Denmark's New Gambling AML Rules Take Effect With Independent Testing Requirements
Denmark's amended Anti-Money Laundering Act took effect on 15 September 2026, requiring gambling operators to assess proliferation-financing risk and arrange independent testing of their AML controls.
Amendments to Denmark's Anti-Money Laundering Act (hvidvaskloven) entered into force on 15 September 2026, extending the compliance obligations of gambling operators licensed by the Danish Gambling Authority (Spillemyndigheden). The changes stem from Act No. 764 of 8 September 2026, adopted by the Folketing on 3 September 2026 as bill L 9 — itself a re-introduction of an earlier bill, L 116, which lapsed when a general election was called in March 2026. The legislation's stated purpose is to strengthen Denmark's compliance with FATF recommendations on money laundering, terrorist financing and proliferation financing.
For licensed gambling operators, the most significant change is a new requirement to subject AML policies, procedures and controls to independent testing — a general obligation that previously applied mainly to financial-sector entities already required to have internal audit functions. Alongside this, proliferation financing has become an explicit category in AML risk assessments, and financial-sanctions compliance must now be documented through written policies and controls. Spillemyndigheden confirmed the gambling-sector impact of the changes in a notice issued around the law's entry into force.
What Changes for Gambling Operators?
Danish gambling operators were already subject to extensive AML obligations, including risk assessments, written policies, customer due diligence and suspicious-activity reporting. The amendments do not replace that framework — they expand it. Three requirements are now explicit for covered gambling providers: proliferation-financing risk must be built into the existing risk assessment (Section 7), written policies and controls must cover both proliferation financing and financial sanctions (Section 8), and those policies and controls must be tested by an independent function (Section 8(4)). Operators should treat this as a broadening of existing obligations rather than an entirely new compliance regime.
New Focus on Proliferation Financing
The amendment inserts a statutory definition of proliferation financing into the Act, covering the provision of funds or financial services connected to the manufacture, acquisition, development, transport or use of nuclear, chemical or biological weapons for purposes that breach national law or international obligations.
This is a distinct concept from money laundering (concealing the proceeds of crime) or terrorist financing (funding ideologically motivated violence). Operators must now incorporate relevant proliferation-financing risks into their existing risk assessments, taking account of the risk factors applicable to their business model, customers, products, services, transactions, delivery channels and geographic exposure. This is not a separate customer due diligence track: proliferation-financing risk is folded into the existing risk-based framework rather than creating a standalone screening regime, and no specific statutory screening frequency has been prescribed.
Financial Sanctions and Internal Controls
Financial-sanctions compliance itself is not new — Danish gambling operators were already required to comply with applicable EU and UN sanctions regimes. The amendment expressly brings financial-sanctions compliance within the written policies, procedures and controls required under the AML framework, including the asset-freezing obligation under Section 34a(3). In practical terms, this means sanctions compliance must now be documented and integrated into the same control framework used for money laundering and terrorist financing, rather than being addressed separately. There is no confirmed new sanctions-specific reporting channel, and claims that "continuous" automated screening is now a distinct statutory requirement are not supported by the underlying legislation.
Independent Testing and Oversight
The most operationally significant change is the extension of independent testing to obliged entities — including gambling operators — that were not previously covered by this requirement.
Operators must now ensure their AML, sanctions and proliferation-financing policies, procedures and controls are tested by an independent function. This does not automatically require hiring an external auditor: an internal employee can perform the review, provided that person is sufficiently independent from the compliance function being tested and has adequate competence, assessed proportionally to the operator's size and complexity. An external expert is the fallback option, to be used only where no suitable independent function exists internally — not a universal requirement.
On timing, it's worth being precise: no fixed statutory testing interval has been established. A figure of "approximately every three years" has circulated in industry commentary, but this originates from the administrative-burden calculations in the bill's preparatory notes, not from a binding legal rule — Danish accountancy bodies have explicitly stated that detailed requirements on testing frequency and scope remain unsettled. Operators should not treat three years as a compliance deadline. Questions also remain open — including among professional bodies consulted during the legislative process — about exactly what qualifies someone as sufficiently "independent" or as an "external expert" for these purposes; further guidance from Spillemyndigheden is expected but had not been published as of the law's entry into force.
Who Is Affected?
The amendments apply to gambling providers already covered by the Anti-Money Laundering Act, which generally includes licensed online casino operators, online betting operators and land-based casinos — the latter cannot be exempted from AML coverage under the Act's proportionality provisions. Certain lower-risk activities, such as specific lottery categories and non-commercial poker offered under separate legislation, fall outside the Act's scope through existing exemptions unrelated to this amendment. Coverage of affiliates, marketing partners and B2B software suppliers is not clearly established by the amendment and should not be assumed; the changes affect the obligations of entities already in scope rather than the underlying scope definition itself.
What Happens if Operators Do Not Comply?
Spillemyndigheden supervises gambling operators' compliance with the AML Act through risk-based inspections and can issue reprimands, corrective orders, or refer serious or repeated breaches to the police. The regulator is required to publish its supervisory reactions and sanctions under the AML Act, and separately publishes fines and convictions under Denmark's gambling law. Fines for intentional or grossly negligent violations are calibrated under existing corporate-liability principles. Licence conditions can be tightened following a sanction where necessary to prevent further violations, but this is a discretionary step tied to a specific enforcement action — not an automatic consequence of non-compliance. No evidence indicates that Act No. 764 created a new, gambling-specific penalty distinct from the AML Act's existing enforcement framework.
Why the Change Matters
Denmark has linked the reform explicitly to FATF compliance, citing FATF Recommendation 1 on risk assessment in the bill's preparatory materials. The EU's own AML Regulation (2024/1624) — a directly applicable regulation rather than a directive requiring transposition — generally applies from 10 July 2027, and Danish professional bodies treat full alignment with that regulation as a separate, future legislative exercise rather than something this Act accomplishes. Act No. 764 is better understood as a Denmark-specific, FATF-driven step that happens to precede the EU's broader timeline, rather than as implementation of the EU regulation itself.
Conclusion
From 15 September 2026, Danish gambling operators need to ensure their AML, counter-terrorist-financing and sanctions-control frameworks explicitly address proliferation-financing risk, maintain documented policies and controls covering financial sanctions, and arrange for independent testing of those controls — through a sufficiently independent and competent internal function where one exists, or external expertise where it does not. The underlying AML obligations are not new, but the documentation and independent-oversight expectations placed on operators have measurably increased, with some practical details — including testing frequency and qualification standards — still awaiting formal guidance from Spillemyndigheden.
For more on Denmark's regulatory framework, see Level.casino's Denmark country page.
