for early access to the latest igaming videos!
and get the latest igaming news first!
Europe is standardizing digital identity at a speed the gambling industry hasn’t fully internalized. By 2026, EU-issued identity wallets, tougher age-checks, stricter AML/KYB, and higher liveness bars will collide with fragmented national gambling rules. Operators that treat digital identity as a compliance checkbox will lose share to those that rebuild onboarding, payments, and risk around the new trust fabric.
The quiet end of “upload your passport and wait 24 hours”
For years, European iGaming built KYC on a patchwork: document scans, database pings, and manual checks that varied wildly by country. That’s about to end. The European Digital Identity (EUDI) Regulation requires every Member State to offer at least one EU Digital Identity Wallet and obliges “relying parties”—including gambling operators in many contexts—to accept wallet-based authentication when they must unambiguously identify a customer.
What changes in practice?
- Standard rails for proof-of-age and attributes. National eIDs remain the roots, but the wallet layers a common architecture and certification regime. Expect privacy-preserving assertions (e.g., “over 18” without date of birth) to replace broad data grabs.
- Mandatory availability. With the implementing acts adopted and entering into force across waves (late 2024, May 2025, and July 2025), governments now have the rulebook to issue, certify, and list wallets; operators get a blueprint for becoming registered relying parties. There is not yet a final EU list of certified wallets—the feed from Member States is still populating—but the direction is set.
- From pilots to production. Large-scale pilots spanning public services, payments, and age-gates are moving beyond proofs of concept. Payment credentials and strong customer authentication are being designed into the wallet flow, with major schemes participating in attribute/token pilots.
For iGaming, this is not a UX nicety; it’s a control shift. The wallet promises faster onboarding with less data in your database, and it moves liability away from vendor stacks of uncertain quality toward a regulated trust framework.
The pressure isn’t only European—and it’s already changing user behavior
Summer 2025 produced a global pincer movement on identity:
- United Kingdom: The Online Safety Act now obliges “highly effective” age checks for pornographic services; Ofcom has built an enforcement playbook and can push for site blocking. Even outside adult content, mainstream platforms began rolling out UK-specific age verification flows (document upload, card check, or facial estimation). The policy shock was visible in consumer behavior, with VPN sign-ups spiking the week rules took force. For gambling, which already sits inside a mature UK compliance culture, the lesson is clear: regulatory precision + real penalties = rapid adoption.
- United States: NIST SP 800-63-4 finally landed, crystallizing expectations around remote proofing and presentation attack detection (PAD). Mobile IDs continue to go live at TSA checkpoints, normalizing wallet-based identity in daily life.
- China: The Cyberspace ID program launched a state-run, tokenized yes/no identity check designed to reduce repeated uploads while centralizing oversight. Multinationals will need modular logins that activate only for China users and live inside China stacks.
- Biometrics bar rising: iBeta’s new Level 3 PAD test tier introduces tougher artifacts and tighter error thresholds. Any facial verification used for onboarding or re-auth in iGaming that can’t withstand Level 3-style spoofs will struggle to pass audits—or the smell test after the next fraud wave.
The through-line: regulators are replacing vague guidelines with testable, certifiable controls. Vendors will either map to the new standards with evidence, or they will be sidelined.
AML is about to bite your B2B relationships, not just your players
While player KYC grabs headlines, the less discussed exposure is Know Your Business (KYB) for your counterparties: affiliates, PSPs, game studios, payment facilitators, even data providers. The new EU AML package—including the Regulation establishing AMLA—ratchets up KYB harmonization by 2026:
- Deeper UBO checks and documentation, standardized across Member States.
- Evidence requirements for source of funds/wealth where risk demands it.
- Proactive system changes in 2025 ahead of full enforceability, meaning procurement, legal, and compliance teams can’t wait until 2026 to re-paper vendors.
Combine that with existing national frameworks (e.g., deposit caps and strict ad rules in Germany; self-exclusion and affordability tooling in Sweden; land-based linkages in Belgium and Hungary; fragmented allowances in France, Poland, Austria), and cross-border scaling without identity automation becomes a margin killer.
Belgium is the canary: ad bans, IBAN checks, and identity hardening
Belgium’s Van Hecke Law changes—ban on incentives, restrictions on advertising, and stricter identity verification including bank-account matching for withdrawals—show how payments and identity are merging. Operators must prove that the IBAN receiving funds belongs to the verified player and monitor whether funds are quickly onward-transferred, a money-laundering red flag. Local eID rails such as itsme® are already being used to short-circuit password resets, reduce multi-accounting, and pull verified attributes in seconds, reactivating dormant accounts while tightening controls.
This is a preview of the wallet era: passwordless, attribute-bound sessions, reduced support load, and less personal data in motion—if operators integrate properly.
The vendor reality check: certificates over marketing
A new procurement posture is emerging:
- “On-register” or certified under the relevant framework (UK trust mark and register; EU wallet provider/relying party listings; US NIST mappings).
- Evidence of PAD performance (including Level 3-class tests) and anti-injection hardening for SDKs used on the open web and inside apps.
- Cryptographic verification for document authenticity (ICAO 9303, RFID chip reads, VDS signatures), not image heuristics alone.
- Privacy-preserving age signals available now, designed to slot into EUDI once national wallets scale.
There are strong products in the market—document readers with large template databases, face SDKs with active and passive liveness, and turnkey orchestration—but what matters to regulators in 2025–26 is verifiable conformity, not feature lists.
Payments will be pulled into identity—and that’s a competitive lever
EUDI isn’t just about age and names. Payment credential tokenization and SCA alignment are being piloted inside the wallet architecture, with card networks participating. For gambling, that opens three advantages:
- Instant, low-friction SCA tied to a high-assurance identity signal.
- Fewer chargeback disputes, since the same tokenized identity underpins the payment and the account.
- Cleaner AML trails, as withdrawals and payouts can bind to verified attributes and verified IBANs with fewer manual checks.
Operators that stitch together identity, risk, and payments will clear withdrawals faster without loosening controls—an area players rank above odds and promotions.
Action plan: how an operator can be “wallet-ready” in 180 days
No future promises—here’s what you can implement now to be on the right side of 2026.
- Map your jurisdictions and flows to the new identity stack.
- Identify where you are a “relying party” under eIDAS/EUDI and what you must accept.
- Add attribute-based age gates that work today and evolve into wallet assertions later.
- Rebuild onboarding around re-usable identity.
- Offer passwordless login via national eIDs where available; keep document fallback.
- Enforce one-to-one account binding (device integrity + face re-bind with PAD at higher risk).
- Upgrade liveness and anti-spoofing to Level 3-capable.
- Require vendor test reports; run your own adversarial tests (3D masks, high-res replays, injections).
- Instrument bona fide error rates—don’t trade conversion for a future consent order.
- Harden payments with identity.
- Implement verified IBAN matching on withdrawals; flag rapid onward transfers.
- Pilot wallet-linked payment tokens where schemes and PSPs allow.
- Industrialize KYB ahead of AMLA day-two.
- Centralize affiliate and PSP due diligence with UBO trees, sanctions screening, and adverse media.
- Bake renewal cadences into contracts; no KYB, no commission.
- Localize responsibly without duplicating tech.
- Germany: deposit caps and ad limits—tie affordability checks to identity attributes.
- Sweden/Netherlands: deep self-exclusion integration; trigger real-time blocks on identity match.
- Belgium: IBAN–identity binding and no incentive mechanics; invest in lifecycle comms over promos.
- Minimize data retention, maximize attestations.
- Store proofs and logs, not raw PII, wherever the wallet can supply a qualified attestation.
- Shorten retention to the legal minimum; automate deletion/anonymization at relationship end + 5 years.
- Prove it to auditors.
- Create a control matrix mapping each market’s rules to concrete tests: age, PAD, IBAN match, SAR triggers, record-keeping, sanctions.
- Keep evidence binders: screenshots, API logs, vendor certificates, and failed-attempt metrics.
Market consequences: winners, laggards, and a likely M&A wave
- Winners will be operators that treat identity as a product, not a policy. Expect higher conversion (instant verification, no forgotten passwords), lower support costs, faster payouts, and fewer fraud losses.
- Laggards will cling to legacy vendors without certification paths or keep bolt-on identity stacks per country, inflating costs and audit risk.
- Suppliers that can prove conformance (wallet readiness, PAD Level 3, ICAO-grade document checks, GDPR-first designs) will take share; those that can’t will be consolidated or regulated out.
The timing matters. Wallet adoption will be uneven by Member State, and national eIDs, plastic documents, and legacy logins will coexist for years. But the regulatory floor is rising, and the commercial ceiling is moving with it.
Bottom line
The EUDI wallet, tougher age and liveness standards, and stricter AML/KYB rules are not isolated reforms; they form a new trust fabric for European online commerce. Gambling sits at the center of that fabric because it touches high-risk payments, vulnerable users, and intense regulatory scrutiny. The next 12–18 months will separate operators who retrofit policies from those who re-platform identity.
If you build for wallets, certify your vendors, bind payments to identity, and industrialize KYB now, you’ll enter 2026 with faster growth and fewer regulatory regrets. If you don’t, the auditors—and your churn—will do the deciding for you.
