MGA Urges Stronger Online Gambling Self-Exclusion Rules

Malta’s gambling regulator has instructed online operators to reinforce their self-exclusion controls after a covert compliance review uncovered cases where barred players were still able to open accounts and continue playing under related brands.

The findings emerged from a regulator-led “mystery shopping” exercise carried out in 2025, designed to test how effectively player protection tools work in real-life conditions rather than on paper.

Review covered 20 licensees and 58 websites

The thematic assessment examined 20 licensed operators across 58 active websites in the online sector. Land-based venues were not part of the project.

The main objective was to determine whether self-exclusion — a mechanism that allows individuals to block themselves from gambling services for a fixed or indefinite period — remains effective when customers attempt to access other brands operating under the same corporate license.

The authority launched the review after receiving repeated complaints suggesting that some individuals who had self-excluded were still able to sign up, deposit funds and play elsewhere within the same licensed group.

While the regulator described the overall compliance level as generally positive, it identified recurring weaknesses that require corrective action. Operators concerned have been asked to submit formal remediation plans and can expect further supervisory follow-up.

Cross-brand loopholes raise concern

One of the most significant issues involved identity recognition across sister brands. In several cases, operators failed to detect that a newly registered account shared identical or substantially similar personal details with an already self-excluded individual. As a result, access was not blocked.

The authority stressed that licensees must maintain reliable detection systems capable of identifying such overlaps and preventing excluded customers from re-entering through alternative websites under the same license structure. The review focused specifically on business-to-consumer online operations and group license holders.

Delays and early reversals

The regulator also highlighted operational shortcomings unrelated to cross-brand access. Two operators did not close accounts within 24 hours after receiving a self-exclusion request via email. The authority reiterated that action must be taken without delay and that any timeframe exceeding 24 hours does not meet its standard of immediacy.

Another case involved the premature removal of a self-exclusion at a player’s request, without respecting the mandatory cooling-off period required under Maltese regulations. Current rules stipulate minimum waiting periods before an exclusion can be shortened or revoked, depending on whether it was set for a definite or indefinite term.

“Reality Check” alerts need improvement

The review also assessed the effectiveness of on-screen “Reality Check” reminders — pop-up notifications designed to inform players about time spent and money used during a session.

Six of the 20 licensees examined were found to have incomplete or insufficient information displayed in these alerts. Regulations require that such notifications temporarily pause gameplay and clearly present session data, including duration and financial outlay.

Sector remains economically significant

In a separate interim performance update, the authority reported that gaming contributed €714.4m in gross value added during the first half of 2025, accounting for 6.5% of Malta’s total GVA.

Despite the sector’s economic importance, the regulator made clear that commercial performance does not diminish the need for robust safeguards.

Industry urged to raise standards

Concluding its review, the authority framed the exercise as an opportunity for improvement rather than punishment. It called on operators to treat compliance not as a box-ticking exercise but as an ongoing responsibility toward consumer protection and operational integrity.

The authority is expected to keep the matter under review to make sure the shortcomings are actually fixed and that self-exclusion does what it is supposed to do — block access across all related sites operating under the same license.

The update comes not long after another case involving Malta, when local authorities declined to enforce a court ruling from Austria that had ordered funds to be repaid to a player — a decision that also sparked debate about cross-border enforcement.