Selec­tive enforce­ment is Germany’s biggest gam­bling prob­lem

Selec­tive enforce­ment is becom­ing Germany’s biggest gam­bling cred­i­bil­ity prob­lem!

It is Fri­day, the end of another long reg­u­la­tory week, and many peo­ple in the gam­bling indus­try will be ready to close the lap­top and head into the week­end. But before Germany’s gam­bling mar­ket moves on, one uncom­fort­able ques­tion should not be left behind. Does the country’s reg­u­la­tor apply enforce­ment pres­sure con­sis­tently, or does the inten­sity of super­vi­sion depend too much on who the oper­a­tor is?

That ques­tion has been run­ning through the entire week. It appeared in the debate over reli­a­bil­ity under §4a GlüStV, in the Merkur and The Mill Adven­ture data-secu­rity case, in the dis­cus­sion around sup­pli­ers and plat­forms behind the licence and in the scrutiny of Tipico’s con­tin­u­ing reg­u­lated posi­tion. Each topic is dif­fer­ent, but they all point towards the same struc­tural con­cern. Ger­many can­not build last­ing trust if enforce­ment looks severe in some cases but cau­tious, quiet or nar­rowly tech­ni­cal in oth­ers.

The GGL describes its cen­tral task as reg­u­lat­ing Germany’s online gam­bling mar­ket by review­ing and approv­ing cross-state online gam­bling offers, ensur­ing that per­mit­ted providers com­ply with rules pro­tect­ing play­ers from gam­bling addic­tion and manip­u­la­tion and com­bat­ing ille­gal gam­bling and adver­tis­ing. That is a broad man­date, not a nar­row cler­i­cal func­tion. It gives the author­ity respon­si­bil­ity for mar­ket access, player pro­tec­tion, legal mar­ket cred­i­bil­ity and action against ille­gal sup­ply.

The prob­lem is not that Ger­many lacks rules. The prob­lem is whether those rules are being applied in a way the mar­ket can under­stand. A strict sys­tem can be cred­i­ble. A selec­tive sys­tem can­not.

Reli­a­bil­ity rules only work if they are applied evenly

Germany’s licens­ing frame­work places heavy weight on reli­a­bil­ity, finan­cial capa­bil­ity, law­ful fund­ing, own­er­ship trans­parency and oper­a­tional con­trol. Under §4a GlüStV, licence appli­cants must sat­isfy extended reli­a­bil­ity require­ments, dis­close own­er­ship and par­tic­i­pa­tion struc­tures, show suf­fi­cient own funds for per­ma­nent busi­ness activ­ity and ensure that the gam­bling oper­a­tion is trans­par­ent and mon­i­torable by the author­ity.

Those require­ments are seri­ous because gam­bling is a sen­si­tive mar­ket. Oper­a­tors han­dle money, player accounts, iden­tity data, bet­ting activ­ity, pay­ment flows and behav­ioural infor­ma­tion. It would be irre­spon­si­ble for a reg­u­la­tor to treat mar­ket entry as a sim­ple admin­is­tra­tive approval.

But strict reli­a­bil­ity tests cre­ate an equally strict oblig­a­tion on the reg­u­la­tor. If reli­a­bil­ity is inter­preted broadly for one oper­a­tor, it should not be inter­preted nar­rowly for another. If finan­cial capa­bil­ity, own­er­ship struc­tures, his­toric con­duct or oper­a­tional risks mat­ter in one case, the mar­ket is enti­tled to ask how those same con­cepts are applied else­where.

This is where Germany’s cred­i­bil­ity prob­lem begins. The mar­ket sees some oper­a­tors fac­ing intense pres­sure over reli­a­bil­ity ques­tions, while other major names con­tinue oper­at­ing after seri­ous legal, tech­ni­cal or struc­tural con­cerns with lim­ited pub­lic expla­na­tion. That does not prove unequal treat­ment, but it cre­ates a per­cep­tion gap. In reg­u­la­tion, per­cep­tion becomes dan­ger­ous when the reg­u­la­tor does not explain its method.

Bet3000 shows why the con­sis­tency ques­tion mat­ters

Bet3000 has become a use­ful ref­er­ence point because it sits inside the wider debate about how Ger­many treats oper­a­tors that are viewed as dif­fi­cult, dis­puted or less favoured by the reg­u­la­tory sys­tem. The rel­e­vant ques­tion is not whether Bet3000 should receive spe­cial treat­ment. It should not. The ques­tion is whether the same seri­ous­ness applied to oper­a­tors under pres­sure is also vis­i­ble when major licensed com­peti­tors face uncom­fort­able issues.

Reli­a­bil­ity can­not be a flex­i­ble con­cept that expands when a smaller or con­tro­ver­sial oper­a­tor is being assessed and con­tracts when a mar­ket leader is involved. A reg­u­la­tor may have strong rea­sons for act­ing dif­fer­ently in dif­fer­ent cases. Dif­fer­ent facts, evi­dence, licence cat­e­gories and pro­ce­dural stages can jus­tify dif­fer­ent out­comes.

But dif­fer­ent out­comes need vis­i­ble rea­son­ing. If one oper­a­tor is exam­ined through a broad reli­a­bil­ity lens, while another is treated through a nar­row tech­ni­cal lens, the mar­ket will nat­u­rally ask whether the law is being applied evenly. That is not a pub­lic-rela­tions prob­lem. It is a mar­ket-con­fi­dence prob­lem.

Germany’s reg­u­lated gam­bling sec­tor is still try­ing to prove that strict licens­ing can cre­ate a safer and fairer mar­ket than off­shore alter­na­tives. That project depends on oper­a­tors believ­ing that com­pli­ance bur­dens apply equally. If enforce­ment feels selec­tive, com­pli­ant oper­a­tors will start to won­der whether the real com­pet­i­tive advan­tage lies not in com­pli­ance, but in mar­ket posi­tion.

Merkur and The Mill Adven­ture raised the data-secu­rity test

The Merkur and The Mill Adven­ture case raised the reli­a­bil­ity ques­tion in a dif­fer­ent form. Pub­lic report­ing alleged that a major data-secu­rity inci­dent exposed infor­ma­tion con­nected to hun­dreds of thou­sands of play­ers across Merkur-linked Ger­man gam­bling sites. iGam­ing Busi­ness reported that cyber­se­cu­rity researcher Lilith Wittmann said she accessed sen­si­tive player data through a GraphQL query, includ­ing bank­ing details and sign-up infor­ma­tion, and said the inci­dent enabled access to data belong­ing to more than 800,000 peo­ple.

The reported facts went beyond an ordi­nary web­site issue. Accord­ing to iGam­ing Busi­ness, the GGL warn­ing stated that sup­pli­ers had failed to meet an annual pen­e­tra­tion-test oblig­a­tion, which led to insuf­fi­cient secu­rity for player data on the Slot­magie domain. Times of Malta also reported that Wittmann said she informed the GGL and that the author­ity sub­se­quently issued pub­lic warn­ings to The Mill Adven­ture, Solis Ortus Ser­vice Ltd and Cash­point Malta Ltd in rela­tion to the secu­rity flaw.

That kind of inci­dent should sit squarely inside the reli­a­bil­ity debate. If player pro­tec­tion is cen­tral to Ger­man reg­u­la­tion, then player data secu­rity can­not be treated as a sec­ondary tech­nol­ogy issue. A player whose iden­tity, pay­ment or gam­bling infor­ma­tion is exposed has not been mean­ing­fully pro­tected, even if deposit lim­its and block­ing sys­tems exist on paper.

The impor­tant ques­tion is not whether one spe­cific sanc­tion should have been imposed. The ques­tion is why the pub­lic did not see a clearer licence-review dis­cus­sion around reli­a­bil­ity, sup­plier con­trol and con­tin­u­ing suit­abil­ity. If a smaller oper­a­tor had been linked to a major player-data expo­sure and failed secu­rity oblig­a­tions, would the reg­u­la­tory tone have looked the same?

Sup­plier and plat­form risk can­not be sep­a­rated from licens­ing

The sup­plier issue is one of Germany’s most impor­tant blind spots. Mod­ern gam­bling oper­a­tions are rarely sim­ple. A licensed domain may rely on plat­form providers, game sup­pli­ers, pay­ment proces­sors, iden­tity-ver­i­fi­ca­tion tools, affil­i­ate net­works, host­ing part­ners, safer-gam­bling soft­ware and data sys­tems.

Germany’s own tech­ni­cal super­vi­sion model shows that the reg­u­la­tor under­stands this com­plex­ity. The GGL states that LUGAS is one of the manda­tory IT super­vi­sion sys­tems for legal gam­bling providers, with tech­ni­cal guide­lines and test-sys­tem access avail­able under the treaty frame­work. The GGL also explains that Safe Server is designed to eval­u­ate data col­lected by gam­bling providers them­selves, mon­i­tor com­pli­ance with reg­u­la­tory require­ments, pre­vent manip­u­la­tion and sup­port checks of early detec­tion sys­tems for gam­bling addic­tion.

That makes sup­plier over­sight cen­tral to enforce­ment con­sis­tency. If the real oper­a­tional risk sits with a plat­form provider, data sys­tem, pay­ment chain or affil­i­ate part­ner, enforce­ment that focuses only on the vis­i­ble licence holder may miss the sub­stance of the mar­ket. The player does not expe­ri­ence con­trac­tual dis­tinc­tions between oper­a­tor and sup­plier. The player sees one brand, one account, one pay­ment process and one gam­bling offer.

This does not mean out­sourc­ing should be pun­ished. Many sup­pli­ers improve com­pli­ance, tech­nol­ogy and secu­rity. But sup­plier fail­ure should not become a hid­ing place for respon­si­bil­ity. If a licensed oper­a­tor depends on third par­ties to run key parts of the gam­bling busi­ness, the reg­u­la­tor should make clear how sup­plier con­trol affects licence reli­a­bil­ity.

Tipico shows the major-brand ques­tion

Tipico raises a sep­a­rate but con­nected issue. It is one of the most vis­i­ble names in Germany’s reg­u­lated gam­bling mar­ket, and its posi­tion includes Ger­man-fac­ing per­mis­sions as well as Schleswig-Hol­stein online casino activ­ity. The GGL whitelist explains that it lists per­mit­ted gam­bling providers and also includes offers super­vised by other Ger­man gam­bling author­i­ties, not only the GGL itself.

The con­cern is not that Tipico should auto­mat­i­cally fail Germany’s reli­a­bil­ity test. That would be an unsup­ported con­clu­sion. The stronger and safer ques­tion is whether the GGL and state author­i­ties should explain more clearly how they assess lit­i­ga­tion expo­sure, liq­uid­ity, group money move­ments, his­toric player claims and ongo­ing finan­cial resilience when grant­ing or main­tain­ing per­mis­sions for a major oper­a­tor.

The player-claims issue is real enough to require reg­u­la­tory atten­tion. The Court of Jus­tice of the Euro­pean Union has dealt with ques­tions linked to claims by a Ger­man con­sumer against Tipico con­cern­ing stakes wagered and lost on Tipico’s Ger­man web­site before the cur­rent frame­work was fully oper­a­tional, accord­ing to the Court’s March 2026 press release. That does not decide the licens­ing ques­tion, but it does sharpen the pub­lic-inter­est ques­tion around ongo­ing reli­a­bil­ity.

Major brands should not be judged more harshly merely because they are major brands. But they should not be judged more gen­tly either. A well-known name, high vis­i­bil­ity or strong com­mer­cial posi­tion should never replace a trans­par­ent reg­u­la­tory assess­ment of reli­a­bil­ity and finan­cial capa­bil­ity.

Black-mar­ket enforce­ment can­not excuse silence inside the legal mar­ket

The GGL has placed sig­nif­i­cant pub­lic empha­sis on com­bat­ing ille­gal gam­bling. Report­ing on the GGL’s 2024 activ­ity infor­ma­tion said the author­ity iden­ti­fied 858 Ger­man-lan­guage ille­gal gam­bling web­sites oper­ated by 212 oper­a­tors, and esti­mated ille­gal Ger­man-lan­guage online mar­ket vol­ume between €500 mil­lion and €600 mil­lion.

That work mat­ters. Ille­gal gam­bling under­mines player pro­tec­tion, tax rev­enue, licensed oper­a­tors and the cred­i­bil­ity of the legal mar­ket. The reg­u­la­tor is right to take black-mar­ket enforce­ment seri­ously.

But black-mar­ket enforce­ment can­not become a sub­sti­tute for trans­par­ent super­vi­sion of licensed providers. A legal mar­ket does not become cred­i­ble sim­ply because ille­gal oper­a­tors are tar­geted. It becomes cred­i­ble when licensed oper­a­tors are also held to clear, vis­i­ble and con­sis­tent stan­dards.

This is where Ger­many risks cre­at­ing a two-level nar­ra­tive. Against ille­gal oper­a­tors, the lan­guage is firm, vis­i­ble and enforce­ment-heavy. Against major licensed names fac­ing seri­ous issues, the pub­lic often sees less about licence-review logic, con­tin­u­ing reli­a­bil­ity or super­vi­sory con­se­quences. That imbal­ance weak­ens the mes­sage that Ger­many is build­ing a fair and coher­ent reg­u­lated mar­ket.

The whitelist is not enough

The GGL whitelist is use­ful. It helps play­ers and part­ners see which providers are per­mit­ted under Germany’s reg­u­la­tory frame­work and includes a note that some listed offers fall under other Ger­man gam­bling author­i­ties rather than the GGL itself.

But a whitelist is not a full enforce­ment model. It shows licens­ing sta­tus at a point in time. It does not explain how the author­ity eval­u­ates seri­ous inci­dents after autho­ri­sa­tion, how licence con­di­tions are reviewed, how sup­plier fail­ures affect reli­a­bil­ity or how lit­i­ga­tion expo­sure is assessed.

That dis­tinc­tion mat­ters because many mar­ket par­tic­i­pants treat whitelist sta­tus as a trust sig­nal. Banks, adver­tis­ers, affil­i­ates, sports part­ners, sup­pli­ers and play­ers may all rely on it. If the list is not sup­ported by vis­i­ble post-licence super­vi­sion, it risks becom­ing a sta­tic reas­sur­ance rather than evi­dence of ongo­ing reg­u­la­tory con­fi­dence.

Ger­many needs the whitelist to mean more than per­mis­sion. It should mean that the oper­a­tor remains sub­ject to active, seri­ous and even-handed over­sight. If the reg­u­la­tor can­not explain how that over­sight works in dif­fi­cult cases, the list loses part of its cred­i­bil­ity.

Selec­tive enforce­ment dam­ages the legal mar­ket

Selec­tive enforce­ment does not always mean cor­rup­tion, favouritism or bad faith. Some­times it is sim­ply the result of admin­is­tra­tive cau­tion, legal com­plex­ity, con­fi­den­tial pro­ce­dures, lim­ited resources or frag­mented author­ity between the GGL and state-level bod­ies. Those real­i­ties are impor­tant and should not be ignored.

But the out­come can still be dam­ag­ing. If oper­a­tors can­not under­stand why some cases trig­ger heavy pres­sure and oth­ers pro­duce qui­eter han­dling, con­fi­dence in the sys­tem declines. If the pub­lic can­not see the regulator’s rea­son­ing, spec­u­la­tion fills the gap.

The reg­u­lated mar­ket needs pre­dictabil­ity. Oper­a­tors should know what hap­pens when there is a data-secu­rity inci­dent, a sup­plier fail­ure, an own­er­ship con­cern, a finan­cial-capa­bil­ity ques­tion or a major lit­i­ga­tion expo­sure. They should know whether those issues trig­ger licence review, addi­tional report­ing, pub­lic warn­ings, con­di­tions, reme­di­a­tion plans or sanc­tions.

With­out that pre­dictabil­ity, enforce­ment becomes harder to dis­tin­guish from dis­cre­tion. A mar­ket can tol­er­ate strict rules. It can­not eas­ily tol­er­ate rules that appear strict only for some.

Our final thoughts and con­clu­sion

Ger­many has built one of Europe’s most restric­tive online gam­bling frame­works. It has reli­a­bil­ity tests, own­er­ship-dis­clo­sure require­ments, finan­cial-capa­bil­ity rules, LUGAS, Safe Server, limit files, activ­ity files, a whitelist and a reg­u­la­tor that pub­licly focuses on player pro­tec­tion and ille­gal gam­bling enforce­ment. On paper, the sys­tem looks seri­ous.

The unre­solved prob­lem is con­sis­tency. Bet3000, Merkur and The Mill Adven­ture, Tipico, sup­pli­ers, plat­forms, black-mar­ket enforce­ment and licence-review stan­dards all point towards the same ques­tion. Does Ger­many apply enforce­ment pres­sure accord­ing to a clear model, or does the out­come depend too much on the operator’s size, pro­file, con­nec­tions or mar­ket impor­tance?

A cred­i­ble reg­u­la­tor does not have to treat every case iden­ti­cally. Dif­fer­ent facts should pro­duce dif­fer­ent out­comes. But a cred­i­ble reg­u­la­tor must show the mar­ket that the same core ques­tions are being asked every time.

Who con­trols the oper­a­tion? Is the fund­ing sta­ble and law­ful? Are play­ers pro­tected in prac­tice? Are sup­pli­ers prop­erly super­vised? Are data sys­tems secure? Are lit­i­ga­tion risks under­stood? Can the busi­ness be mon­i­tored prop­erly? And when some­thing goes wrong, does the licence review process respond con­sis­tently?

That is the ques­tion Ger­many should not avoid as this reg­u­la­tory week ends. Does the GGL have a con­sis­tent enforce­ment model, or does reg­u­la­tory pres­sure depend too much on who the oper­a­tor is?

FAQs

Why is Ger­many’s gam­bling reg­u­la­tion being crit­i­cised?
Ger­many’s gam­bling reg­u­la­tion is being ques­tioned because some indus­try observers believe enforce­ment actions appear incon­sis­tent between dif­fer­ent licensed oper­a­tors, rais­ing con­cerns about fair­ness and trans­parency.

What is the role of the GGL in Ger­many?
The Joint Gam­bling Author­ity of the Fed­eral States (GGL) reg­u­lates Ger­many’s online gam­bling mar­ket, issues licences, mon­i­tors com­pli­ance, pro­tects play­ers and com­bats ille­gal gam­bling activ­i­ties.

Why is enforce­ment con­sis­tency impor­tant in gam­bling?
Con­sis­tent enforce­ment ensures that every licensed oper­a­tor is treated equally under the law, help­ing main­tain mar­ket con­fi­dence, player trust and fair com­pe­ti­tion.

What does §4a GlüStV require from gam­bling oper­a­tors?
Sec­tion 4a of the Ger­man State Treaty on Gam­bling requires oper­a­tors to demon­strate reli­a­bil­ity, finan­cial sta­bil­ity, trans­par­ent own­er­ship struc­tures and effec­tive oper­a­tional con­trols before receiv­ing a licence.

Why are data secu­rity inci­dents rel­e­vant to gam­bling reg­u­la­tion?
Oper­a­tors han­dle sen­si­tive cus­tomer infor­ma­tion, includ­ing pay­ment and iden­tity data. Seri­ous cyber­se­cu­rity fail­ures may affect player pro­tec­tion and could influ­ence reg­u­la­tory assess­ments of oper­a­tor reli­a­bil­ity.

How do third-party sup­pli­ers affect gam­bling com­pli­ance?
Many gam­bling oper­a­tors rely on exter­nal tech­nol­ogy providers, pay­ment proces­sors and plat­form sup­pli­ers. Reg­u­la­tors must ensure these part­ners also meet secu­rity and com­pli­ance stan­dards.

What is Ger­many’s gam­bling whitelist?
The whitelist is an offi­cial reg­is­ter of licensed gam­bling oper­a­tors autho­rised to offer legal gam­bling ser­vices in Ger­many under the coun­try’s reg­u­la­tory frame­work.

Why is black-mar­ket gam­bling still a con­cern?
Ille­gal gam­bling web­sites under­mine licensed oper­a­tors, reduce con­sumer pro­tec­tion and cre­ate unfair com­pe­ti­tion, mak­ing enforce­ment against unli­censed oper­a­tors a key reg­u­la­tory pri­or­ity.

What is LUGAS?
LUGAS is Ger­many’s manda­tory tech­ni­cal mon­i­tor­ing sys­tem that helps reg­u­la­tors super­vise licensed gam­bling oper­a­tors and enforce respon­si­ble gam­bling require­ments.

What is the main con­cern raised in the arti­cle?
The arti­cle ques­tions whether Ger­many applies gam­bling enforce­ment con­sis­tently across all oper­a­tors and argues that greater trans­parency would strengthen con­fi­dence in the reg­u­lated mar­ket.