Enhanced due diligence is no longer a box-ticking exercise reserved for the highest-value players. Regulators across Malta, the UK, Gibraltar and the Netherlands are tightening the criteria that define when operators must escalate from standard customer due diligence to a deeper investigative process, and banking partners are following suit with their own parallel expectations. Understanding precisely where those thresholds sit, and what evidence is needed to satisfy them, is now a core operational competency for any licensed iGaming business.
What Enhanced Due Diligence Actually Means in Practice
Enhanced due diligence (EDD) is the set of additional checks an operator applies when a customer or transaction presents a higher risk of money laundering, fraud or sanctions exposure. Where standard CDD collects identity documents and verifies a source of funds at onboarding, EDD goes further: it requires documented evidence of wealth origin, a plausible narrative linking that wealth to observed gambling behaviour, and ongoing monitoring at a higher frequency than baseline customers receive.
The common misconception is that EDD is triggered solely by deposit volume. In reality, regulators expect operators to apply a risk-based model that accounts for multiple factors simultaneously, not just a single monetary threshold crossed in isolation.
Regulatory Threshold Signals Operators Must Monitor
While specific monetary limits vary by jurisdiction, the following categories consistently appear in regulatory guidance and enforcement decisions as EDD triggers:
- Cumulative deposit velocity: A player depositing amounts that, in aggregate over a defined period, exceed the operator's documented risk appetite without a corresponding verified income profile.
- Single large transactions: One-time deposits or withdrawals that breach a pre-set monetary threshold, typically aligned with the jurisdiction's cash reporting rules.
- Politically exposed person (PEP) status: Any identified PEP relationship requires mandatory EDD regardless of deposit size, under the Fourth and Fifth AML Directives and their national transpositions.
- High-risk country of residence or payment origin: Transactions routed through jurisdictions on FATF grey or black lists, or through correspondent banks with known deficiencies.
- Behavioural anomalies: Patterns inconsistent with declared occupation or stated income, such as loss rates that exceed what a plausible salary could sustain.
- Adverse media or sanctions hits: Any match, even a fuzzy one, against sanctions lists or credible negative news sources.
What Banking Partners Expect to See
Acquiring banks and payment processors conduct their own due diligence on operators, and they increasingly request evidence that the operator's internal EDD process is genuinely robust. In 2025, several major acquiring relationships in Europe have been conditional on operators providing the following:
- A written EDD policy with defined monetary and behavioural thresholds, signed off at board or senior management level.
- Documented case files for a sample of EDD-triggered customers, showing the evidence gathered and the risk decision reached.
- Proof that source-of-funds evidence is verified against third-party data, not simply self-declared by the customer.
- Clear escalation paths to a qualified MLRO, with records of when and how decisions were made.
- Transaction monitoring rules that have been tuned and tested, not left at vendor default settings.
Banks apply a correspondent-banking logic to operator relationships: if the operator cannot demonstrate that it has identified and managed high-risk customers properly, the bank absorbs that residual risk. Operators that cannot produce clean, auditable EDD records are increasingly finding their payment processing options reduced.
Building a Defensible EDD Framework
A defensible framework is one that holds up under regulatory inspection and satisfies banking due diligence requests without requiring weeks of manual retrieval work. The key components are:
- Threshold documentation: Write down the specific figures and triggers your organisation uses, and review them at least annually against regulatory guidance updates.
- Tiered risk scoring: Assign risk scores at onboarding and recalculate them dynamically as behaviour and transaction data accumulate.
- Source-of-wealth verification tools: Integrate payslip verification, open banking data or credit bureau checks to corroborate customer declarations efficiently.
- MLRO sign-off records: Every EDD case that proceeds to approval should carry a documented rationale from the MLRO or a delegated compliance officer.
- Audit trail integrity: Ensure your platform records timestamps, actions and decision rationales in a tamper-evident log that can be exported on request.
Regulators do not expect perfection; they expect proportionality, consistency and honest documentation. An operator that applies its own stated thresholds reliably and records its reasoning clearly is in a far stronger position than one with sophisticated software but no coherent decision trail.
The OnlineShine Perspective
From a managed-services standpoint, the operators that run into the most serious regulatory difficulties are rarely those with poorly designed systems. More often, the problem is a gap between written policy and daily operational practice. Thresholds exist on paper but are overridden informally, EDD cases are opened but not completed in a reasonable timeframe, or source-of-funds evidence is collected but not actually assessed. Closing those gaps requires both the right tooling and a compliance culture that treats EDD as a genuine risk control rather than a customer friction point to be minimised.
