Enhanced due diligence is no longer a checkbox reserved for high-rollers who deposit six figures in a single session. As regulators across Europe and beyond tighten AML frameworks, iGaming operators must build EDD thresholds and workflows that are proportionate, documented and genuinely defensible under supervisory scrutiny.
What Enhanced Due Diligence Actually Means in iGaming
Enhanced due diligence is the deeper layer of customer verification triggered when a player presents a higher risk profile than standard KYC can adequately assess. In practical terms, it means collecting more information, verifying it through additional sources and documenting the rationale for every decision. Regulatory frameworks such as the EU's Fourth and Fifth Anti-Money Laundering Directives, the UK Gambling Commission's LCCP and Malta's FIAU guidance all require EDD for specific customer categories and financial thresholds, though the exact trigger points differ by jurisdiction.
The critical distinction operators often miss is that EDD is not a single event. It is an ongoing process. A player cleared at onboarding can move into EDD territory months later based on cumulative deposit patterns, velocity changes or adverse media hits.
Setting Your EDD Thresholds: Principles Over Prescriptions
No single deposit figure universally triggers EDD. Operators must build thresholds that reflect their specific risk appetite, player base and licensing obligations. The following principles provide a practical starting point:
- Use cumulative, not transaction-level, triggers. A player depositing 500 euros ten times in a month presents the same aggregate exposure as one depositing 5,000 euros once. Your monitoring rules must capture both patterns.
- Differentiate by product vertical. Threshold logic appropriate for a sportsbook with frequent small deposits may be entirely inappropriate for a live-casino vertical where session values are higher and velocity is lower.
- Align with your Source of Funds policy. If your SOF policy requires documentation above a defined lifetime deposit threshold, your EDD trigger should activate before that threshold is reached, giving your team time to collect evidence without disrupting the player relationship mid-session.
- Calibrate to your licensing jurisdiction. The UKGC expects operators to apply EDD to politically exposed persons regardless of deposit volume. The MGA requires it when enhanced-risk factors are present. Map each jurisdiction's requirements to a clear internal trigger matrix.
Building a Scalable EDD Workflow
Threshold logic alone is insufficient. The workflow that activates once a threshold is breached determines whether your EDD programme is operationally credible or simply a compliance facade. A functional EDD workflow should include the following stages:
1. Automated Risk Flagging
Your CRM and transaction monitoring system should generate a risk flag automatically when a player meets a trigger condition. Manual identification is too slow and too inconsistent at scale. The flag should include the specific rule that was tripped, the player's current risk score and the actions required from the compliance team.
2. Structured Information Request
Contact with the player should be templated but not robotic. A clear, professional request for source of funds documentation, proof of income or employer confirmation reduces friction and improves response rates. Give the player a defined window, typically five to ten business days, before account restrictions apply.
3. Independent Verification
Documents submitted by the player must be verified against independent sources wherever possible. This means cross-referencing payslips against HMRC or equivalent data, checking company ownership against corporate registries and screening for adverse media and sanctions simultaneously.
4. Decision, Documentation and Escalation
Every EDD case must close with a documented decision: approve with conditions, continue monitoring, restrict or exit the relationship. The rationale must be written, not implied. If the decision is made by a junior analyst, a senior compliance officer or MLRO must countersign cases above a defined risk level. Suspicious activity reports should follow your internal SAR policy if the outcome warrants it.
Balancing Compliance and Player Experience
A poorly designed EDD process drives good players away and generates regulatory complaints. Operators who integrate EDD prompts into natural account management touchpoints, rather than deploying them as sudden friction events, retain significantly more players through the process. Pre-emptive enrichment of player profiles at onboarding also reduces the volume of intrusive EDD requests later. Collecting occupation, employer and estimated annual income at registration, within the bounds of data protection rules, creates a baseline that makes subsequent monitoring far less disruptive.
The goal of EDD is not to interrogate players. It is to give your compliance team enough information to make a defensible, proportionate risk decision.
Documentation: Your Primary Defence Under Audit
When regulators review your EDD programme, they are not only checking whether you triggered reviews at the right thresholds. They are checking whether your team applied consistent judgment, documented the evidence reviewed and escalated appropriately. Operators who treat EDD records as audit assets, rather than compliance burdens, are consistently better positioned during regulatory inspections and licence renewal assessments.
