The Malta Gaming Authority has published the outcome of a sector-wide supervisory review focused on how online B2C operators implement self-exclusion and responsible gambling measures in Malta. The exercise assessed whether safeguards operate effectively in practice and clarified regulatory expectations concerning player protection.

Authorities initiated the review during the first half of 2025 following complaints that some players who had self-excluded were still able to access other brands operating under the same licence. The assessment covered 20 licensees and 58 active URLs, with investigators conducting mystery shopping to test real-world functionality of controls rather than relying solely on documented policies.

Review Scope and General Compliance

The regulator examined how operators applied self-exclusion across brands, how systems responded to duplicate or similar identity details, and whether responsible gambling information was clearly presented at key stages of play. Investigators created accounts across three brands per licensee to evaluate whether exclusions were enforced consistently and whether controls could be bypassed.

According to the Authority, overall compliance levels were broadly positive. Most licensees demonstrated practices aligned with regulatory standards. However, a number of operators were found to fall short in specific areas, prompting corrective action requirements.

The regulator stated that the review “sought to identify any systemic weaknesses and clarify regulatory expectations relating to player protection, highlighting areas performing well as well as opportunities for licensees to strengthen their practices.” The findings reaffirmed the Authority’s commitment to safeguarding players and maintaining integrity in the online gaming sector, while identifying practical improvements that operators must implement.

Self-Exclusion Delays and Cross-Brand Weaknesses

One of the central issues concerned delays in activating self-exclusion requests. Two licensees did not close accounts within 24 hours when players submitted requests by email, while another required identity verification before implementing the exclusion. The Authority reiterated that self-exclusion must take effect immediately and stated that no additional requirements, including KYC checks, may delay implementation. It does not regard any period exceeding 24 hours as compliant.

Investigators also identified a case where an operator revoked a self-exclusion without applying the required cooling-off period. Regulations mandate a minimum 24-hour delay before reducing or lifting a definite exclusion and seven days for an indefinite one. The regulator expects automated safeguards that prevent immediate reinstatement, regardless of communications between operator and player.

Cross-brand enforcement presented further challenges. Three licensees allowed a self-excluded individual to register, deposit, and play on another brand under the same licence by using similar personal information. The Authority expects systems capable of detecting identical or materially similar data, including name, date of birth, email address, IP address, or payment details. When indicators of problem gambling exist, exclusions must extend across all brands held under the same licence.

Centralised exclusion databases and real-time data matching tools were identified as effective approaches to strengthen controls. The findings highlighted the need for operators to enhance detection systems to ensure that player protection mechanisms operate consistently across corporate structures.

Limit-Setting and Reality Check Gaps

The review also identified shortcomings in the presentation of responsible gambling tools during account registration and gameplay. Four licensees failed to prompt players to set gambling limits either during registration or before their first deposit. Regulations require operators to offer limit-setting tools at the outset and ensure that they remain readily accessible. The Authority requires proactive prompts and immediate enforcement once limits are set.

Reality Check functionality showed weaknesses at six licensees. Session pop-ups lacked mandatory information in certain cases. Regulatory standards require these alerts to suspend gameplay and display time spent, amounts wagered, winnings, and losses. Timers must continue across games, and any exclusion of auto-play activity from time calculations must be optional rather than automatically applied.

The regulator confirmed that it communicated its findings to the affected operators and required rectification plans. Supervisory follow-up will continue, and enforcement measures may escalate where necessary. The review forms part of a broader risk-based oversight strategy designed to promote consistent standards across the sector.

Through the accompanying guidance document, the Authority encouraged all licensees to draw on the review’s findings to reinforce internal procedures, strengthen responsible gambling controls, and support a safer online gaming environment.