Germany’s blind spot: suppliers, platforms and the companies behind the licence

Germany’s gambling regulation still has a structural blind spot. It often looks strongest when it deals with the visible operator, the licensed domain or the company name that appears on the whitelist. But the real operational risk in online gambling does not always sit neatly with the public-facing licence holder.

Modern gambling operations are built through layers. A betting or casino website may rely on platform providers, game suppliers, odds feeds, payment processors, KYC tools, affiliate networks, compliance software, hosting structures, data systems and marketing partners. The licence holder may be the legal entry point, but the actual risk can sit deeper in the machinery that makes the business function.

This matters because Germany’s regulatory framework is already designed to look beyond the surface. §4a GlüStV requires ownership and participation structures to be fully disclosed, asks whether the operator and responsible persons are reliable and competent, requires lawful funding and demands that operation is transparent and monitorable. The same provision also requires that supervision of the distribution network is possible at all times and cannot be frustrated by third parties or persons involved in the operation.

That language is important. It shows that German law does not treat online gambling as a simple relationship between regulator and website. The law recognises that third parties, operational structures and technical systems can affect whether a gambling offer is truly controllable. The question is whether enforcement practice follows that reality with enough consistency.

The licence holder is only the front door

A licence holder is the natural starting point for regulation. It is the entity that applies for permission, receives the licence, appears on official lists and carries formal responsibility towards the regulator. Without that starting point, supervision would become fragmented and almost impossible to organise.

But the licence holder is not always the full risk picture. In a highly outsourced market, the company visible to players may not control every meaningful part of the product. Player onboarding, identity checks, game integration, data storage, payments, safer gambling signals, affiliate acquisition and technical reporting may all involve external partners.

That does not automatically make the licence holder less responsible. In fact, it may make the licence holder’s oversight duties more important. If a gambling business chooses to rely on suppliers and platforms, it must be able to show that those relationships do not weaken regulatory control, player protection or technical supervision.

This is where the market needs more visible regulatory logic. If a problem emerges at supplier level, does the regulator treat it as a problem for the supplier only, or as a reliability issue for the licence holder? If a platform provider fails, does that affect the operator’s suitability? If payment flows, affiliate activity or technical data reporting are handled by third parties, how deeply does the authority test who is actually controlling the risk?

LUGAS shows Germany understands technical supervision

Germany cannot say it does not understand technical complexity. The GlüStV created a framework that depends heavily on central IT supervision, real-time controls and provider-side data obligations. The GGL states that LUGAS is one of the mandatory IT supervision systems for legal gambling providers, with technical guidelines and test-system access available for potential providers under the treaty framework.

The GGL also explains that LUGAS consists of two information technology systems and has been administered by the GGL since 1 January 2023, with Dataport operating it as a public-sector service provider for Saxony-Anhalt. The Safe Server evaluation system is designed to assess data collected by gambling providers themselves and is used to monitor compliance with regulatory requirements, prevent manipulation especially by operators, create a data basis for evaluating the GlüStV and check operators’ early detection systems for gambling addiction.

This shows that Germany’s regulatory model is not just document-based. It is built on data flows, technical access and supervisory interfaces. The state has created systems to monitor what licensed providers do, not merely what they say in an application.

That makes the blind spot even harder to defend. If the regulator relies on technical supervision to monitor licensed gambling, then it also has to understand who builds, controls, maintains and secures the technical environment. Otherwise, Germany risks supervising the data output while missing the operational structure behind it.

Safe Server obligations point to the same issue

The Safe Server concept is especially relevant because it sits directly between operator conduct and regulatory oversight. Under §6i GlüStV, online casino, online poker, virtual slot and sports betting providers must operate an automated system for early detection of players at risk of gambling addiction. The provision also requires providers to operate, at their own cost, a technical system that correctly records all data required for gambling supervision, stores it in a digitally immutable way and enables electronic control, including direct access by the competent supervisory authority.

That is a serious obligation. It assumes that the regulator can rely on the data environment as a supervisory tool. But if platform providers, hosting partners, software suppliers or other service companies are involved in creating and maintaining that environment, then the reliability of those partners becomes part of the regulatory question.

A Safe Server is only as reliable as the operational chain behind it. If the licence holder lacks real control over the systems that collect, store or transmit supervisory data, then the regulator may be looking at a compliant interface without fully understanding whether the underlying structure is robust. That would be a dangerous gap in a market that depends so heavily on technical compliance.

The same problem appears in safer gambling technology. If the early detection system depends on data quality, behavioural tracking and accurate account information, then supplier performance is not a side issue. It directly affects whether the regulator’s player-protection objectives can be achieved in practice.

Limit files and activity files depend on operational integrity

Germany’s central files under LUGAS make the same point from another angle. The GGL explains that the central files include a limit file for monitoring cross-provider deposit limits and an activity file to prevent parallel play across multiple gambling providers. The system assigns pseudonyms to players, requires provider-side interaction with the files and uses certificates to give gambling providers access to the central files.

This is not a simple compliance checklist. It is a live operational system. Providers must register players, handle unique play IDs, set and process deposit-limit functions, update active and inactive player status and prevent play when the central activity file shows that the player is already active with another provider.

The practical question is obvious. Who ensures that these processes function correctly when multiple technology layers sit between the player and the licence holder? If a platform provider integrates the system, if a service partner handles account data or if technical reporting depends on outsourced infrastructure, then the regulator must be able to see more than the licence holder’s name.

Germany’s system is only as strong as the chain of implementation. A rule about cross-provider limits means little if the technical and operational partners responsible for making it work are not scrutinised with the same seriousness as the licensed company. Regulation that stops at the formal licence holder risks missing the places where failure actually happens.

Data protection is not separate from supplier control

The wider data-protection obligations in the GlüStV reinforce the same concern. §6g requires licence holders to store player personal data for five years after closure of the player account and then delete it after that period. It also states that existing personal data must always be effectively protected against unauthorised access and that affected persons must be informed about the nature and scope of storage, retention and deletion.

Those obligations cannot be meaningfully separated from supplier governance. If a licence holder uses external providers for platform management, data storage, security testing, payments, identity verification or player-account infrastructure, then the practical protection of player data depends on those arrangements. A data-protection rule aimed only at the formal licence holder may not be enough if the operational control sits elsewhere.

This is why the Merkur and The Mill Adventure case raised wider questions. The public concern was not only whether one vulnerability existed. It was whether supplier structures, security obligations and platform responsibility were being treated as central regulatory issues rather than narrow technical problems. In a market built on outsourcing, a major data incident should force the regulator to ask who truly controlled the affected systems.

The same reasoning applies beyond cybersecurity. Payment risks can sit with payment processors. Marketing risk can sit with affiliate networks. Game-integrity risk can sit with suppliers. Player-protection failures can sit in data systems that the visible operator does not fully build or maintain itself. A regulator that focuses only on the licence holder’s formal position may miss the real source of harm.

Payment flows and affiliates create further blind spots

The gambling market is not only technical. It is commercial. Payment flows, acquisition channels and affiliate relationships can shape the way operators behave and the risks players face. Yet these areas are often harder for the public to assess than the visible domain or the name on a whitelist.

• 4a GlüStV requires the applicant to keep separate accounting for all play and payment transactions in Germany and to process game-related payment transactions through an account in Germany or at a credit institution based in an EU member state. It also requires the operator to provide interfaces for real-time checking of all gambling transactions.

That is an important legal foundation, but it should not end the discussion. The regulator still needs to know how payment providers, payment routing, group structures, merchant arrangements and commercial partners interact with the licensed business. A payment transaction may satisfy a formal requirement while still raising questions about operational transparency, control and accountability.

Affiliate networks create similar problems. Advertising and acquisition can be outsourced, cross-border, incentive-heavy and difficult to monitor. If the licence holder benefits from traffic generated by third parties, it should not be enough to say that the website itself is licensed. The regulatory question should be whether the full commercial chain respects the same standards Germany applies to the licensed offer.

The GGL’s own mandate supports a wider view

The GGL describes its central task as regulating Germany’s online gambling market by reviewing and approving cross-state online gambling offers, ensuring permitted providers comply with rules protecting players from gambling addiction and manipulation and combating illegal gambling and advertising. It also says that youth and player protection, prevention of gambling and betting addiction, uniform legal application and equal framework conditions are central to its work.

That mandate is broad enough to justify looking beyond the visible operator. If the goal is uniform legal application and equal conditions, then the regulator must understand how different business models actually operate. A vertically integrated operator and a supplier-heavy operator may present different risks, but both should be assessed against the same principles of transparency, reliability and monitorability.

This is not an argument for punishing outsourcing. Many regulated markets rely on specialist suppliers, and gambling is no different. Software providers, payment companies and compliance vendors can improve security and professionalism when properly controlled.

The issue is not the existence of suppliers. The issue is whether suppliers become a hiding place for responsibility. A licensed operator should be able to use external services, but it should also be able to prove that those services do not weaken player protection, data security, supervisory access or compliance with German law.

Paper regulation cannot supervise a networked market

The biggest risk is that Germany ends up regulating the licence holder on paper while the real market structure operates through networks. That would create a gap between formal supervision and practical control. The regulator would know who holds the licence, but not always where the operational risk sits.

This is especially dangerous when enforcement appears strict in some areas and less visible in others. Smaller or disputed operators may face intense scrutiny over reliability, ownership or historical conduct, while larger market structures involving suppliers, platforms or major commercial partners may receive less public examination. That creates the impression that the regulator is strong against visible targets but less comfortable examining the deeper market architecture.

There may be legal and procedural reasons for this. Supplier investigations may be confidential. Licence decisions may be limited by administrative law. Different authorities may be responsible for different aspects of payments, data protection, AML or advertising. But those explanations do not remove the need for visible supervisory logic.

If Germany wants a credible regulated market, it must show that licence-holder supervision includes the chain behind the licence. The operator, the platform, the payment system, the affiliate channel and the Safe Server data environment are not separate worlds. Together, they form the actual gambling offer experienced by the player.

Our final thoughts and conclusion

Germany’s gambling regulation already contains the legal and technical tools to look beyond the surface. §4a GlüStV addresses ownership, reliability, financial capability, transparency, distribution-network supervision and real-time interfaces. §6i requires technical systems that record supervisory data, store it immutably and allow electronic control. LUGAS, Safe Server, limit files and activity files show that Germany understands the importance of technical oversight.

The problem is not the absence of rules. The problem is whether those rules are applied to the real structure of the market. A licensed domain is only the front door. Behind it may sit platform providers, software companies, payment partners, data processors, affiliate networks and group-level commercial arrangements that carry real regulatory risk.

If player protection is genuinely central, then the regulator cannot afford to supervise only the company name on the licence. It must understand who controls the systems, who handles the data, who processes the payments, who drives the traffic and who makes the operational decisions that affect players.

Germany’s blind spot is not that suppliers exist. The blind spot is pretending that supplier risk can be separated from licence reliability. In a modern online gambling market, reliability must follow the risk, not merely the paperwork.

FAQs

What is the main concern raised about Germany’s gambling regulation?
The article argues that Germany’s gambling regulation often focuses on the licensed operator while insufficiently examining the suppliers, platforms, payment providers and technical partners that help run the gambling business.

Why are suppliers important in online gambling supervision?
Suppliers can control critical functions such as payments, identity verification, game integration, data storage, safer gambling tools and reporting systems, which directly affect player protection and regulatory compliance.

What role does §4a GlüStV play in gambling regulation?
§4a GlüStV requires operators to disclose ownership structures, prove financial reliability, maintain transparency and ensure that supervisory control cannot be blocked by third parties involved in the operation.

What is LUGAS?
LUGAS is Germany’s mandatory IT supervision framework for legal online gambling providers, designed to monitor compliance, deposit limits and player activity across licensed operators.

How does the Safe Server system support player protection?
The Safe Server system records supervisory data, stores it in a digitally immutable form and allows electronic access by regulators to help monitor compliance and identify gambling-related risks.

Why are deposit limits and activity files important?
They help prevent players from exceeding cross-provider deposit limits or gambling simultaneously with multiple operators, making real-time technical coordination essential for effective supervision.

What data protection obligations apply to licence holders?
Under §6g GlüStV, operators must securely store player data for five years after account closure, protect it from unauthorised access and later delete it according to legal requirements.

How can payment providers create regulatory risks?
Payment processors and routing arrangements may influence transparency, transaction monitoring and accountability, meaning regulators need to understand the full payment chain behind a licensed operation.

Why are affiliate networks considered a blind spot?
Affiliate marketing can operate across borders and involve aggressive acquisition tactics, making it harder for regulators and the public to assess whether advertising and player acquisition meet legal standards.

What conclusion does the article reach about supplier oversight?
The article concludes that effective gambling regulation must follow the operational risk behind the licence, meaning regulators should examine platforms, payment systems, data processors and affiliate networks as closely as the visible licence holder.