Enhanced due diligence in iGaming is not a fixed checklist; it is a dynamic calibration exercise that sits at the intersection of regulatory obligation, risk appetite, and operational capacity. For compliance teams that have moved past the basics, the real challenge lies in setting thresholds that are defensible to regulators, proportionate to actual risk, and workable for operations staff at the same time.
What Enhanced Due Diligence Actually Requires
EDD is the intensified verification and monitoring applied to customers who present a higher risk of money laundering, terrorist financing, or sanctions exposure. Regulatory frameworks such as the EU's Fourth and Fifth Anti-Money Laundering Directives, the UK's Money Laundering Regulations 2017, and Malta's PMLFTR all mandate EDD for specific categories of customer, including politically exposed persons, high-value depositors, and those from high-risk third countries. What regulators rarely prescribe is the precise monetary or behavioural threshold at which EDD must activate. That determination belongs to the operator, and it must be grounded in a documented risk assessment.
Threshold Types: Monetary, Behavioural, and Composite
Experienced compliance teams recognise that deposit or turnover ceilings alone are a blunt instrument. A more defensible architecture combines three threshold types:
- Monetary thresholds: Cumulative deposit or net deposit figures over a rolling period, for example a 30-day or 90-day window, that trigger a source of funds request or enhanced profile review.
- Behavioural thresholds: Velocity anomalies, sudden stake escalation, rapid withdrawal after minimal play, or structuring patterns that fall just below monetary limits.
- Composite scoring: A weighted model that aggregates monetary activity, behavioural signals, jurisdictional risk, payment method risk, and customer profile attributes into a single risk score that gates the EDD workflow.
The composite approach is increasingly expected by regulators during inspections. A flat monetary trigger set at, for instance, 2,000 euros in a calendar month may be appropriate for low-risk cohorts but entirely inadequate for customers depositing via cryptocurrency from jurisdictions on the FATF grey list.
Calibrating Thresholds to Your Actual Player Base
Threshold calibration is not a one-time configuration task. Operators must review trigger levels at least annually, and more frequently if the player acquisition strategy changes materially. The calibration process should involve:
- Analysing the distribution of customer spending across the active base to ensure thresholds are neither over-inclusive (creating compliance workload without proportionate risk reduction) nor under-inclusive (allowing meaningful risk to pass undetected).
- Back-testing thresholds against historical suspicious activity reports and confirmed fraud or money-laundering cases to validate that existing settings would have caught real events.
- Stress-testing against synthetic high-risk scenarios to identify gaps, particularly around structuring behaviour.
- Documenting every calibration decision, including the rationale for any threshold adjustment, so that the business can demonstrate to regulators a genuine risk-based approach rather than arbitrary number selection.
Operationalising EDD Without Degrading Customer Experience
One of the persistent tensions in iGaming compliance is that poorly timed EDD requests cause player friction, chargebacks, and reputational complaints. Skilled teams resolve this by segmenting the EDD workflow into phases. A customer approaching a threshold can receive a proactive, friendly source of funds request framed as account verification before the hard trigger is reached. This reduces the incidence of abrupt account restrictions and gives higher-value customers time to provide documentation without feeling suspected of wrongdoing.
Automated case management systems should flag EDD-pending customers to responsible gambling teams simultaneously, because elevated spend that triggers AML scrutiny often correlates with problem gambling indicators that require a separate intervention pathway. Treating these as parallel processes rather than sequential ones saves time and reduces regulatory exposure on both fronts.
Politically Exposed Persons and Source of Wealth
PEP screening deserves specific attention because the threshold concept applies differently here. EDD for PEPs is mandatory regardless of deposit level; the threshold question shifts to how deep source-of-wealth verification must go and how frequently the enhanced profile must be refreshed. A PEP depositing modest amounts still requires a documented assessment of whether the funds are consistent with their declared public role and known income. Operators should establish a refresh cycle, typically between six and twelve months, with interim triggers based on any material change in activity pattern.
Where OnlineShine Sees Operators Getting This Wrong
In our managed compliance work across multiple regulated jurisdictions, the most common failure modes are: thresholds set at industry convention rather than operator-specific risk analysis; EDD workflows that generate a request but lack an escalation path when customers fail to respond; and composite scoring models that are configured at launch and never subsequently validated against real outcomes. Each of these is a finding waiting to happen during a regulatory review.
A threshold is only as strong as the documented rationale behind it and the operational process that follows when it is crossed.
