Here’s the latest update on EU iGaming developments, fresh as of Tuesday 3 November 2026.
Austria’s TRIS Deadline Approaches
Austria’s Ministry of Finance has proposed replacing the online gambling monopoly with an open licence system that emphasises stronger player protection and enforcement. This proposal is currently under review in the EU’s Technical Regulation Information System, or TRIS.
The standstill period, during which legislation cannot be formally adopted, ends on 5 November 2026. Once that lapses, parliamentary proceedings in Austria may continue, but new licences cannot be awarded until January 2027, and operations may only start by October 2027. Existing monopoly provider win2day holds its concession until 30 September 2027. To qualify for new licences, operators must settle tax liabilities and comply with final player‑protection judgments. Operators that previously offered services without national authorisation can still apply, provided they withdraw by the end of December 2026.
New tools are built into the system. A central exclusion register, operator-imposed self-exclusion, cross-operator deposit limits, time and spending limit waits, plus payment and website blocking all feature. These will be phased in from January 2027 ahead of full enforcement later in the year.
This shift marks another major EU market moving from monopoly to multi-licence. Regulators and operators across Europe are watching closely. The move is expected to enhance competition and provide players with more choices while maintaining strict regulatory oversight.
Many industry insiders believe this transformation could set a precedent for other countries currently operating under a monopoly. The introduction of an open licence system aims not only to improve fairness among operators but also to address issues related to problem gambling. By implementing measures such as central exclusion registers and spending limits, Austria hopes to create a safer gambling environment for its players. Additionally, these measures are anticipated to support Austria’s broader social responsibility goals by reducing the negative impacts associated with gambling addiction.
EU Anti-Money Laundering Rules Gain Ground
The EU’s Anti-Money Laundering Regulation, EU 2024/1624, now offers the first legal definition of “gambling services” at a pan-EU level. That definition includes betting, lotteries, casino games, and poker, across all distribution methods.
This regulation takes effect directly in all member states on 10 July 2027. It does not provide a unified EU gambling licence, but it ensures harmonised customer due-diligence rules. That tighter framework will shape how banks and payment providers handle gambling transactions – even though licensing remains national.
Separately, the EU’s Anti-Money Laundering Authority has drafted technical guidelines that propose a €2 000 threshold for due-diligence checks on gambling transactions. Sweden’s regulator, Spelinspektionen, supports incorporating these standards into its July 2027 reforms.
The implications of these changes are significant. By standardising the definition of gambling services and enhancing due diligence requirements, the EU aims to combat financial crimes such as money laundering effectively. Industry stakeholders must prepare to adapt to these evolving regulatory demands. This includes updating their processes to ensure compliant operations, which could mean greater operational costs but could also foster a more trustworthy environment for consumers.
Furthermore, the €2,000 threshold for transactions requiring due diligence checks represents an effort to target larger, potentially suspicious transactions without unduly burdening operators handling smaller stakes. This threshold strikes a balance by protecting the integrity of gambling transactions while allowing the industry to operate smoothly within legal frameworks.
Cyber Resilience Obligations Take Effect
Downloadable casino and sportsbook clients, gaming terminals, kiosks, mobile apps, and their software are now clearly within the scope of the EU’s Cyber Resilience Act. Guidance from the European Commission, issued on 27 July 2026, clarifies this scope for the gambling sector.
Reporting obligations under Article 14 begin on 11 September 2026, even for products already on the market. The full Act applies from 11 December 2027. Existing EU type-examination certificates remain valid until 11 June 2028.
That gives operators and suppliers time to plan ahead. But they must act. This new regulation will affect nearly every digital product connected to gambling. Ensuring compliance with these cyber resilience measures will necessitate significant investment in IT infrastructure and cybersecurity staff for most businesses. However, the potential for increased consumer confidence due to enhanced security measures makes this investment a crucial one.
Cyber threats are evolving rapidly, and the gambling sector, due to its high-value transactions and data-driven nature, remains a prime target. The Cyber Resilience Act aims to create a more secure online environment by enforcing strict security protocols. These include regular security audits, incident reporting, and data protection practices, all designed to protect both operators and their customers. By doing so, the Act seeks to establish a baseline of cybersecurity across the EU, ensuring that operators meet rigorous standards.
Other Notable National Moves
- Belgium now mandates that betting machines at newsagents verify player age (21 or over) and screen against self-exclusion registers. Any non-compliant machines must be deactivated.
- Spain in 2026 introduced mandatory cross-operator deposit limits – €700 per day, €1,750 per week, and €3,300 per four weeks – under its Royal Decree 520/2026. These rules take effect on 25 March 2027 and include new operational and financial guarantee requirements.
As we observe these regulatory shifts, a clear trend emerges. The focus is on consumer protection, responsible gambling, and preventing financial crime. Belgium’s emphasis on age verification and self-exclusion highlights a proactive approach to preventing underage gambling and problem gambling.
In Spain, the introduction of deposit limits is part of wider efforts to promote responsible gambling. These changes aim to prevent excessive gambling and provide a framework for operators to follow in protecting customers. By setting deposit limits, Spain seeks to mitigate the risks associated with uncontrolled gambling spending. Moreover, Spain’s approach highlights an understanding of the importance of financial controls in maintaining cash flow integrity while supporting player protection.
It’s clear: the regulatory landscape across EU iGaming is changing fast. Between Austrian licence reform, unified AML definitions, cyber resilience rules, and national revisions in Belgium and Spain, operators face rising complexity. However, these changes also bring opportunities for growth and innovation, enhancing the integrity and safety of online gambling across Europe. As these regulations continue to evolve, operators must remain adaptable and informed, using these shifts as a springboard for new developments and consumer trust-building within the industry.
