Facts on regulation
Laws, Requirements, and the New Meaning of “Reasonable Measures”
A global overview of how 2020–2025 reforms tightened—but did not fully settle—the meaning of “reasonable measures” for licensed operators and their suppliers, and how layered rules on gambling, AML, sanctions, privacy, and marketing now define the real room for manoeuvre
Intro
Since 2020, the idea of “reasonable measures” in online gambling has expanded from basic age checks and reactive controls to a dense web of obligations: risk‑based KYC and AML under EU and national rules, sanctions and access controls, data‑heavy monitoring for safer gambling, and stricter marketing standards to protect children and young adults. At the same time, privacy and data‑protection laws such as GDPR constrain how far profiling, geolocation, and retention can go, and each jurisdiction builds its own stack of rules on top of shared risks. The result is a moving target: regulators have narrowed what is acceptable, but the exact line of what counts as “reasonable” still depends heavily on where the player sits—and which regulator is asking the question.
Many roads to "reasonable": regulators are narrowing the range of acceptable approaches, but each jurisdiction still charts its own route.
From policies to proof of systems
A decade ago, many online operators met their obligations with static policies, basic age and ID checks, and reactive responses to clear red flags.
Today, the same term —“reasonable measures”— typically implies risk‑based KYC, sanctions screening, continuous behavioural monitoring, detailed logging and retention rules, tested intervention processes, and the ability to demonstrate all of that to regulators in multiple jurisdictions.
Regulators have become more explicit about this shift.
In Great Britain, the Gambling Commission's remote customer interaction requirements require effective systems to identify risk, take action and evaluate the results. The government's 2023 White Paper set out proposals for further reform; it was not itself a set of enacted licence conditions.
Sweden’s Gambling Authority describes reasonable measures as a duty of care that requires licence‑holders to monitor behaviour, assess individual risk, and act in a way that is appropriate and proportionate to that risk.
The EU's 2024 AML package provides for a more harmonised framework. Existing national AML duties continue to apply in the meantime: the new AML Regulation generally applies from 10 July 2027.
From the industry side, Eric Frank, now CEO of Integrity Compliance 360 (formerly Odds On Compliance), has argued that stricter AML and KYC measures are rapidly becoming the standard, with operators treating robust safeguards as part of their long‑term licence to operate rather than a box‑ticking exercise.
Mapping out the layers: "reasonable measures" are built like a multi‑tier cake, with gambling, AML, sanctions, privacy, marketing and other rules all needing to fit together in a workable system.
Drawing the map: layers of “reasonable measures”
To understand what reasonable measures mean in practice, it helps to view them as a stack of overlapping rule‑sets that apply, to different degrees, in every regulated iGaming market.
Gambling and safer‑gambling law – National gambling acts, licence conditions and technical standards define duties of care, mandatory tools (limits, self‑exclusion, reality checks) and, increasingly, expectations for real‑time monitoring of behaviour.
Marketing and youth‑protection rules – Statutes and advertising codes restrict content, bonuses, and sponsorships, especially around minors and young adults, and require “socially responsible” messaging and prominent risk information.
AML, CFT, and sanctions regimes – Existing national laws impose financial crime controls, with their scope depending on the business and jurisdiction. The EU's new AML Regulation adds a harmonised framework generally applicable from 10 July 2027; its adoption in 2024 did not make every provision immediately applicable.
Criminal law on money laundering and fraud – Harmonised at the EU level by AMLD6 but implemented nationally, these rules define offences and liability when AML controls fail or are knowingly circumvented.
Cybersecurity and operational-resilience rules – NIS2 applies to specified sectors and entity types. Gambling operators are not automatically covered simply because they provide gambling services. Relevant suppliers, such as cloud or managed-service providers, may fall within its scope; the applicable entity category and national rules must be checked.
Privacy and data‑protection law – GDPR and equivalent frameworks constrain profiling, geolocation, and retention, requiring operators to show that data‑intensive AML and safer‑gambling systems are necessary and proportionate.
Territorial and market‑access rules – EU internal‑market jurisprudence, national licensing models, and, in North America, state or provincial statutes define who may offer what, from where, and under which technical and hosting conditions.
Soft‑law and industry standards – Non‑binding pan‑European AML guidelines, responsible‑gambling standards, and payment‑scheme rules shape regulators’ expectations of good practice, even where they are not formally binding.
“Reasonable measures” today sit at the intersection of these layers: in any given market, the operative definition is the particular combination of gambling and marketing rules, AML and sanctions duties, security and privacy requirements, and territorial constraints that apply to a given product and business model.
Global data flows and fragmented rulebooks
How the layers differ by jurisdiction
The common layers are assembled differently across key markets, which is why doing “everything right” in one jurisdiction does not guarantee that the same system will be considered reasonable somewhere else. The following are a few examples.
United Kingdom
In Great Britain, the Gambling Commission's licence conditions and codes set binding requirements for customer protection, including systems to identify risk and act on it. The 2023 White Paper set out reform proposals requiring separate implementation. The scope of financial crime rules also matters: the Money Laundering Regulations cover remote and non-remote casinos, while other gambling businesses have obligations under the Proceeds of Crime Act and applicable licence conditions. Recent enforcement makes clear that minimal checks are no longer acceptable. Marketing codes restrict content likely to appeal to children or young adults and demand prominent risk messages, making promotional strategy part of the reasonable‑measures discussion. For UK‑facing operators, reasonable measures therefore describe an integrated system of financial and behavioural monitoring, controls on advertising, and unmistakable evidence that interventions are timely and effective.
Sweden and the broader EU framework
Sweden illustrates how EU‑level rules combine with national choices. Duty‑of‑care guidance from the regulator expects continuous monitoring of play, individual risk assessments, and proportionate interventions. Several separate legal developments need to be distinguished. Sweden's 2025 sanctions Act implements the EU's April 2024 directive and defines sanctions offences. The September 2025 memorandum Ds 2025:23, by contrast, proposed changing the territorial scope of gambling law to focus on participation from Sweden, with a proposed start date of 1 January 2027. It proposed effective measures to prevent participation from Sweden for operators seeking to remain outside that scope. A gambling-law proposal is not an enacted, universal obligation to use automated sanctions screening or VPN detection. Data processing must separately comply with GDPR requirements, including a lawful purpose, data minimisation and appropriate security. Any NIS2 obligations depend on whether the particular entity falls within its scope. Neither framework should be presented as one uniform technical checklist for all gambling businesses.
Ontario and selected US states
In Ontario and many US states, territorial and hosting rules are unusually important. Licences often require in‑state servers, state‑specific technical standards for logging, backups, and disaster recovery, and regular reporting to local regulators. AML and responsible‑gambling frameworks expect programme‑based controls, including ongoing monitoring, defined safer‑gambling tools, and clear escalation procedures for suspicious or harmful activity. Marketing rules and league or regulator‑driven standards add further constraints on how bonuses, odds, and sponsorships can be promoted. For operators and infrastructure providers, reasonable measures here include not only KYC and monitoring but also demonstrating that systems are physically and logically aligned with each state or province’s rulebook—exactly the fragmented reality highlighted in the interview with Rickard Vikström.
Reasonable measures as a team sport: modern compliance brings legal, risk, technology and operations around the same table.
Where this leaves “reasonable measures”
Across these examples, the direction of travel is consistent even if the local layers differ. What counted as reasonable a decade ago—static policies, basic checks, and largely reactive interventions—would now be viewed as inadequate in most regulated markets.
Today, regulators and industry standards converge on a definition that involves risk‑based KYC, sanctions screening, continuous monitoring of behaviour and transactions, structured safer‑gambling tools, detailed logging and retention, and governance that can withstand scrutiny across multiple jurisdictions.
At the same time, privacy, security, and territorial rules place real limits on how far that expansion can go, ensuring that “reasonable measures” remains a standard to be interpreted rather than a fixed checklist.
Further reading & Key Sources
High stakes: gambling reform for the digital age (UK Government, 2023) – https://www.gov.uk/government/publications/high-stakes-gambling-reform-for-the-digital-age
Navigating the EU AML package: implications for online gambling service providers – https://www.twobirds.com/en/insights/2025/germany/navigating-the-eu-aml-package-implications-for-online-gambling-service-provider
EGBA: Pan-European anti-money-laundering guidelines for online gambling (6 March 2023).
Correction, 14 October 2026: We clarified the scope of NIS2, separated Sweden's gambling-law proposal from its sanctions legislation, and distinguished existing duties from the application dates of the EU's new AML framework. We also corrected the description of the UK White Paper and casino-specific AML rules, updated the EGBA source reference and removed unfinished series links.