Malta Gaming Authority investigation reveals gambling safety gaps

The Malta Gaming Authority completed an extensive undercover compliance investigation during the first half of 2025 to assess whether licensed gambling operators are effectively protecting their customers in practice. The initiative, conducted through a structured mystery shopper program, sought to evaluate how regulatory obligations translate into real world safeguards for players, particularly those at risk of gambling related harm.

While the majority of operators demonstrated a commitment to regulatory compliance, the review identified areas where safeguards were either inconsistently applied or insufficiently robust. According to the authority’s findings, certain procedural delays and technical weaknesses could undermine player protection mechanisms, especially in situations involving self exclusion and identity verification.

The investigation forms part of the regulator’s broader supervisory mandate to ensure that consumer protection measures are not merely documented in policy manuals but are embedded into the operational systems of licensed entities.

A structured mystery shopper methodology

Rather than relying solely on documentation reviews or operator submissions, the Malta Gaming Authority adopted a proactive supervisory approach. Investigators created controlled test accounts across dozens of licensed platforms to evaluate system functionality under realistic user conditions.

Step one: Baseline account assessment

In the first phase, regulators established standard user accounts to observe how platforms operated during the registration process and early gameplay. This stage focused on onboarding procedures, limit setting prompts and visibility of responsible gambling tools.

Investigators assessed whether new players were encouraged or required to establish deposit limits, loss limits or time limits upon registration. The findings indicated that while many operators offered these tools, not all prominently prompted users to activate them at the outset.

Step two: Cross brand self exclusion testing

The second phase examined the integrity of self exclusion mechanisms across related brands owned by the same corporate group. After requesting self exclusion from one brand, investigators attempted to register with a sister platform under the same operator.

The objective was to determine whether group level exclusion controls were effectively implemented. In several cases, the systems functioned as intended. However, the authority observed instances where exclusion data was not synchronised swiftly across all affiliated brands. Such inconsistencies may create unintended gaps during critical periods when vulnerable players seek to restrict access.

Step three: Identity variation attempts

In the final stage, investigators tested the robustness of identity verification systems by making minor alterations to personal details such as name formatting or address structure. These controlled variations were designed to assess whether automated systems could detect potential duplicate accounts or attempts to circumvent prior restrictions.

The review found that certain technical configurations did not consistently flag closely matched profiles. Although these instances did not necessarily indicate deliberate non compliance, they highlighted the need for stronger identity matching protocols and improved database integration.

Observed weaknesses in implementation

The authority’s report emphasised that compliance frameworks were generally present. However, implementation challenges occasionally reduced their effectiveness in real time.

Delays in account restrictions

One of the more significant findings concerned delays in applying self exclusion requests. In a small number of cases, account restrictions were not immediately enforced after a player initiated a ban request.

Even short administrative or system delays can present heightened risk during moments of emotional vulnerability. The authority stressed that immediate execution of exclusion requests should be treated as a non negotiable requirement within responsible gambling systems.

Inconsistent cooling off enforcement

The investigation also reviewed the enforcement of mandatory cooling off periods before account reactivation. While many operators adhered to prescribed waiting intervals, isolated instances suggested that reactivation processes were not uniformly stringent.

The authority clarified that any reactivation must comply fully with regulatory timelines and must not allow premature access to gambling services.

Limited limit setting prompts

Another recurring observation involved the absence of strong prompts encouraging new users to set spending limits during registration. Although limit setting tools were available across most platforms, their visibility and prominence varied.

The authority reiterated that proactive engagement with limit setting features plays a vital role in harm prevention strategies.

Technical concerns and player notifications

Beyond procedural elements, the review highlighted certain technical and interface related concerns.

Identity matching limitations

Minor alterations in personal information occasionally resulted in the creation of separate accounts that were not immediately linked to prior profiles. The authority advised operators to refine matching algorithms and strengthen verification layers to prevent circumvention of existing controls.

Importantly, the regulator did not allege systemic misconduct. Rather, it identified areas requiring technical enhancement to align operational practices with regulatory expectations.

Reality check notification effectiveness

The review further assessed in game “reality check” notifications designed to inform players of time spent and activity levels. In some cases, these alerts were considered unclear or insufficiently detailed to provide meaningful behavioural reflection.

Effective player notifications should present clear data regarding session duration and expenditure in a format that supports informed decision making. The authority encouraged operators to reassess user interface design to ensure clarity and accessibility.

Regulatory response and corrective measures

The Malta Gaming Authority has required each operator that did not fully meet expectations during the review to submit a formal remediation plan. These action plans must detail corrective steps, timelines and internal control enhancements.

The regulator emphasised that its objective is not punitive but preventative. However, failure to implement corrective measures within established deadlines may result in further supervisory action in accordance with applicable regulations.

The authority’s evolving oversight model reflects a shift toward more assertive and data driven supervision. Instead of relying exclusively on periodic reporting, the regulator intends to conduct ongoing operational testing to ensure that safeguards function effectively under real conditions.

Introduction of anonymous self assessment tool

Alongside enforcement initiatives, the authority introduced a voluntary anonymous self assessment instrument designed to help individuals evaluate their gambling behaviour. The tool allows users to complete a structured questionnaire without providing identifiable information.

This initiative aims to empower players with greater awareness while preserving privacy. By offering accessible evaluation resources, the regulator seeks to complement operator based controls with individual level engagement.

Strengthening accountability across the sector

The 2025 undercover investigation underscores Malta’s continued emphasis on responsible gambling within its licensed market. The jurisdiction remains one of Europe’s most prominent regulatory environments for online gaming.

Through enhanced monitoring and direct operational testing, the authority signals to operators that compliance must extend beyond written policies. Player protection systems must be technically robust, promptly executed and transparently communicated.

Operators are now aware that routine user activity may be subject to supervisory observation. This awareness is intended to foster a culture of continuous compliance and proactive system improvement.

Legal and regulatory implications

From a legal perspective, the investigation highlights the increasing importance of demonstrable compliance within regulated gambling markets. Operators are expected not only to maintain documented procedures but also to ensure that technological infrastructures support regulatory objectives.

Failure to align technical systems with policy obligations may expose operators to reputational risk and regulatory scrutiny. Conversely, timely remediation and transparent engagement with the regulator can reinforce market credibility.

The authority’s measured response indicates a balanced regulatory philosophy that prioritises consumer welfare while maintaining industry stability.

Conclusion

The Malta Gaming Authority’s undercover review represents a significant step in reinforcing practical player protection within the licensed gambling sector. By testing real world functionality rather than relying solely on documentation, the regulator identified technical and procedural gaps that might otherwise have remained undetected.

Although most operators demonstrated substantial compliance with existing rules, the investigation revealed that even minor system weaknesses can have meaningful implications for vulnerable individuals. Immediate execution of self exclusion requests, consistent cross brand data sharing and stronger identity verification processes remain essential components of an effective responsible gambling framework.

The regulator’s insistence on corrective action plans and its introduction of an anonymous self assessment tool illustrate a dual strategy of enforcement and empowerment. This balanced approach seeks to protect consumers while encouraging operators to strengthen internal systems.

As regulatory oversight continues to evolve, licensed entities in Malta are expected to treat player protection not as a compliance checkbox but as a foundational principle embedded within their technological architecture and corporate governance. The 2025 investigation serves as a clear reminder that effective regulation depends not only on written standards but on their consistent application in daily operations.

FAQs

What was the purpose of the Malta Gaming Authority investigation?
The investigation aimed to evaluate whether licensed gambling operators effectively implement player protection measures in real world conditions.

How did the regulator conduct the review?
The authority used mystery shopper accounts to test registration processes, self exclusion systems and identity verification controls.

Did the investigation find widespread non compliance?
The findings indicated that most operators follow regulations, but certain technical and procedural gaps were identified.

What issues were identified with self exclusion systems?
In some cases, there were delays in applying exclusions or inconsistencies across related brands.

Why is identity verification important in gambling regulation?
Robust identity verification prevents individuals from bypassing restrictions and supports responsible gambling safeguards.

What are reality check notifications?
They are in game alerts designed to inform players about time spent and activity levels during a session.

What actions must operators take following the investigation?
Operators that did not meet expectations must submit formal remediation plans detailing corrective measures.

Is the regulator imposing penalties?
The authority has focused on corrective action, though further measures may apply if deficiencies are not resolved.

What is the anonymous self assessment tool?
It is a voluntary questionnaire that allows individuals to evaluate their gambling behaviour without revealing personal identity.

How does this investigation affect Malta’s gaming sector?
It reinforces the importance of practical compliance and strengthens confidence in the jurisdiction’s regulatory framework.