What the New EU AML Rules Actually Mean for Your Data When You Play Online

On July 1, 2025, a piece of EU legislation quietly came into force that most people outside compliance departments still haven’t heard of. The Anti-Money Laundering Authority regulation. AMLA-R. Didn’t arrive with a press conference. No trending hashtag. Just a 400-page regulatory package that started applying directly to businesses across all 27 member states, including a category of platforms that handle enormous volumes of personal and financial data: licensed online operators.

This matters to anyone who cares about where their data ends up. Not because online platforms are uniquely dangerous, but because they’re one of the clearest test cases for how the EU’s new AML framework actually functions in practice. Who collects what, how long they keep it, and what your rights are when they do.

What AMLA-R Changed, and Why It’s Different From GDPR

Most privacy-conscious readers already know GDPR. It governs how companies collect, store, and process personal data. AMLA-R is something else. It governs how companies verify who you are, monitor what you do financially, and report suspicious patterns to authorities.

The two frameworks overlap, and that overlap is where things get uncomfortable.

Under AMLA-R, any platform classified as an “obliged entity”. Which includes banks, crypto exchanges, and online gambling operators with EU licensing. Must now follow a single, directly applicable rulebook rather than 27 slightly different national versions. Before July 2025, a German operator and a Spanish operator running under MGA licenses could interpret AML obligations differently. That divergence is gone.

What replaced it is a standardised requirement set that includes:

• Mandatory identity verification before any financial transaction
• Continuous transaction monitoring, not just at onboarding
• Record retention of KYC documents and transaction logs for a minimum of five years
• Risk-based enhanced due diligence for high-value or high-frequency users
• Disclosure obligations when data is shared with the EU’s new central AML authority

For users, that last point is the one worth reading twice. Your verification documents. Passport scans, proof of address, bank statements. Can now be accessed by a supranational authority, not just the platform you gave them to.

The KYC Data Trail Is Longer Than You Think

Here’s what a typical verification flow looks like under the new rules, and what gets stored at each step.

You open an account. The platform collects your name, date of birth, email, and residential address. So far, standard. But then comes document verification: a government-issued ID scan, often processed through a third-party KYC provider like Sumsub or Onfido. That scan isn’t just held by the platform. It passes through the KYC vendor’s infrastructure, is matched against liveness checks (a selfie or a short video), and logged with a timestamp.

That’s three parties holding a copy of your face before you’ve made a single transaction.

Once you’re verified and active, AMLA-R’s transaction monitoring layer kicks in. Platforms must flag patterns: deposits that cluster around reporting thresholds, withdrawals to accounts that weren’t used for deposits, frequency spikes. None of this is visible to you, but it’s being logged in real time.

Five-year retention is the floor, not the ceiling. Some jurisdictions inside the EU permit extension to seven years if a suspicious activity report has been filed. Users have no automatic notification right when that happens.

Where Licensed Platforms Differ From Gray-Market Operators

This is the part that actually matters for privacy decision-making.

Gray-market operators. The ones running without EU member-state licensing, often incorporated in jurisdictions with minimal oversight. Collect the same data. Sometimes more. But they operate outside AMLA-R’s scope entirely, which means no standardised retention limits, no mandated disclosure rules, no GDPR cross-reference obligations, and no audit trail you can invoke when something goes wrong.

Licensed operators aren’t privacy-perfect. But they’re legally accountable in ways unregulated ones aren’t. AMLA-R requires them to publish their data retention policies and KYC procedures in accessible form. That means a user can actually read, verify, and. Under GDPR. Challenge how long their data is held.

For users who want to compare platforms on this axis, EU online casinos listed on regulated review sites at least allow you to cross-check licensing status, jurisdiction, and published retention obligations before you hand over a document scan. That’s a floor most gray-market alternatives don’t offer.

Gambling carries financial risk. Play within your means. And if it stops being fun, BeGambleAware.org and 1-800-GAMBLER are there.

What the Five-Year Rule Means in Practice

Five years is a long time. Think about what changes in five years: addresses, jobs, relationships, financial circumstances. Yet your original ID scan and every transaction you made on a licensed platform sits in a compliant data store for the entirety of that period.

This isn’t unique to online operators. Banks do the same thing, and EU financial institutions have operated under five-year AML retention rules for over a decade. The difference now is that the enforcement architecture is centralised, and the cross-border data-sharing mechanisms are more direct.

If you’re the kind of reader who runs VPN checks and audits cookie permissions before registering anywhere, the practical question isn’t whether to avoid licensed platforms entirely. It’s how to engage with them in a way that limits your exposure. Separate email addresses for different services. A payment method that doesn’t tie directly to your main bank account. Reading the data retention policy before the terms and conditions, not after.

These aren’t paranoid steps. They’re the kind of operational hygiene that becomes more important as data retention periods extend and cross-border sharing becomes routine.

What Your Rights Actually Are Under AMLA-R + GDPR

The two frameworks interact in ways the regulators haven’t fully resolved, which creates some genuine ambiguity for users.

GDPR gives you the right to erasure. The right to ask a company to delete your data. AMLA-R’s five-year retention mandate overrides that right when the data in question is held for AML compliance purposes. In plain terms: you can request deletion, but the platform can lawfully refuse if they’re holding your KYC records to satisfy AML obligations.

What you do retain:

• Right of access: you can request a copy of all personal data the platform holds on you
• Right to rectification: if your data is inaccurate, they must correct it
• Right to know: the platform must tell you, in its privacy policy, that AML law overrides your erasure right and for how long
• Right to complain: to your national data protection authority if you believe the platform is retaining data beyond what’s lawful

The last one is underused. Most users never file DPA complaints, which is exactly why platforms sometimes hold data longer than necessary without challenge.

According to research published by the Future of Privacy Forum in 2024, fewer than 3% of EU consumers have ever exercised a formal data subject right, despite high awareness of GDPR in principle. Knowing you have rights and knowing how to use them are different things entirely.

The Practical Takeaway

AMLA-R isn’t going away, and the trend across EU financial regulation runs in one direction: more standardisation, longer retention, more cross-border data access. That’s true for banks, crypto platforms, and licensed online operators alike.

For privacy-aware users, the calculus isn’t “avoid all regulated platforms.” It’s “understand what you’re handing over, to whom, for how long, and what recourse you have.” Licensed platforms operating under AMLA-R give you answers to all four questions. If you know where to look for them. Unregulated ones give you none.

That’s not an endorsement of handing over more data than you need to. It’s an argument for informed engagement over uninformed avoidance.

—

Frequently Asked Questions

How long can a licensed EU platform keep my KYC documents? AMLA-R sets a minimum five-year retention period from the end of the business relationship. Some jurisdictions extend this to seven years if a suspicious activity report was filed. You won’t always be notified when an extension applies, though you can ask your national data protection authority to investigate if you suspect a breach.

Can I request deletion of my verification data under GDPR? Not while the platform has a legal AML obligation to retain it. AMLA-R’s compliance requirements override GDPR’s right to erasure for data held specifically for anti-money laundering purposes. Once the retention period expires, the standard GDPR erasure right reapplies fully.

What’s the difference between AMLA-R and the older EU AML directives? Previous EU AML rules came as directives, meaning each member state implemented them differently. AMLA-R is a regulation. It applies directly and uniformly across all 27 member states without national adaptation. That closes a lot of the compliance gaps gray-area operators used to exploit.

Does AMLA-R affect crypto platforms the same way? Yes. Crypto-asset service providers are explicitly included as obliged entities under the AMLA-R package. Exchanges, custodians, and certain wallet providers must meet the same KYC and transaction-monitoring standards as traditional financial institutions and online operators.

What can I actually do to limit my data exposure on licensed platforms? Start by reading the privacy policy before the terms of service. Specifically the retention and data-sharing sections. Use a dedicated email address. Where possible, use a payment method that creates minimal links to your core financial identity. And if you believe a platform is retaining your data unlawfully, file a complaint with your national DPA rather than assuming nothing can be done.