Open Banking in iGaming: The Compliance Trap Behind Fast Payments

The world of online gambling in Europe is currently undergoing a massive transformation in payment processing. Open Banking is the buzzword of the hour. It promises faster deposits for players, instant withdrawals, and significantly lower processing fees for operators compared to traditional credit cards. However, behind the shiny facade of efficiency lies a thicket of legal questions that many compliance teams have barely mapped out. It is about much more than just moving money from A to B. It involves access to highly sensitive account data and the question of who is actually responsible for complying with anti-money laundering regulations.

Expert Miguel Luis warns that the purely commercial view of Open Banking is too narrow. While benefits like zero chargebacks and better source of funds verification at onboarding are obvious, deep analyses at the intersection of payment services regulation, gambling regulation, and data protection (GDPR) are often lacking. Two mechanisms operate in this field: Payment Initiation Services (PIS), which trigger transfers directly, and Account Information Services (AIS), which allow access to transaction history and balances. The latter is crucial for affordability assessments but carries significant risks.

Numbers and facts

Things became particularly concrete recently in the Netherlands. The local regulator, KSA (Kansspelautoriteit), issued a requirement effective October 8, 2026, that is causing a stir. Deposits are only permitted from accounts where the registered name matches every first name and the surname on the player's ID document. This sounds simple but is a Herculean task technically. Banks often shorten first names or omit middle names, which leads to immediate failures in automated matching. Another important date is April 2026, when the Council published the final compromise texts for PSD3 and the Payment Services Regulation (PSR).

These new EU rules contain explosive potential for operations: In the future, players will be able to revoke their Open Banking authorization directly within their bank app without informing the gambling operator. If an operator relies on AIS data streams to monitor affordability and source of funds, the information flow suddenly stops. Without an infrastructure to detect such revocations immediately, operators find themselves on thin legal ice.

Background

Responsibility for compliance is divided. The Third Party Provider (TPP) providing the technical interface holds a payment services license. The gambling operator holds the casino license. Both are subject to the Anti-Money Laundering Directive (AMLD), but one side often relies blindly on the other. Miguel Luis emphasizes a central problem of accountability:

"The risk is not that AML obligations are absent. It is that both parties assume the other is carrying the primary obligation, with the result that neither applies the full standard they are each independently required to meet." - Miguel Luis, iGaming Compliance Expert

Furthermore, in July 2027, the new AMLR (Anti-Money Laundering Regulation) will become directly applicable. It clarifies that a gambling operator's obligations are not discharged by the payment provider's compliance. They are additive. Anyone thinking a verified bank account is sufficient proof for source of funds is mistaken. A bank statement shows salary, but not necessarily the full picture of wealth, such as inheritances or investments.

Why it matters for German players

For German players, Open Banking is particularly relevant because the State Treaty on Gambling 2021 (GlüStV 2021) already imposes very strict transparency requirements. Casinos licensed in Germany, appearing on the GGL whitelist, must monitor deposit limits of 1,000 euros per month via the LUGAS system. Slot stakes are also limited to 1 euro per spin. Open Banking could be a double-edged sword here. On one hand, it facilitates identity verification (KYC); on the other, it allows authorities and providers an even deeper insight into financial behavior.

Anyone playing at a GGL-licensed provider can be sure that GDPR data protection standards must be upheld. However, the discussion around PSD3 shows that data sovereignty must remain with the player. Revoking data access in a bank app could, in Germany, lead to an immediate account suspension because the provider can no longer fulfill its due diligence duties to check financial suitability. German players should therefore pay close attention to which consents they grant when using pay-by-bank services.

What it means for GGL-licensed casinos

For German online casinos with a GGL license, the development in Open Banking primarily means an obligation for technical upgrades. Strict AML rules require that the source of funds is clearly established. Using AIS data can help replace the often tedious manual submission of payslips or bank statements. However, operators must ensure they don't just receive the payment provider's confirmation but are capable of analyzing raw data regarding gambling-specific risk factors themselves. The GGL is expected to apply similar standards to the Dutch KSA regarding name-matching accuracy.