Brussels has never passed a single gambling law, and it isn’t about to start now.
That absence of EU-wide legislation is often mistaken for a lighter regulatory touch. It is, if anything, the opposite. The lack of a harmonised framework has left operators serving EU online casinos navigating twenty-seven separate national regimes, each with its own licensing authority, tax structure, and compliance obligations, loosely bound together by general EU principles on data protection and the free movement of services rather than any sector-specific rulebook. For operators, that patchwork is now the single biggest determinant of where expansion is worth the cost.
Why There Is No Such Thing as an EU Gambling License
The European Commission has been explicit on this point for over a decade: gambling regulation remains a national competence, and Brussels’ role is limited to ensuring member states’ individual rules don’t conflict with broader EU treaty principles. The Commission closed its last open infringement procedures in the gambling sector back in December 2017 and has shown no appetite to revisit direct legislative harmonisation since.
Join The European Business Briefing
New subscribers this quarter are entered into a draw to win a Rolex Submariner. Join 40,000+ founders, investors and executives who read EBM every day.
Subscribe
What exists instead is a set of adjacent frameworks that touch gambling without directly regulating it: GDPR governs how operators handle player data, the EU’s Anti-Money Laundering Directives set baseline KYC obligations, and a voluntary technical standard — EN 17531, adopted by the European Committee for Standardisation in 2021 — offers a common reporting format that national regulators can choose to adopt when supervising operators. None of these amount to a license an operator can use to trade across the bloc. Each national market still requires its own separate application, its own compliance build-out, and often its own dedicated local entity.
Malta’s De Facto Role as a Base License
The Malta Gaming Authority occupies a distinctive position in this landscape without technically being an EU passporting license in the way financial services licenses often work. Malta’s relatively efficient application process, established legal precedent, and comparatively predictable tax treatment have made it the default jurisdiction for operators establishing an EU foothold, even though an MGA license alone does not grant legal access to markets like Germany, France, or Italy. In practice, most serious operators treat Malta as a foundational license — proof of a baseline compliance standard — layered underneath whatever combination of national licenses their expansion plan actually requires.
That layering is expensive. Industry estimates suggest the true annual cost of maintaining a Maltese license, once ongoing compliance obligations are factored in rather than just the headline fee, runs several times higher than the published license cost alone.
The National Patchwork in Practice
Germany, Italy, France, and Spain each illustrate a different regulatory philosophy, and the differences matter directly for market-entry planning.
Germany’s Gemeinsame Glücksspielbehörde der Länder (GGL) runs one of the strictest frameworks in the bloc. Players face a €1,000 monthly deposit cap across all licensed platforms combined, slot stakes are capped at €1 per spin, and the regulator holds meaningful enforcement power, including payment-blocking orders against unlicensed operators. Industry estimates put unlicensed activity at between 25 and 50 percent of German online gambling volume, a gap regulators attribute less to player defiance and more to a legal market that many operators and players alike consider commercially unattractive relative to the restrictions attached to it.
Italy has moved toward consolidation rather than restriction. A nine-year online license now costs roughly €7 million, paired with a 25 percent tax on gross gaming revenue — a structure explicitly designed, according to regulatory commentary, to favour large, well-capitalised operators over smaller entrants. Italy has also begun reversing its 2018 ban on gambling sponsorship in sport, with a new Sports Decree under discussion that would permit sponsorship again under conditions including a proposed 1 percent levy on sponsorship revenue.
Sweden, by contrast, opened its market to competition back in 2019 under Spelinspektionen but is tightening sharply in the other direction for 2026: from April, operators will be banned from accepting deposits funded by credit cards, overdrafts, personal loans, or buy-now-pay-later services, making Sweden the first EU market to prohibit gambling on credit outright.
Comparing the Compliance Burden Across Key Markets
Malta functions as a foundational, comparatively efficient license that most operators treat as a baseline rather than a market-access solution on its own. Germany imposes hard deposit and stake caps alongside some of the bloc’s most assertive enforcement tools. Italy has priced its license deliberately high to concentrate the market among larger operators. Sweden is moving toward being the strictest market on payment methods specifically, even as its licensing process itself remains relatively open. None of these four approaches resembles the others closely enough that a compliance framework built for one transfers cleanly to the next.
What the Black Market Data Reveals About the Cost of Fragmentation
The scale of unlicensed activity gives the clearest sense of what fragmentation actually costs the legal market. A November 2025 report commissioned by the European Casino Association found illegal operators generated an estimated €80.6 billion in 2024, accounting for roughly 71 percent of the EU’s total online gambling market by that measure, with an estimated 81 million Europeans using unregulated platforms lacking basic consumer protections. That figure prompted seven national regulators — Austria, France, Germany, Great Britain, Italy, Portugal, and Spain — to sign a joint statement in November 2025 committing to shared enforcement measures, including coordinated payment-blocking referrals to card networks and stronger cooperation on disrupting unlicensed platforms.
The UK’s Gambling Commission has been particularly active on this front, making its first payment-blocking referral to Visa in January 2025 before extending similar measures to Mastercard and digital wallet providers later in the year. Search engine referrals, according to regulatory commentary, have proven to be the single most effective enforcement lever so far, ahead of payment-level interventions.
Toward Quiet Harmonisation, Not a Single Law
Industry figures tracking the sector describe 2026 as a year of gradual convergence rather than dramatic legal change. Rather than a single EU gambling directive, the more likely path runs through shared technical standards — common definitions of harm markers, aligned reporting formats, and closer supervisory cooperation between national regulators. Dr. Wulf Hambach, a lawyer specialising in the sector, has pointed to financial services as a cautionary parallel: early EU frameworks in that industry relied on minimum harmonisation and mutual recognition, assuming shared rules alone would produce consistent outcomes, an assumption that didn’t fully hold up in practice.
Voluntary standards, once supervisors build their internal processes around them, tend to become de facto requirements regardless of their formally optional status. EN 17531 fits that pattern already, and further technical alignment — on AI-driven personalisation, crypto-related transactions, and app-based gambling — looks like the more realistic direction of travel for 2026 and beyond, rather than any single unifying statute emerging from Brussels.
What This Means for Operators Weighing EU Expansion
For an operator sitting outside the market and evaluating entry, the practical implication is straightforward even if the underlying landscape isn’t: there is no shortcut equivalent to a single EU license, and treating Malta as one is a common and costly misreading of how the market actually works. A deeper look at the compliance strategies operators are adopting in response — from KYC infrastructure to responsible-gambling tooling — is covered in Strategies for iGaming Businesses to Adapt to Europe’s Gambling Regulations, which walks through how operators are building compliance frameworks capable of flexing across multiple national regimes simultaneously.
The direction of travel favours larger, better-capitalised operators able to absorb the cost of maintaining parallel compliance infrastructure across a dozen or more jurisdictions at once. Smaller operators increasingly face a choice between consolidating around a handful of markets they can serve properly, or partnering with larger platforms that have already built the compliance scaffolding required to operate at scale across the bloc’s genuinely fragmented, and likely to remain fragmented, regulatory map.
