 July 2027, the EU's AML rules become directly applicable law rather than directives each country interprets its own way. A single regulation and a new central authority replace much of the patchwork operators deal with today.

The package has three moving parts. The Anti-Money Laundering Regulation (AMLR) sets one rulebook that applies across all 27 member states without national transposition. The Sixth Anti-Money Laundering Directive (Directive (EU) 2024/1640) reshapes supervision, financial intelligence units and beneficial ownership registers, with a transposition deadline of 10 July 2027. And the new Anti-Money Laundering Authority (AMLA), operational since 1 July 2025 and based in Frankfurt, sits above national supervisors.

For an operator running in several EU markets, the practical shift is fewer diverging national rulebooks and one harmonised standard - including that EUR 2,000 gambling CDD threshold applied the same way everywhere. Whether AMLA reaches directly into gambling supervision or leaves it to national regulators is still settling, so I'd treat the direct-supervision question as open rather than decided.

How do operators run KYC without killing conversion?

The short version: verify by risk, ask early, and use data you already hold before you ask the player for more. The goal is to make the low-risk majority feel nothing and reserve friction for the accounts that earn it.

• Verify silently where you can. Electronic identity checks against reliable data sources clear most players without a document upload. Reserve manual document review for the ones that fail or score high.
• Ask for source of funds before the balance is large. Early requests read as routine. Late ones read as an operator blocking a withdrawal.
• Score risk continuously, not once. Ongoing monitoring catches the player whose behaviour changes after a clean onboarding - which is most of the real AML risk.
• Keep payment and compliance data joined up. The MCC, the card BIN, the deposit pattern and the KYC result tell a fuller story together than any one does alone.
• Match the check to the market. A licensed EU market, a UK credit-card ban and an offshore grey market carry different obligations - a single global rule either over-checks or under-checks somewhere.

Most of this is a vendor decision as much as a policy one. The iGamingPayments.ai directory lists KYC, identity and fraud providers alongside PSPs, and the payments glossary defines the surrounding terminology if any of the acronyms here are new.

Frequently asked questions

What is the difference between KYC and AML?

KYC is identity verification - confirming a player is who they say they are. AML is the wider programme of controls that stops criminal money moving through the operator, including risk assessment, transaction monitoring and suspicious activity reporting. KYC is one part of AML, not the whole of it.

Do all iGaming players have to complete KYC?

Yes, regulated operators verify identity for every player, though the depth varies by risk. Standard checks can run silently against electronic data sources, while higher-risk players and those crossing transaction thresholds face documentary verification and enhanced due diligence. Age verification is mandatory before play in licensed markets.

At what amount does AML checking kick in?

It depends on the jurisdiction. FATF Recommendation 22 sets a designated threshold of USD/EUR 3,000 for casino customer due diligence, and the EU's Anti-Money Laundering Regulation requires CDD for gambling wagers or winnings of at least EUR 2,000, including linked transactions structured to stay below the line. Operators also run checks below these figures where risk indicators appear.

What happens if an operator fails its AML obligations?

Regulators impose financial penalties, licence conditions or licence revocation, and named individuals can face personal consequences. The UK Gambling Commission has issued multi-million-pound settlements and penalties against licensed operators for AML and social responsibility failings, and the EU's incoming AMLA adds a central supervisor with its own enforcement reach from 2027.

Is a source of funds request a sign my withdrawal is being blocked?

No - it is a standard AML control, not a stalling tactic, though the timing often makes it feel like one. Operators are required to evidence where gambling money originates when deposits rise beyond a player's expected pattern. The complaint usually comes from operators asking late rather than the check itself being unreasonable.

How is AML different for crypto deposits in iGaming?

Crypto-funded deposits are treated as a higher-risk indicator. The UK Gambling Commission's April 2025 guidance expects enhanced due diligence where player funds trace back to crypto trading, because the origin of on-chain money is harder to evidence than a bank transfer. Operators taking crypto should plan for source of funds checks as the default, not the exception.

Does the EU AMLR replace national gambling AML rules?

Largely, yes, from 10 July 2027. The Anti-Money Laundering Regulation is directly applicable across all 27 member states without national transposition, so it supersedes much of the country-by-country patchwork. The accompanying Sixth Directive reshapes supervision and the new AMLA in Frankfurt sits above national regulators.

Find the right payment provider for your operation

Browse 342+ vetted PSPs, crypto processors, open banking providers and fraud vendors - filtered by region, vertical and payment method. Or run the numbers before your next PSP negotiation.