MGA: self-exclusion still flawed
•
22 Feb 2026 •
Reading time: 3 minutes
A regulatory investigation by the MGA has revealed shortcomings in the systems designed to protect vulnerable gamblers. Behind the technological promises, reality still reveals shortcomings.
An investigation in response to repeated complaints
In 2025, the Malta Gaming Authority (MGA) launched a major thematic review after receiving disturbing reports that players who had requested to be excluded were continuing to access certain online gambling sites. The authority decided to investigate whether these reports were isolated incidents… or part of a structural problem.
Twenty direct-to-consumer licensees were examined. In all, fifty-eight active sites were scrutinized. The aim was to measure the real effectiveness of self-exclusion and responsible gaming tools in their day-to-day operation.
Mystery shopper test
Rather than limiting itself to analyzing internal policies, the authority opted for a concrete method: mystery shopping, or testing in real-life conditions. Between the first and second quarters of 2025, investigators created accounts on several brands belonging to the same operators.
The protocol was rigorous. The teams used fixed identities to register on an initial platform, then activated a self-exclusion request. They then attempted to register on other sites linked to the same licensee, sometimes with identical data, sometimes slightly modified. Investigators even made deposits and participated in gaming sessions to observe actual system behavior.
The results revealed some worrying delays. Two operators failed to close accounts within twenty-four hours of an e-mailed self-exclusion request. In one case, the company required identity verification documents before applying the measure. However, according to the rules in force, exclusion must be immediate and cannot be conditional on administrative procedures.
The investigation also identified a case where an exclusion was lifted without respecting the mandatory cooling-off period. Regulations require a minimum period of twenty-four hours to modify a definite exclusion, and at least seven days for an indefinite exclusion. Allowing an instant return is a direct violation of the spirit of these measures.
One of the most sensitive findings concerns groups operating several brands under the same license. Three operators have allowed self-excluded players to register, deposit money and play on another site in the same network. For the regulator, however, the rule is unambiguous: when an exclusion is triggered for reasons related to problem gambling, it must apply to all brands controlled by the same licensee. Companies are expected to detect matches between identities, means of payment or other technical indicators.
Responsible gaming tools sometimes relegated to the background
The analysis was not limited to self-exclusion. It also examined other mechanisms that are essential to preventing excessive behavior.
Four operators did not encourage players to set gambling limits at the time of registration or before the first deposit, even though this step is supposed to be systematic. These limits represent one of the first lines of defense against abuse.
Even more worryingly, six licensees had failures in the so-called “reality check” function. This system must interrupt the gaming session to display key information: session duration, amounts wagered, winnings and losses. The message must remain visible until the user sees it, preventing immediate resumption. In several cases, the information was incomplete or the technical alert did not comply with regulatory requirements.
Compliance judged acceptable overall, but fragile
The authority stresses that, overall, the majority of operators are complying with expectations. However, the review highlights a number of cross-functional weaknesses that undermine the effectiveness of the system.
Each operator concerned has received detailed feedback and is now required to submit a remediation plan. The regulator plans to step up monitoring to check that the corrective measures have been implemented. Enforcement measures may be envisaged if shortcomings persist.
In a fast-growing market, the ability to ensure effective exclusion could become a decisive criterion of trust, both for the authorities and the public. The question is no longer whether the tools exist, but whether they actually work when players need them most.