Cross Border Gambling Compliance

QUICK ANSWER

Cross-border gambling compliance is the practice of meeting every applicable legal and regulatory obligation in each jurisdiction where a gambling operator accepts bets or offers gaming products. Because gambling is regulated at the national — and sometimes sub-national — level, operators serving multiple markets must build compliance programs that satisfy divergent standards simultaneously.

The term ‘cross-border’ encompasses more than international operations. Many compliance obligations arise when operators cross state or provincial lines — for example, US online gambling operators must hold separate state licenses in New Jersey, Pennsylvania, Michigan, and other markets, each imposing distinct requirements. Similarly, Australian operators navigate state-and-territory-level regulations for different product types.

A key distinction shapes how operators approach cross-border compliance: the difference between licensing-origin compliance (the obligations imposed by the jurisdiction that issued the operator’s license) and market-access compliance (the requirements in the jurisdiction where the player is physically located). In most regulated markets, local licensing — and therefore local compliance — is required as a condition of accepting players, regardless of where the operator holds its primary license.

The growth of online gambling has transformed cross-border compliance from a niche concern into a core operational requirement. Digital platforms allow operators to serve customers across dozens of markets simultaneously, each with its own regulatory framework, enforcement posture, and expectations for how compliance programs should be structured.

Why Cross-Border Compliance Is More Complex Than Single-Market Compliance

QUICK ANSWER

Cross-border compliance multiplies complexity because there is no unified global gambling regulatory framework. An operator must track requirements across multiple licensing authorities, satisfy different AML and KYC standards, navigate conflicting data protection regimes, comply with distinct responsible gambling obligations, and adapt marketing to local advertising rules — all simultaneously and in real time.

• No harmonized global standard. Unlike financial services, where Basel III provides an international floor, gambling regulation remains almost entirely national. Each jurisdiction defines gambling differently, sets its own licensing thresholds, and determines its own AML, KYC, and responsible gambling requirements.
• Regulatory arbitrage risk. Operators licensed in permissive jurisdictions serving players in stricter markets face enforcement exposure in the player’s jurisdiction, not just the licensing jurisdiction. Operating under a Curacao license while serving UK-resident players, for example, exposes an operator to UKGC enforcement regardless of its licensing position.
• Regulatory change velocity. Rule changes can occur suddenly and with limited transition periods, forcing operators to adapt quickly at high cost. Compliance teams must monitor multiple regulatory feeds simultaneously and maintain the internal agility to implement changes on short notice.
• Expanding liability beyond operators. Since the second half of 2025, enforcement has increasingly targeted suppliers, platforms, and payment partners — not only primary license holders. Enterprise-wide risk management, extending compliance obligations through the supply chain, has become a compliance best practice.

The Core Compliance Pillars for Multi-Jurisdictional Operators

Cross-border gambling compliance is not a single obligation, it is a set of parallel compliance programs that must operate simultaneously. The six pillars below represent the primary areas where regulatory requirements diverge materially across jurisdictions.

1. Licensing and Market Access

QUICK ANSWER

A gambling license granted in one jurisdiction does not generally permit an operator to accept players from another. Most regulated markets require operators to hold a locally issued license as a precondition of legal market access. Multi-jurisdictional operators typically maintain a portfolio of licenses across key markets, each with distinct application requirements, ongoing conditions, and renewal obligations.
Securing licenses across multiple jurisdictions requires navigating distinct application processes, financial disclosure requirements, background investigation regimes, technical standards certifications, and in some markets — mandatory local substance (physical presence, local directors, or locally hosted systems).

Once licensed, operators must manage ongoing compliance with license conditions across multiple authorities simultaneously — including regular audits, financial reporting, responsible gambling program reviews, AML audit submissions, and player fund segregation requirements. License renewal timelines, fee schedules, and condition changes must be tracked as part of an active license portfolio management program.

2. Anti-Money Laundering (AML) and Financial Crime Prevention

QUICK ANSWER

Anti-money laundering (AML) requirements for gambling operators vary significantly by jurisdiction, but all major regulated markets require operators to implement a risk-based AML program covering customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk customers, transaction monitoring, and suspicious activity reporting to the relevant financial intelligence unit (FIU).

Gambling is classified as a high-risk sector for financial crime by the Financial Action Task Force (FATF) and national regulators. The industry’s combination of high-value transactions, cash handling (at land-based venues), cross-border payment flows, and anonymity potential creates vulnerability to money laundering and terrorism financing.

Cross-border AML compliance creates a specific tension: an online site licensed in one country and serving customers in another may owe suspicious activity reporting obligations to financial intelligence units in multiple jurisdictions. Where a transaction touches different countries — for example, a player depositing from a bank in a FATF high-risk country — operators must apply enhanced due diligence and may have reporting obligations beyond their home jurisdiction.

The FATF 2025 update on virtual assets and service providers (VASPs) flagged that many countries have yet to fully implement key requirements, including the Travel Rule and effective licensing systems, leaving gaps that expose operators to cross-border financial crime risk. For gambling operators accepting cryptocurrency, this creates a particularly complex compliance environment where standards differ materially across jurisdictions.

3. KYC and Identity Verification

QUICK ANSWER

Know-your-customer (KYC) requirements obligate gambling operators to verify the identity, age, and in some cases the financial circumstances of players before allowing them to gamble. Requirements differ across jurisdictions in terms of verification triggers, acceptable identity documents, timing of verification, and what enhanced verification is required for higher-risk players.

Baseline KYC requires verification of identity, age, and residential address. However, the standards for acceptable identity documents differ — a national ID card acceptable in Germany may not satisfy UK requirements. Verification timing also varies: some jurisdictions require verification before the first deposit; others allow a threshold to be reached before enhanced checks are triggered.

Multi-state US compliance creates a particular challenge: age thresholds differ by state, with some markets permitting 18-year-olds to gamble and others requiring players to be 21. An operator must maintain separate verification workflows for each jurisdiction in its portfolio, blocking players who are legal in one state but not another.

Modern compliance technology has significantly reduced the operational burden of KYC. Automated verification providers integrate directly into gambling platforms, with average verification times under two minutes and approval rates of 85-92% for legitimate players. However, the rise of AI-generated synthetic identities and deepfake-enabled impersonation represents a growing threat to cross-border KYC programs, particularly given that standards differ across jurisdictions.

4. Responsible Gambling and Player Protection

QUICK ANSWER

Responsible gambling obligations require operators to implement measures that identify and protect players at risk of gambling-related harm. In cross-border contexts, these obligations vary considerably — from self-exclusion schemes and deposit limits to mandatory affordability checks — and a single operator may be required to maintain distinct programs for each market it serves.

The UK Gambling Commission represents the global benchmark for responsible gambling compliance, having introduced enhanced consumer protections including affordability assessments that require operators to verify a player’s financial circumstances before allowing continued gambling beyond defined thresholds. These requirements go significantly beyond those in most other jurisdictions.

National self-exclusion programs — such as GAMSTOP in the UK and CRUKS in the Netherlands — operate within single markets and do not currently extend across borders. A player self-excluding in one jurisdiction is not automatically protected in another, placing an obligation on operators to check all applicable self-exclusion registers in every market they serve.

Social responsibility compliance has become a central condition of license renewal across most regulated markets. Operators that cannot demonstrate robust responsible gambling programs — including regular audits, staff training, and continuous improvement — face license suspension or non-renewal regardless of their AML and KYC performance.

5. Data Protection and Privacy

QUICK ANSWER

Gambling operators handling personal data across borders must comply with data protection laws in every jurisdiction where they collect or process player information. GDPR applies to operators serving EU/EEA residents regardless of where the operator is established, and other major markets — including the US, Brazil, and Australia — have enacted their own data protection frameworks that create additional obligations.

GDPR’s extra-territorial reach is one of the most significant data protection challenges for cross-border gambling operators. An operator established outside the EU but targeting EU residents with its gambling products is subject to GDPR as a controller. This creates obligations around lawful basis for data processing, data subject rights, privacy notices, and — critically — restrictions on transferring player data to countries without an EU adequacy decision.

A recurring compliance tension exists between AML data retention requirements and GDPR erasure rights. AML regulations in most jurisdictions require operators to retain customer due diligence records for five years or more after the end of a business relationship. Where a player exercises their GDPR right to erasure, operators must make a careful legal assessment of which data must be retained for regulatory compliance and which can be deleted.

Data residency requirements add a further layer of complexity. Some markets require player data to be stored within national borders — requirements that conflict with centralized global compliance systems that aggregate data across markets for unified AML monitoring.

6. Advertising and Marketing Restrictions

QUICK ANSWER

Gambling advertising is among the most heavily restricted forms of marketing, and requirements differ substantially across jurisdictions. Cross-border operators must ensure that advertising delivered via digital platforms — including search, social media, and affiliate networks — complies with the rules of the jurisdiction where the player is located, not just where the operator is licensed.

Digital advertising creates particular cross-border exposure because ad serving platforms do not respect regulatory boundaries. An ad campaign targeting UK users via Google may serve impressions to users in jurisdictions where such advertising is prohibited or requires a local license. Operators must implement rigorous geotargeting controls and conduct regular audits of campaign delivery data to identify and remediate territorial compliance breaches.

In November 2025, gambling regulators from Austria, France, Germany, the United Kingdom, Italy, Portugal, and Spain issued a joint statement reaffirming their coordinated commitment to combating illegal online gambling advertising. The statement identified cross-border advertising by unauthorized operators as a top enforcement priority and signaled reduced tolerance for affiliate marketing and digital distribution channels that carry unlicensed gambling advertising across borders.

Affiliate marketing liability represents a growing compliance concern. As enforcement increasingly targets the supply chain — not just primary operators — the question of who bears regulatory responsibility when an unlicensed affiliate promotes a licensed operator in a restricted market has become a live legal issue in multiple jurisdictions.

Major Regulatory Frameworks That Shape Cross-Border Compliance

Several supranational and international frameworks establish minimum standards that cascade into national gambling regulations. Compliance professionals working across jurisdictions must understand these frameworks as a baseline before mapping jurisdiction-specific requirements.

FATF Recommendations

QUICK ANSWER

The Financial Action Task Force (FATF) Recommendations establish global standards for anti-money laundering and counter-terrorism financing. While FATF does not regulate gambling operators directly, its Recommendations are transposed into national law by member countries, making them the de facto international baseline for AML compliance across the global gambling industry.

FATF’s Recommendations identify gambling as a designated non-financial business and profession (DNFBP) subject to AML/CFT obligations. This classification requires gambling operators in FATF member countries to implement customer due diligence, record-keeping, and suspicious transaction reporting — the core obligations that underpin AML programs across major regulated markets.

FATF’s mutual evaluation process assesses member countries’ compliance with the Recommendations. Countries identified as deficient in gambling-sector AML regulation are placed under enhanced monitoring or on FATF’s high-risk jurisdiction list. For gambling operators, customers from high-risk or monitored jurisdictions trigger enhanced due diligence obligations — a requirement that must be operationalized across every market the operator serves.

EU Anti-Money Laundering Directives (AMLD)

QUICK ANSWER

The European Union’s Anti-Money Laundering Directives (AMLD) create a harmonized AML framework across EU member states. The forthcoming EU AML Regulation (AMLR) will extend and strengthen obligations for gambling operators, with direct applicability across all member states without requiring national transposition — and establishing a new EU AML Authority (AMLA) to oversee compliance.

Current AMLD requirements for EU casinos include mandatory CDD for transactions at or above EUR 2,000, enhanced due diligence for higher-risk customers including politically exposed persons, and reporting of suspicious transactions to national financial intelligence units. While the AMLD provides a framework, national transposition has produced variation across member states — meaning operators must still map requirements market-by-market within the EU.

The AMLA, once operational, is expected to centralize oversight of cross-border AML compliance for obligated entities including gambling operators. This represents a significant shift toward regulatory harmonization within the EU — though the timeline for full AMLA operational capability extends into the latter part of this decade.

GDPR and Cross-Border Data Transfer Obligations

QUICK ANSWER

The General Data Protection Regulation (GDPR) applies to any gambling operator that processes the personal data of individuals located in the EU or EEA, regardless of where the operator is established. This creates significant data protection compliance obligations for non-EU operators with EU player bases, including restrictions on transferring player data outside the EU.

For cross-border gambling operators, GDPR compliance requires careful legal analysis of the basis for processing different categories of player data, implementation of data subject rights mechanisms, maintenance of records of processing activities, and — where player data is transferred to third countries — reliance on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs) or adequacy decisions.

Post-Brexit, UK operators serving EU/EEA players must comply with both UK GDPR and EU GDPR as separate legal frameworks. The UK’s adequacy decision from the EU provides a basis for data transfers between the UK and EU, but this must be monitored for continued validity.

Mutual Recognition and Enforcement Cooperation

QUICK ANSWER

Cross-border enforcement of gambling regulation relies primarily on cooperation between national regulators. No binding international treaty governs gambling compliance globally. Regulatory cooperation takes the form of bilateral agreements, information-sharing arrangements, and multi-regulator joint statements — most developed in Europe, less formalized in other regions.

The European Regulators Group for online gambling (EREG) facilitates regulatory cooperation and information sharing among EU gambling regulators. The November 2025 joint enforcement statement from seven European regulators — covering illegal cross-border advertising by unauthorized operators — represents a significant escalation in coordinated enforcement, signaling that operators cannot rely on regulatory fragmentation as a de facto protection.

Outside Europe, cross-border enforcement cooperation is more limited. Extraterritorial enforcement without inter-jurisdictional cooperation faces significant practical constraints. Enforcement actions against operators located in one jurisdiction for conduct affecting players in another depend heavily on the availability of bilateral cooperation mechanisms and the willingness of the operator’s home regulator to take action.

Jurisdiction-by-Jurisdiction Compliance Snapshot

The following snapshot covers key compliance requirements in major gambling markets. It is intended as a starting reference — compliance professionals should consult jurisdiction-specific legal advice and refer to IMGL’s full market pages for detailed guidance.

United Kingdom

QUICK ANSWER

The United Kingdom operates one of the world’s most demanding gambling compliance frameworks, governed by the Gambling Commission under the Gambling Act 2005. UK-licensed operators must meet stringent AML requirements, implement robust responsible gambling safeguards including affordability assessments, comply with UK GDPR, and adhere to advertising standards enforced by the ASA and UKGC.

European Union (Key Markets)

QUICK ANSWER

While the EU does not have a unified gambling regulatory framework, operators serving EU players must comply with AMLD requirements transposed into national law, GDPR, and — in each member state where they seek to operate — local licensing requirements that differ significantly across markets.

United States

QUICK ANSWER

The United States regulates gambling at the state level, creating one of the world’s most fragmented multi-jurisdictional compliance environments. Online gambling operators serving US players must obtain licenses from each state in which they operate, comply with state-specific KYC and AML requirements, and satisfy federal obligations under the Bank Secrecy Act and the Unlawful Internet Gambling Enforcement Act (UIGEA).

Asia-Pacific

QUICK ANSWER

The Asia-Pacific region is among the most fragmented gambling regulatory environments globally. Regulatory approaches range from full legalization with strict oversight (Australia, Macau, Singapore) to near-total prohibition with limited exceptions (mainland China, India for money-based games). Cross-border enforcement challenges are acute across the region.

Australia prohibits casino-style online gambling products under the Interactive Gambling Act but permits online sports betting, creating a unique compliance environment for operators. AUSTRAC AML obligations apply to licensed betting operators, who must also hold state and territory licenses for specific product types.

Singapore’s amended Payment Services Act, including cross-border collection agency regulations, is expected to come into effect from 2026 onwards, with gambling funds explicitly subject to regulation — a significant development for operators in the broader Asia-Pacific market.

India adopted a markedly stricter approach to online gaming and gambling regulation in 2025, imposing a nationwide prohibition on online money games. While extraterritorial enforcement remains difficult without bilateral cooperation, the regulatory direction is clear: operators serving Indian-resident players face significant legal exposure.

Latin America and Emerging Markets

QUICK ANSWER

Latin America has undergone significant gambling regulatory development in recent years. Brazil’s regulated online betting framework, launched in January 2025, represents the most significant market opening in the region. Compliance requirements are still maturing across much of Latin America, but operators entering these markets face increasing regulatory expectations aligned with FATF standards.