Open Banking is gaining traction across the European iGaming sector, with operators rapidly integrating pay-by-bank solutions to deliver faster transactions, lower fees, and improved source of funds verification. While the commercial incentives are clear, a detailed analysis of the compliance implications is still largely missing from industry conversations.
Complex Regulatory Landscape for Open Banking
Open Banking in iGaming operates through two core mechanisms: Payment Initiation Services (PIS), which enable direct player-to-operator bank transfers, and Account Information Services (AIS), which provide access to players' bank data for affordability and source of funds checks. Both are regulated under the EU's PSD2 framework, with licensed Third Party Providers (TPPs) handling the payment services aspect, not the operators themselves. This division of regulatory responsibility introduces new compliance complexities, especially as operators may not have full visibility or control over critical parts of the transaction process.
Upcoming Regulatory Changes and Market Impact
The forthcoming Payment Services Regulation (PSR) and PSD3, with final compromise texts published by the Council in April 2026, will further reshape compliance requirements. One significant change is that players will be able to revoke Open Banking authorisation for a specific merchant directly from their bank app, potentially cutting off data access used for ongoing affordability and source of funds checks. Operators must therefore develop monitoring tools and response protocols to manage these interruptions and ensure compliance continuity.
Specific National Requirements: The Dutch KSA Example
The Dutch gambling regulator (KSA) recently introduced a rule requiring the name on a player's bank account to exactly match the name on their identity document, effective from October 8, 2026. This mandates technical solutions that can verify name matches at the point of payment initiation, not just during onboarding. Operators must ensure their TPPs provide bank account data in a format suitable for precise matching, highlighting the need for close collaboration and robust data handling processes.
Why This Matters for Industry Stakeholders
For operators and affiliates, these developments signal a shift toward more stringent compliance obligations that extend beyond commercial considerations. The ability to monitor consent status, manage data flows, and adapt to varying national requirements will be essential for maintaining regulatory approval and market access. Suppliers and TPPs must also ensure their solutions provide the necessary data transparency and interoperability to support these compliance needs.
Data Protection and AML Considerations
Open Banking's integration with iGaming brings GDPR and AML considerations to the forefront. Operators must distinguish between consents for payment initiation and ongoing data use, ensuring each is properly documented and justified. Both TPPs and operators have AML duties, and there is a risk that each assumes the other is fulfilling the primary obligations. Clear delineation of responsibilities and robust frameworks are required to avoid regulatory gaps.
Key takeaways
- Open Banking adoption in iGaming is outpacing compliance planning, especially in data and consent management.
- Upcoming EU regulations and national requirements like those from the Dutch KSA demand new technical and operational responses.
- Operators and TPPs must clarify AML responsibilities to ensure all obligations are met.
- GDPR compliance is critical, with a need for separate consents and clear data handling protocols.