An Estonian gambling licence application is assessed on the operator's games and platform, but also on how it protects players and prevents money laundering. The player protection procedures and the AML/CFT rules are written documents the authority reads, and later checks in supervision. This guide explains what they must cover and what our two add-ons for a gambling licence deliver.
The guide is general information, not legal advice. Gambling licences are decided by the competent Estonian authority; nobody can guarantee them.
What must responsible gambling procedures cover?
- Age and identity verification — gambling is prohibited for persons under the age limit; remote players are identified before they can play or withdraw;
- self-exclusion — players can restrict their own gambling, and operators must check the national register of restricted persons and honour it;
- limits — deposit, loss and session limits that players can set, and their effect;
- reality checks — reminders that show players how long they have been playing and what they have spent;
- indicators of problem gambling — how the operator detects risky behaviour and intervenes;
- a complaints procedure for players, so that disputes are registered and answered;
- advertising — the restrictions on gambling advertising and bonuses;
- staff training and records.
Our responsible gambling and player protection procedures (from €2,300) turn these into operating procedures that match your platform and are consistent with the rest of the application.
Who needs these procedures
Every applicant for an Estonian gambling activity licence needs them, whether the operator runs online games of chance, sports or totalisator betting, games of skill or a land-based venue. The procedures are read once at the application stage and then checked again in supervision, so an already-licensed operator that changes its platform, adds a new game type or starts serving a new market should review and update them too, not only a first-time applicant. See the Estonian gambling licence for who needs the licence itself.
The Estonian system has two layers: the activity licence, which these procedures accompany, and a separate operating permit for each specific game or platform. Player protection and AML/CFT documents belong to the activity-licence stage; the operating permit is a later, narrower application about the particular game.
How the procedures are prepared
- We review the games, the platform and the markets the operator plans to serve, since a sports betting site, a casino platform and a land-based venue each raise different player-protection questions.
- We draft the player protection policy covering the points above, using the wording and structure the authority expects.
- We match the policy to the operator's AML/CFT rules and to the rest of the licence application, so that the documents describe the same business consistently.
- The operator reviews and approves the final procedures before they are filed with the application.
The procedures are written to be operated, not only filed: age and identity checks, the self-exclusion register check, limits and reality checks must actually run on the platform once the licence is granted, because supervision checks the documents against practice.
AML/CFT rules for a gambling operator
Gambling operators are obliged entities under the Money Laundering and Terrorist Financing Prevention Act. They need a business-wide risk assessment, internal rules for customer due diligence and enhanced due diligence, a customer risk scoring methodology, sanctions screening, monitoring of deposits and withdrawals, reporting to the Financial Intelligence Unit, a compliance officer and staff training, and record keeping. The AML/CFT internal rules, risk assessment and procedures (from €3,200) deliver the complete set, and the same package serves payment and e-money institutions. Our guide to AML rules and safeguarding for licensed companies covers the AML/CFT documents in more depth.
Common mistakes
- Treating the policy as paperwork only. Procedures that are not actually implemented on the platform lead to findings in supervision, even after the licence is granted.
- Assuming the package certifies the gaming software. It does not — certification of the games and the platform is carried out by an accredited testing laboratory, at a separate cost, and is not part of this add-on.
- Expecting us to act as the compliance officer. The AML/CFT compliance officer and MLRO must be the operator's own appointee, assessed by the authority; we write the framework and train the team on it, we do not take on the role.
- Writing AML rules that do not match the actual product. A sportsbook, a casino platform and a land-based venue carry different money-laundering risks, and generic wording is a common reason for follow-up questions from the authority.
- Leaving advertising and bonus terms out of the policy. Gambling advertising and bonus offers are restricted, and the player protection procedures should state how the operator keeps its marketing within those limits, not only how it treats players once they have signed up.
Where these fit in the application
Both documents are ordered together with the gambling activity licence (from €23,000). See the Estonian gambling licence for the licence itself and state fees and capital for the costs paid to the state.
What you receive — and what is not included
- player protection procedures ready for the application and for operation;
- AML/CFT rules and the risk assessment for a gambling operator.
Not included: certification of the gaming software and platform by a testing laboratory, the technical implementation of the procedures on the platform, screening software, and the day-to-day work of the compliance officer. State fees and gambling tax are paid separately.
The amounts are our fees for the standard scope; no VAT is added; state fees and gambling tax are paid separately. All communication takes place by email.
Ready to start? Choose the gambling activity licence; the responsible gambling procedures arrive ticked. Order.
Official sources
The laws this article names, each linked to its official text, as read on 9 October 2026. For the Estonian acts we read the English translation in Riigi Teataja (opens in a new tab); the legally binding text is the Estonian one.
- Money Laundering and Terrorist Financing Prevention Act (opens in a new tab) — Riigi Teataja (opens in a new tab), English translation
To see which of our services your company needs, open the Business Navigator.
Frequently asked questions
What must responsible gambling procedures cover in Estonia?
Age and identity verification, self-exclusion and the check of the national register of restricted persons, deposit and loss limits, detection of problem gambling and intervention, advertising restrictions, staff training and records.
Are gambling operators subject to AML rules?
Yes. Gambling operators are obliged entities under the Money Laundering and Terrorist Financing Prevention Act and need a risk assessment, customer due diligence rules, monitoring, reporting to the Financial Intelligence Unit and record keeping.
Related guides
More on this topic: Licensed companies.