Enhanced due diligence is one of the most frequently misunderstood obligations in iGaming compliance. Operators know the term exists, but the precise thresholds, triggers, and documentation requirements often remain unclear until a regulator asks the uncomfortable questions. This guide defines EDD in plain language and explains how online gambling businesses can apply it consistently and proportionately.
What Enhanced Due Diligence Actually Means
Due diligence in a compliance context refers to the process of verifying who your customers are and assessing the risk they represent. Standard customer due diligence, or CDD, covers identity verification, address confirmation, and a basic risk rating. Enhanced due diligence goes further. It requires operators to gather additional information, apply closer scrutiny, and obtain senior management approval before accepting or continuing a business relationship with certain categories of player.
The legal basis for EDD in most regulated markets derives from the Financial Action Task Force recommendations and their local legislative translations, such as the EU's Anti-Money Laundering Directives. In iGaming, national gambling regulators layer their own specific requirements on top of these financial-sector rules, which means the precise threshold at which EDD kicks in can vary by jurisdiction.
Common Triggers for EDD in Online Gambling
While exact figures differ across markets, the following categories reliably trigger an EDD obligation for most licensed operators:
- Politically exposed persons (PEPs): Any player identified as a current or former senior public official, or a close associate or family member of one, requires EDD regardless of deposit amounts.
- High-risk third countries: Players with connections to jurisdictions on FATF grey or black lists, or on an operator's own internal high-risk country list, require enhanced scrutiny from the first deposit.
- Source of funds concerns: When a player's declared occupation does not plausibly explain their gambling activity, EDD documentation covering source of wealth and source of funds becomes mandatory.
- Deposit and loss thresholds: Many regulators set monetary triggers. In the UK, for example, operators are expected to conduct enhanced checks when cumulative net losses or deposits reach defined levels within a rolling period. Other jurisdictions set single-transaction thresholds or monthly cumulative caps.
- Suspicious behaviour patterns: Rapid structuring of deposits just below reporting thresholds, unusual bonus exploitation, or frequent payment method changes can each independently trigger EDD.
What EDD Documentation Must Contain
An EDD file is not simply a copy of a passport and a payslip. Regulators and auditors expect a structured, evidenced record that demonstrates your team made a reasoned decision. A robust EDD file typically includes:
- Identity documents verified through a recognised third-party service or certified copies.
- Proof of source of funds, such as bank statements, audited accounts, or documented sale proceeds.
- Proof of source of wealth where cumulative activity warrants it, covering how the player accumulated their overall net worth.
- A written risk narrative prepared by the compliance team, explaining why the relationship is acceptable despite elevated risk.
- Senior management or MLRO sign-off recorded with a date and name.
- Ongoing monitoring notes with defined review dates.
Proportionality: Calibrating Effort to Actual Risk
One of the most practical principles in AML regulation is proportionality. Regulators do not expect operators to treat every player depositing above a low threshold as a money laundering suspect. They do expect documented reasoning that matches the depth of investigation to the level of risk. A player depositing modestly who is flagged only because they reside in a medium-risk country may need lighter EDD than a high-value player with an unexplained wealth profile.
Proportionality means your EDD process must be defensible, not merely thorough. A regulator reviewing your files wants to see that your team asked the right questions, recorded the answers, and reached a logical conclusion.
Building an Operational EDD Process
For operators setting up or reviewing their EDD framework, the following structural steps reduce compliance risk and operational friction at the same time:
- Define your thresholds in writing inside your AML policy, and review them at least annually or whenever a new regulatory update is issued.
- Configure your platform to produce automatic alerts when a player crosses a monetary or behavioural trigger, so no case falls through the cracks.
- Assign clear ownership, typically the MLRO or a designated compliance analyst, for each EDD case from trigger to resolution.
- Set a maximum time window for completing an EDD review. If documentation is not received within that window, deposits should be suspended rather than simply left pending.
- Archive all EDD files for the retention period required by your licence conditions, commonly five years after the end of the relationship.
How OnlineShine Supports EDD Compliance
Our managed compliance service embeds an experienced MLRO function directly into your operation. We design threshold frameworks calibrated to your specific licence jurisdiction, configure alerting logic within your existing platform, and maintain the audit-ready documentation that regulators expect. Whether you are launching a new brand or remediating gaps identified in a regulatory review, having a dedicated compliance partner means EDD becomes a manageable process rather than a source of ongoing operational anxiety.
