Enhanced due diligence is no longer a box-ticking exercise reserved for high-rollers at land-based casinos. For online operators, EDD thresholds define the line between standard customer verification and the deeper scrutiny required when a player's activity, origin or behaviour elevates financial crime risk. Getting those thresholds right, and operationalising them consistently, is one of the most consequential compliance decisions an operator can make in 2024.
What Enhanced Due Diligence Actually Means
Standard customer due diligence (CDD) covers identity verification, basic source-of-funds checks and ongoing transaction monitoring for most players. Enhanced due diligence goes further: it requires operators to establish the legitimate origin of funds, understand the nature of the business relationship in greater depth and apply heightened ongoing monitoring. Under the EU's Fourth and Fifth Anti-Money Laundering Directives, EDD is mandatory for politically exposed persons (PEPs), customers from high-risk third countries and any relationship that presents elevated risk indicators.
In practical terms, EDD means requesting bank statements, payslips or business accounts, conducting adverse media screening, obtaining senior management approval for the relationship and documenting the rationale for accepting the customer at all. The process must be proportionate to the risk level identified, but proportionality does not mean minimal.
How Thresholds Are Set, and Where Operators Go Wrong
Most operators set EDD thresholds around a combination of three variables: deposit volume over a rolling period, cumulative net deposits since account opening and single-transaction size. A common configuration might trigger EDD review at 2,000 euros in net deposits within 30 days, with an absolute threshold of 10,000 euros lifetime or any single deposit above 5,000 euros. The precise figures, however, must reflect the operator's own risk appetite, licence conditions and the demographic profile of its player base.
The most frequent compliance failures stem from three structural problems:
- Static thresholds: Thresholds set at launch and never reviewed become obsolete as player spending patterns change and regulatory guidance evolves.
- Threshold structuring blindness: Players who learn an operator's limits can deliberately keep deposits just below them. Transaction monitoring rules must identify structuring patterns, not just individual transaction sizes.
- Siloed data: EDD decisions made without integrating bonus abuse data, chargeback history and customer service escalations miss behavioural signals that financial data alone cannot reveal.
Risk-Based Calibration Across Player Segments
Regulators expect operators to segment their customer base by risk and apply differentiated thresholds accordingly. A player depositing via a regulated bank in a low-risk jurisdiction warrants a different threshold profile than one using crypto wallets registered in a high-risk country. The UK Gambling Commission, the Malta Gaming Authority and the Dutch Kansspelautoriteit have all published guidance emphasising that flat thresholds applied uniformly across all customers are inadequate.
Operators should build at least three threshold tiers into their AML programme:
- Standard tier: CDD maintained; automated monitoring flags anomalies for analyst review.
- Elevated tier: Lighter EDD applied, typically source-of-funds documentation requested, with enhanced monitoring frequency.
- High-risk tier: Full EDD including source-of-wealth verification, senior management sign-off and documented ongoing review at defined intervals.
Operationalising EDD Without Destroying the Player Experience
One of the persistent tensions in compliance is the friction EDD introduces at the point it is triggered. Operators that present EDD requests poorly, or time them awkwardly, create player complaints, chargebacks and reputational damage. The solution is to embed EDD collection into the customer journey early, framing documentation requests as part of account verification rather than as a sudden investigative step.
Automated triggers should give compliance analysts enough lead time to conduct outreach before a player hits a withdrawal limit or a deposit block. Where possible, operators should collect incremental documentation at lower thresholds, so that by the time full EDD is required, much of the evidence is already on file.
The OnlineShine Practitioner View
Threshold calibration is a living process, not a one-time configuration. Operators that treat EDD limits as permanent policy settings rather than dynamic parameters reviewed against actual player behaviour and emerging regulatory guidance are carrying compliance risk they cannot see.
At OnlineShine, our MLRO-as-a-service clients undergo quarterly threshold reviews that cross-reference transaction monitoring outputs, responsible gambling data and any regulatory correspondence received in the period. This approach ensures that EDD frameworks remain proportionate, defensible and aligned with the operator's current licence obligations across all active markets.
