AML Retention vs Your Erasure Request: A Legal Deep-Dive

Close a casino account and ask for your data to be deleted, and you will almost certainly hit a wall built from anti-money-laundering rules. The wall is real, but it is narrower than most people assume. A deletion request is not all-or-nothing: financial and identity records usually have to stay for five years after closure in most licensing jurisdictions, while marketing consent and behavioural profiling data are typically separable and can be erased on request. The trick is knowing which is which, and how to ask for the right thing.

What anti-money-laundering law actually requires after closure

Licensed operators are obliged to keep records that let a regulator reconstruct a customer’s activity long after the relationship ends. In practice this means identity documents, proof of address, source-of-funds evidence, transaction histories and the internal risk assessment attached to the account. The retention clock does not start when you open the account; it starts when the relationship ends, which is why a closed account can still sit in a compliance archive for years.

The five-year figure is the common baseline across most licensing jurisdictions, including the UK regime overseen by the United Kingdom Gambling Commission. Some records are held longer if there is an open investigation, a dispute or a suspicious activity report. That is the legal basis operators cite when they refuse a deletion request, and in the narrow band of financial records it is a legitimate refusal rather than an excuse.

The myth worth killing is that AML retention freezes everything. It does not. The obligation attaches to specific categories of records needed for financial crime purposes, not to every byte the operator ever collected about you. A marketing preference, a behavioural profile built for bonus targeting, a device fingerprint used for advertising attribution: these are usually outside the AML perimeter and can be dealt with separately.

Separating compliance records from marketing and profiling data

When you send an erasure request, the operator runs it against its data map. Compliance data gets flagged as retained; everything else should be assessed against the lawful basis it was collected under. Marketing data relies on consent or legitimate interests, and consent can be withdrawn. Profiling data used to personalise offers or segment customers for retention campaigns is generally not required for AML purposes.

This is where most requests fail on procedure rather than law. A blanket “delete everything” email gets a blanket refusal citing AML, and the customer assumes the argument is lost. A better request names the categories: withdraw marketing consent, request erasure of profiling and analytics data, and ask for confirmation of which categories are being retained and under what legal obligation. That framing forces the operator to answer the separable question instead of hiding behind the compliance one.

There is a practical wrinkle for grey-market brands. CasinoLab, for example, operates entirely in euros and publishes no licensing information, which makes it hard to identify the retention regime it claims to follow. It also lacks a United Kingdom Gambling Commission licence and does not integrate GAMSTOP, so a UK customer cannot rely on the same regulatory backstops that apply to a licensed UK operator. That does not remove data protection rights, but it makes enforcement slower and more dependent on the jurisdiction the operator actually answers to.

What a workable erasure request looks like

Treat the request as a structured instruction rather than a complaint. You want a paper trail that identifies each category and the basis on which it is kept or deleted.

• State your account identifier and the registered email address, plus the date you closed the account.
• Withdraw marketing consent explicitly and ask for suppression of your contact details for marketing purposes.
• Request erasure of behavioural profiling, analytics and advertising attribution data.
• Ask the operator to confirm in writing which records are retained, for how long, and under which legal obligation.
• Ask for the name of the data protection officer or the compliance contact handling the request.

Keep the reply. If the operator refuses everything without distinguishing categories, that refusal is itself useful evidence in a complaint to a data protection authority. The strongest cases are not about whether AML retention exists; they are about operators applying it to data that has nothing to do with financial crime.

Account access, verification holds and what closure really means

Retention questions often surface at the worst moment: a customer tries to log back in to retrieve statements or chase a pending withdrawal and finds the account locked. A verification hold affects withdrawal review long before closure, and an unresolved hold can delay or block the closure process itself. Operators are reluctant to delete anything while a compliance review is open, which is why timing matters.

Access mechanics are a separate frustration. A CasinoLab login requires the registered email address and password, and browser autofill causes a fair share of login failures when a saved password has been changed elsewhere. The brand runs in a phone browser without an app, so there is no app store update to blame and no app-level session to clear. If you are trying to reach an account before closing it, clear saved credentials and type them manually at https://casinolab-online.uk/login/ before assuming the account is gone.

One-account rules add another layer. CasinoLab limits accounts to one per person, household and device, so a customer who tries to reopen after closure may find the old record is what blocks a new registration. That retained identity record is exactly the kind of data the AML rules require, and it is also why “just delete me and I will start again” rarely works.

Bonus and promotional data sit in an awkward middle. A code like WELCOME2026 is a marketing artefact, and the record of who claimed it can be retained for fraud prevention even after the promotional profile is erased. The distinction is purpose: records kept to prevent bonus abuse can survive, while records kept to target you with future offers should not.

Mirror sites, payment methods and the paper trail

Customers locked out of a primary domain sometimes search for mirror sites, which creates a second problem. A mirror is not a new account and does not reset retention; it usually routes to the same back end, and logging in through one leaves the same audit trail. The safer route is customer support, in writing, with a clear request tied to your account identifier.

Payment methods leave their own trail outside the operator’s control. Card processors, e-wallets and banks retain transaction records under their own obligations, so erasing the casino’s marketing data will not erase the payment history held by a third party. When you map what can and cannot be deleted, include the payment chain in the picture.

For readers comparing brands, the Casino Lab UK search results mix licensed and unlicensed operators, and the retention regime follows the licence. Casino Lab 2 and similar names may share branding but not necessarily the same compliance posture. Check the licence, check whether GAMSTOP applies, and check whether deposits are held in euro (EUR) or sterling, because the currency often hints at the regulator the operator actually answers to.

Sportbook, slots and live tables all generate behavioural data, and that data is the most separable part of the archive. If your goal is to stop being profiled and marketed to, the erasure request should target those categories directly rather than asking for the impossible deletion of your transaction history.

The practical path is to close the account in writing, confirm the closure date, then send a categorised erasure request that withdraws marketing consent and targets profiling data while accepting that financial records will be held for around five years. Ask for a written breakdown of what is retained and why, keep every reply, and escalate to the relevant data protection authority if the operator refuses to separate the categories. That approach respects the AML rules without letting them swallow rights that were never part of the bargain.