France’s gambling regulator, the Autorité Nationale des Jeux, has published a practical guide instructing licensed online operators on how to detect, document, and respond to player fraud. Released on Monday after consultations with operators and the gaming ombudsman, the guide clarifies compliance expectations under existing anti-fraud and anti-money laundering rules. It introduces no new legal obligations. What it does instead is tighten the operational framework operators must follow in the French market.
The regulator’s timing is deliberate. Fraud typologies have grown more sophisticated, and operators have been pressing for clarity on when corrective action holds up in court.
What the Guide Means for Operators in Practice
The document answers questions that have lingered for years: when can an account be closed, when can a balance be withheld or returned, when can a bet be cancelled or a tournament prize redistributed? For compliance teams, the value is less about new rules and more about a defensible playbook. Here is what matters for the business side.
- Operators now have a regulator-endorsed reference for the evidentiary threshold French courts expect before corrective action is taken.
- Six fraud categories are formally mapped to legal provisions and recommended responses, reducing ambiguity in enforcement decisions.
- Contractual terms, KYC protocols and fraud-detection systems will need review to align with the guidance.
- Acting on suspicion alone is no longer defensible. Proof is the standard.
- Two-factor authentication for withdrawals and banking changes is now an expected technical safeguard, not an optional one.
Six Categories of Fraud, One Framework
The ANJ identified six forms of fraud it sees repeatedly across licensed platforms: identity fraud, payment fraud and abusive chargebacks, in-game cheating, money-dumping, and the manipulation of sporting events. For each, the guide sets out the relevant legal basis and the operational steps a licensee should take.
The responses vary by threat. In identity fraud cases, operators are told to close accounts once fraud is established, and to reserve balances where bank account ownership cannot be confirmed. For account takeovers, the emphasis falls on technical mitigation: two-factor authentication applied to withdrawals and to any change of banking details. That extra step is friction, yes. It is also the difference between a recoverable incident and a drained account.
Poker draws particular attention. Where collusion or bot use is detected, the guide points to contractual provisions that let operators redistribute illegitimate winnings to the players who were cheated. French courts have upheld such redistribution, the regulator noted, but only when the operator can back the decision with robust data.
The Evidence Standard: Suspicion Is Not Enough
This is the part operators should read twice. The ANJ has drawn a hard line between suspicion and proof, and the guide walks through the kinds of evidence French courts have accepted in past litigation. The regulator uses the term faisceaux d’indices, or converging indicators: not a single smoking gun, but a cluster of signals pointing the same direction.
Those accepted indicators include IP addresses, device logs and connection timings. Individually, each is circumstantial. Stacked together, they build the kind of case that survives a legal challenge from a player whose account was closed or whose winnings were clawed back.
Which raises a harder question for operators: is their current logging infrastructure detailed enough to reconstruct that picture months after the fact? The guide encourages several concrete steps to close that gap.
- Strengthen terms and conditions to give contractual footing for corrective action.
- Maintain robust, retrievable evidence trails.
- Adopt the technical standards the regulator points to, and verify alignment with certification requirements.
- Review KYC and fraud-detection protocols end to end.
Fraud Categories and Recommended Responses
| Fraud type | Recommended operator response |
|---|---|
| Identity fraud | Close accounts once fraud is established; reserve balances where bank ownership is unverified |
| Account takeover | Enforce two-factor authentication for withdrawals and banking detail changes, alongside monitoring of unusual login patterns and device fingerprints |
| Poker collusion / bot use | Use contractual terms to redistribute illegitimate winnings to affected players, backed by data |
| Payment fraud / chargebacks | Document transaction evidence to contest abusive claims |
| Money-dumping | Apply converging indicators to identify coordinated transfers |
| Sporting event manipulation | Monitor betting patterns against known integrity signals |
Player Protection Stays High on the Regulator’s Agenda
Fraud is one front. Safeguarding is another, and the ANJ has been active there too. In July, the regulator imposed a €500,000 fine (around $572,797) on an unnamed betting operator, referred to only as Company X, for failing to identify and support customers showing signs of problematic gambling.
The investigation behind that penalty found the operator had misjudged the risk level of 29 high-risk players. Six were missed altogether. The remaining 23 were slotted into a lower risk tier than their behaviour warranted. Numbers like these tend to shape how regulators frame their next round of scrutiny.
Earlier in the year, the ANJ also ran a public awareness campaign tied to the 2026 World Cup, flagging the addiction risks that come with the surge in sports betting during a major tournament. The two priorities, fraud and safeguarding, are converging into a broader compliance expectation.
Frequently Asked Questions
Does the ANJ guide create new legal obligations?
No. The guide clarifies how existing anti-fraud and anti-money laundering rules apply, rather than adding fresh duties. In practice, though, it raises the operational bar operators are expected to meet.
What evidence do French courts expect before an operator acts?
Converging indicators, or faisceaux d’indices: IP addresses, device logs and connection timings among them. The regulator is explicit that suspicion alone will not hold up.
Can operators claw back winnings from cheating players?
Yes, where poker collusion or bot use is proven and contractual terms allow it. Courts have validated redistribution to affected players when the operator’s data is solid.
What should operators do first?
Review KYC processes, fraud-detection protocols and contractual terms against the guidance, then check that technical safeguards meet certification standards.
