Enhanced due diligence thresholds are no longer a back-office afterthought for iGaming operators. Regulators across Malta, Gibraltar, the Isle of Man, and emerging markets have sharpened their expectations around when and how operators escalate customer scrutiny, and the operational cost of getting that calibration wrong runs from regulatory fines to licence suspension. The central question facing compliance teams in 2025 is not whether to invest in EDD capability, but which delivery model fits their risk appetite, headcount, and growth trajectory.
What EDD Thresholds Actually Mean in Practice
Enhanced due diligence is the set of additional checks an operator applies when a customer crosses a defined risk boundary. In iGaming, those boundaries are triggered by deposit velocity, cumulative wagering amounts, source-of-funds gaps, PEP status, or behavioural anomalies flagged by transaction monitoring. The threshold itself is the numerical or qualitative rule that moves a player from standard due diligence to the EDD queue.
Regulators do not prescribe a single universal threshold. The MGA's AML framework, the UK Gambling Commission's guidance, and FATF Recommendation 10 all require operators to set thresholds that reflect their own risk-based approach. That flexibility is also a compliance trap: thresholds set too high miss high-risk players, while thresholds set too low flood analyst queues with false positives and burn through operational capacity.
The Build Option: Control at a Cost
Building an in-house EDD function gives operators direct control over threshold logic, escalation workflows, and the analyst team executing reviews. For large, multi-brand operators with dedicated compliance headcount, this model makes sense. Thresholds can be tuned precisely to product verticals, player demographics, and jurisdiction-specific risk assessments without waiting on a vendor release cycle.
The costs are significant and often underestimated:
- Hiring and retaining qualified MLRO-level staff in a competitive talent market
- Building or licensing a case management system that handles EDD workflows, document collection, and audit trails
- Continuous threshold recalibration as player behaviour and regulator expectations shift
- Training programmes to keep analysts current with typology updates
A build approach also concentrates regulatory liability internally. If thresholds are misconfigured and a suspicious transaction is missed, the operator bears full accountability with no contractual recourse to a third party.
The Buy Option: Speed with Integration Risk
Purchasing a specialist AML platform, whether from an established provider or a newer AI-driven vendor, gives operators pre-built threshold templates, automated document verification, and often integrated transaction monitoring. The time-to-deploy advantage is real, particularly for operators entering new markets under licence conditions that require demonstrated EDD capability from day one.
Operators should stress-test the following before signing:
- How configurable are the default thresholds, and who owns the configuration process?
- Does the platform support jurisdiction-specific rule sets, or is it a single global model?
- What is the data residency position, especially relevant for operators holding EU player data under GDPR?
- What SLAs cover uptime and analyst queue response during peak periods?
Buying solves the technology problem but not the human judgement problem. Platforms surface cases; qualified analysts still need to close them. Operators who buy technology without pairing it with trained compliance resource often find their EDD queues growing faster than their team can clear them.
The Outsource Option: Flexibility Without the Overhead
Outsourcing EDD operations to a managed-services partner means the operator sets the threshold policy, while the partner supplies the analysts, tooling, and process governance to execute reviews at scale. This model has gained traction among mid-market operators who need credible EDD capability but cannot justify the fixed cost of a full in-house compliance function.
A well-structured outsource arrangement should include:
- Clear ownership of threshold-setting: the operator's MLRO must retain policy authority, with the partner executing within those parameters
- Documented escalation paths so that complex or high-value EDD cases reach senior compliance oversight without delay
- Regular reporting cadences that give the MLRO visibility into queue volumes, closure rates, and threshold breach patterns
- Contractual data security obligations aligned with the operator's licence conditions
Choosing the Right Model for Your Operation
The honest answer is that most operators end up with a hybrid arrangement. Threshold policy sits with the internal MLRO, technology is purchased from a specialist vendor, and operational analyst capacity is either built in-house or supplemented through a managed partner during growth phases or market launches.
Effective EDD is not a technology question or a staffing question in isolation. It is a governance question: who owns the threshold, who executes the review, and who is accountable to the regulator when either goes wrong.
Operators reviewing their EDD model should map their current threshold logic against recent regulatory feedback, calculate the real cost of their existing false-positive rate, and assess whether their analyst team has the capacity and training to handle the next step up in player volumes. That honest audit usually points clearly toward which delivery model closes the gap most efficiently.
