iGaming & Gambling Compliance in Latvia

Latvia runs an open but closely controlled licensed market for online gambling. A licensed operator must be a Latvian-registered company, settle with players through an account at a Latvian credit institution and pay winnings only to an account that funded stakes. Unlicensed sites are blocked at domain and payment level, and players may not use them.

The State Revenue Service (Valsts ieņēmumu dienests, VID) is now the gambling licensing authority, the main gambling supervisor and the AML supervisor for the sector. The Financial Intelligence Unit of Latvia (Finanšu izlūkošanas dienests, FIU Latvia) receives suspicious transaction reports and threshold declarations.

The biggest obstacle for a new entrant is structural rather than technical: the company, capital, bank account and responsible person all have to be in place in Latvia, and the identity flow has to work with the Latvian personal code and the State Revenue Service self-exclusion interface.

1. Who regulates this sector

Cabinet Order No. 630 of 3 October 2025 merged the Lotteries and Gambling Supervisory Inspection (Izložu un azartspēļu uzraudzības inspekcija, IAUI) into the State Revenue Service with effect from 1 April 2026.

2. Licensing and authorisation

Gambling and lotteries may be organised in Latvia only under the relevant licence (Section 3(1) of the Azartspēļu un izložu likums [Gambling and Lotteries Law]). Section 44 allows slots, roulette, card and dice games, bingo, totalisator and betting to be offered online.

Company-level licence

The gambling organisation licence (Sections 8 to 19) is issued by the State Revenue Service for an indefinite term and must be re-registered every year. The applicant must be a capital company registered in Latvia with paid-up share capital of at least EUR 1,400,000. Foreign shareholders may hold no more than 49 percent of the capital, except investors from EU, EEA and OECD member states. Officers need an impeccable reputation; decisions take up to 90 days.

Interactive gambling licence

Online operation also requires an interactive gambling licence (Sections 46 to 51), which the State Revenue Service issues only to an operator that already holds the gambling organisation licence. The application includes the game rules, a Latvian credit institution account for player settlements, a certification body's opinion on system security and data protection, the server location and the web address. The service decides within 60 days. Online operation is prohibited until the service approves a responsible person.

Land-based comparison and B2B suppliers

Casinos, gaming halls, bingo halls and betting shops each need a separate location licence (Sections 26 and 27), subject to municipal restrictions. B2B suppliers creating or hosting gambling content in Latvia need a gambling services licence (Section 80.1).

3. AML, KYC and customer due diligence

Lottery and gambling organisers are obliged entities under Section 3(1)(7) of the Noziedzīgi iegūtu līdzekļu legalizācijas un terorisma un proliferācijas finansēšanas novēršanas likums [Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing, the AML Law]. Since 1 April 2026 the State Revenue Service supervises them for AML purposes (Section 45(2)(7)) and for sanctions compliance (Section 13(4.2) of the Law on International Sanctions and National Sanctions of the Republic of Latvia).

CDD triggers

Customer due diligence (CDD) is required before a business relationship, meaning one intended to be lasting (Section 1(3)), starts, on suspicion, and for any transaction of EUR 2,000 or more, including winnings, purchase of chips or tickets and currency exchange, whether single or linked (Section 11(1)(4)).

Identification data

Residents: name, surname and personal code. Non-residents: name, date of birth, photograph, document number, issue date and issuing state and authority. The document must be checked against the Invalid Documents Register (Section 12).

Enhanced due diligence

Mandatory for non-face-to-face customers unless the approved remote methods are used, for politically exposed persons (PEPs), for customers from high-risk third countries and wherever risk is elevated (Sections 22(2) and 25.1).

Retention

CDD information, payment records and correspondence are kept five years after the relationship or occasional transaction ends, extendable by up to five years at FIU Latvia's or a supervisor's request (Section 37).

Reporting

Obliged entities register in the FIU Latvia reporting system and report every suspicious transaction without delay (Section 31.4). Under Cabinet Regulation No. 550 of 17 August 2021 (point 14.5), gambling organisers file a threshold declaration for each transaction of EUR 2,000 or more in which winnings are paid or the customer is settled with, chips are bought, sold or exchanged, or an interactive gambling account is topped up or withdrawn from. Declarations are filed weekly (point 11). A documented risk assessment, internal controls and a sanctions risk assessment are also required (Section 6 of the AML Law; Section 13.1 of the sanctions law).

4. Identity verification and onboarding

Independently of AML thresholds, Section 53(1) of the Gambling and Lotteries Law requires each player to be registered, with identifying data, before being allowed to take part, and Section 54.1(4) lists the data: name, surname, personal code and date of birth, plus the number of the account from which stakes will be funded. In practice only people holding a Latvian personal code can play online, as FIU Latvia's 2026 National Risk Assessment states (point 5.14.3). Persons under 18 may not take part (Section 41(1)(6)).

Cabinet Regulation No. 715 of 5 December 2017 (point 8) gives the operator three working days after registration to verify identity and age using available identification means, and to check that the player has not excluded themselves from that operator. Only then is the player registered (point 9) and asked to choose a maximum stake per game or a maximum total stake per 24 hours (point 10). Raising the limit takes effect on the seventh day (point 13).

Approved remote identification methods

Cabinet Regulation No. 392 of 3 July 2018 lists the technological solutions that, with documented risk controls and staff training (AML Law Section 22(2)(1)), let an obliged entity identify a customer remotely without mandatory enhanced due diligence (point 7):

• a qualified electronic signature, qualified increased security electronic identification, or an eIDAS-recognised scheme;
• real-time, encrypted video identification with face comparison and live questions (point 10);
• identity data obtained from a credit or payment institution through an identification payment;
• comparison of a photograph of the identity document with an electronic selfie.

For video and document-plus-selfie methods the operator must check the document's remotely verifiable security features and perform biometric recognition and comparison (point 9). Documents need a machine-readable zone and optical security features (point 11). Bank-data and selfie methods may not be used where the customer or beneficial owner is linked to a high-risk third country or a low-tax or no-tax jurisdiction (point 12). It may be outsourced, but the operator stays responsible (point 6).

5. Digital channels: what's different

Bottom line: online play needs its own licence and a full identity, age and self-exclusion check before the first stake, while in gaming halls and betting shops visitors show ID at the door for the self-exclusion check (Section 4.1(7)) but stay unregistered until the EUR 2,000 due diligence threshold.

Closed-loop payments

Section 53(3) and (4) of the Gambling and Lotteries Law limit an interactive operator to settling with players through an account at a Latvian credit institution, and prohibit paying winnings to an account from which no stake was deposited. A breach carries a fine of 1,400 fine units (EUR 7,000) under Section 89(11), and using an undisclosed or non-compliant account is a ground for revoking the licence under Section 87(1)(10).

Blocking of unlicensed operators

Under Cabinet Regulation No. 114 of 10 March 2026, electronic communications providers must block a domain or IP address within five working days of a State Revenue Service decision, and the .lv registry must end the domain's registration. Section 44.2 of the Law on Payment Services and Electronic Money requires payment service providers to stop credit transfers to listed unlicensed operators within three working days and to refuse remote card payments by Latvian residents to unlicensed interactive operators.

Responsible gambling on screen

Cabinet Regulation No. 333 requires a link to the State Revenue Service self-exclusion page on every site, a self-exclusion reminder at each login and, from the second hour of play, a 10-second harm message whenever a new game starts (points 13, 14 and 25).

6. Data protection and biometrics

The AML Law states that processing personal data to meet its requirements is carried out in the public interest (Section 5.2(1)), which gives operators a basis for identity and due diligence data, and it allows CDD data to be processed electronically (Section 37(4)). The interactive operator controls its own player register and must give the State Revenue Service access to it (Section 54.1).

Biometric data processed to uniquely identify a person is a special category under Article 9 of the GDPR, so face matching needs an Article 9(2) condition in addition to a lawful basis. Regulation No. 392 requires biometric comparison in video and selfie identification. Remote identification evidence must be kept unaltered for the AML retention period (point 16).

Player data and account audit trails are kept for five years after the last account change (Section 54.1(7)), and the gaming system must hold game-by-game records for at least five years and protect accounts from unauthorised access (Cabinet Regulation No. 189, points 13 and 14).

7. Sector-specific obligations

National self-exclusion register

Any person may ask to be barred from all gambling in Latvia, online and land-based, and from interactive lotteries, for at least 12 months (Section 4.1). Since 1 April 2026 the State Revenue Service keeps the register. Requests can be made in person, at a venue, with electronic identification or through the link on each interactive site (Regulation No. 333, point 9). Removal is possible only in person at the State Revenue Service, no earlier than 12 months after inclusion. Failing to prevent a self-excluded or addicted player from playing carries a fine of 1,400 fine units (EUR 7,000) under Section 89(9).

Advertising and incentives

Advertising of gambling and interactive gambling sites is prohibited outside gambling venues (Section 41(5)). From 1 April 2026 licensed betting operators may display their registered figurative trademarks at adult sports events, on adult athletes' kit and in sponsorship notices, with an 18+ warning and the self-exclusion web address, but without any call to play (Section 41(5.1) to (5.3)). Free play as a gift or prize and lending to players are prohibited (Section 41(3) and (6)).

Winnings tax

The operator withholds personal income tax on the part of any winnings above EUR 3,000 paid at once or within one visit (Sections 15(24) and 17(10)(22) of the law "Par iedzīvotāju ienākuma nodokli" [Personal Income Tax Law]).

8. Risk indicators and red flags

FIU Latvia's 2024 guidance names tax offences and sports match manipulation as the main threats for online gambling. Its 2026 National Risk Assessment adds drug trafficking and illicit excise goods for the sector and finds that online operators detect suspicious transactions more effectively (points 5.14.9 and 5.14.12).

Gambling and lottery indicators (FIU Latvia)

• Structuring: regular deposits or withdrawals just below the threshold, or paying in from one account and asking for payout to another.
• Parked funds: money held in the gaming account for long periods with little or no play, then withdrawn to a bank account.
• Document fraud: forged, invalid or someone else's identity document used to open an account.
• Multi-country access: logins to one account from IP addresses in different countries.
• Foreign funding: deposits and payouts through foreign bank accounts or cards with no logical explanation.
• Third-party control: payout requested to a third party's account, or the account appears to be run by someone else.
• Group play: several customers placing identical bets while one collects the winnings and asks for proof of the win.
• Unexplained wealth: spending out of line with declared income, large transfers from third parties, or PEP status.

9. Enforcement and penalties

Gambling law fines are set in fine units of EUR 5 each (Section 16(2) of the Administrative Liability Law), imposed by the State Revenue Service (Section 90).

The State Revenue Service can suspend an interactive licence until a breach is remedied (Section 86) and must revoke it for, among other grounds, false information, taxes overdue by more than 30 days or undisclosed settlement accounts (Section 87). For AML breaches, Section 78 of the AML Law allows a public statement, a warning, a fine of up to twice the profit gained or otherwise up to EUR 1,000,000, suspension or revocation of the licence, and removal of responsible officers.

From 2023 to 2025 the inspectorate took 14 AML decisions: six warnings and eight fines totalling EUR 75,008.45 (National Risk Assessment 2026, point 5.14.8). Published decisions mostly concern weak detection of suspicious transaction indicators (a EUR 5,000 fine plus mandatory staff training for a betting operator in January 2023; EUR 2,000 fines for two operators in late 2025) and late threshold declarations; in June 2022 one operator was fined EUR 52,263.90 for customer due diligence failures.

10. Recent changes and what to watch

• 10 July 2027:[Adopted, applies 10 Jul 2027] EU Regulation 2024/1624 (AMLR) applies directly. Gambling providers are obliged entities (Article 3(3)(g)) and must apply CDD on collecting winnings or wagering stakes of EUR 2,000 or more (Article 19(5)).
• 1 May 2027:[Review due by 1 May 2027] The Cabinet must review the new sports trademark exception (Transitional Provision 36).
• 2026:[Published] FIU Latvia's National Risk Assessment for 2023 to 2025 lowered the sector's money laundering risk from medium-high to medium and recommends mandatory customer registration in gaming halls, betting shops and bingo halls.
• 1 October 2026:[Final draft, not adopted] AMLA submitted its final draft regulatory technical standards on customer due diligence under Article 28(1) AMLR to the European Commission (final report dated 30 September 2026). Draft Article 7 makes remote document-based checks a fallback, allowed only where the customer cannot reasonably present an identity document in person and has no eID means at assurance level substantial or high or relevant qualified trust service; the operator must justify the fallback and meet listed safeguards. Proposed to apply six months after entry into force.
• 1 April 2026:[In force] The State Revenue Service replaced the IAUI as licensing authority, gambling supervisor and AML supervisor; existing licences stay valid until re-registration.
• 1 April 2026:[In force] Cabinet Regulation No. 114 moved domain and IP blocking to the State Revenue Service, with a five-working-day deadline for providers.
• 1 April 2026:[In force] Cabinet Regulation No. 97 of 3 March 2026 amended the self-exclusion rules: the State Revenue Service holds the register and online requests take effect immediately.
• 1 January 2026:[In force] Gambling tax on online games rose from 12 to 15 percent of organisation revenue.

11. What this means for identity verification

• Personal code first: online registration is built around the Latvian personal code, which is also the key for the self-exclusion register query; people without one cannot open an online account.
• Verify before play: identity and age must be confirmed within three working days of registration and before the player is admitted, so there is no window for unverified play.
• Use an approved remote method: one of the four methods in Regulation No. 392, with document security checks, an Invalid Documents Register check and biometric comparison; anything else pushes remote players into enhanced due diligence.
• Re-check at every login: the self-exclusion register is queried at each session, and payouts go only to an account that funded stakes.
• Plan for July 2027: the AMLR keeps the EUR 2,000 trigger and its recitals expect operators to attribute linked transactions to a customer even before verification, so transaction monitoring and identity data need to connect from the first deposit.