Malta Media

Germany’s betting shop gold rush is over and I wonder how many franchisees have realised it. For years, operators sold expansion, impressive networks and the promise of attractive returns. Today, approximately 74% of regulated sports betting stakes are placed online, retail locations are disappearing and the person paying the rent is often the one carrying the greatest financial risk. So here is an interesting question for Tipico, Tipwin Limited, sportwetten.de and BET3000 Deutschland Management GmbH: How attractive is your franchise model when the market is moving in precisely the opposite direction? Bet3000's regulatory history makes that question particularly interesting. A famous brand is one thing, but profitable shops and reliable licensing arrangements are something quite different. We examined the figures, the changing market and who might survive the next ten years. The full article is on Malta Media: https://lnkd.in/dZB4jUNn

Germany’s online gambling market is not built around single, simple operators. It is built around networks. A licensed domain may be the visible part of the business, but the real operational risk can sit with platform providers, software companies, payment partners, data systems, compliance tools, affiliate networks and other service providers behind the licence. That matters for regulation. Germany’s framework already recognises that online gambling must be technically supervised. LUGAS, Safe Server, the limit file and the activity file all show that the system depends on data flows, supervisory access and operational reliability. This is not only a legal market. It is a technical market. The question is whether enforcement follows that reality. If a regulator focuses mainly on the visible licence holder, it may miss where the actual risk sits. A player does not experience the market through corporate charts or supplier contracts. The player sees one brand, one account, one payment flow and one gambling product. But behind that product, responsibility can be spread across several companies. This becomes especially important after serious incidents involving data security, platform operations or supplier obligations. If a supplier failure affects player protection, supervisory data, payment processing or account security, it should not be treated as something separate from licence reliability. The licence holder remains responsible, but the regulator also needs to understand the chain behind the licence. Otherwise, Germany risks regulating the company name on paper while the real market structure operates somewhere else. Our latest Malta Media article looks at Germany’s supplier blind spot, the role of Safe Server and LUGAS, payment and affiliate risks and why licence reliability must follow the actual operational structure of the market. https://lnkd.in/dtyWvHE2 #Germany #iGaming #GamblingRegulation #PlayerProtection

Germany’s online gambling debate often starts from the wrong assumption. It treats the existence of a licensed market as if that already means consumers are protected, but that is only true when players actually stay inside the licensed framework. That is the real channelisation problem. A licence, a whitelist, OASIS, LUGAS and technical supervision all matter, but they only matter for players who remain in the legal market. The moment a player moves outside that system, the protection model loses practical reach. This is not about defending operators or attacking regulators. It is about asking whether the current framework is strong enough in real consumer journeys, not only in legal architecture. A player does not experience regulation as a policy document. They experience registration, verification, limits, product availability, payments, bonuses, odds, delays and friction. Some of that friction is justified. Player protection will always require limits and safeguards and no serious discussion should pretend otherwise. But every additional point of friction also has a behavioural consequence, especially when alternatives outside the intended framework are still accessible. The GGL’s own public summary of the 2025 activity report refers to a study showing a 77 percent channelisation rate and a 23 percent illegal online market share for 2024. That can be presented as evidence that the regulated market carries most activity. It can also be read as a warning that nearly one quarter of the online market remains outside the intended protection system. That is not a minor detail. If consumer protection depends on regulated participation, then leakage matters. It matters for players, for licensed operators, for tax collection, for market integrity and for the credibility of the regulatory model. The licensed market cannot carry this burden alone. It cannot make illegal competitors follow German rules, it cannot educate every consumer by itself and it cannot compensate for a framework if the legal offer becomes too weak or too inconvenient compared with what consumers can find elsewhere. The more uncomfortable question is whether Germany is measuring the right thing. Counting licences, systems and enforcement actions is necessary, but it is not enough. The decisive test is whether real players remain inside the protected environment when they face real choices. For me, this is where the channelisation debate has to become more honest. A strict regulated market may look strong on paper, but if too much consumer behaviour leaks outside the framework, the protection objective itself becomes harder to defend. The legal market does not need to copy the illegal market. But it must remain commercially credible, understandable and accessible enough to keep players where protection actually works. https://lnkd.in/dG4HZtAB #Germany #GamblingRegulation #Channelisation #ConsumerProtection #iGaming

Germany’s gambling authority says LUGAS processed data connected to approximately five million registered players and more than 60 permitted providers in 2025. The GGL has administered the Safe Server evaluation systems and central databases since January 2023, with Dataport operating the infrastructure. Now comes the awkward part. In its latest announcement, the GGL says evaluations will rely more extensively on Safe Server data from 2027, even though German law describes the system as recording all information needed for gambling supervision and enabling electronic control at any time. The wording does not prove that the data have been ignored. “More extensively” means increased use, not the first use. But it does confirm that a system imposed on the licensed market years ago is still moving towards the level of data quality and analytical use the regulator considers necessary. The GGL’s own chronology strengthens the concern. In 2025, it promised further Safe Server development for more precise supervision. Its report on that year later described mandatory and correct use as an arduous process and said better data quality was still required for reliable and comparable decisions. Licensed operators did not receive a four-year transition from scrutiny. They had to connect systems, transmit information and operate within central limits from the beginning. Players also entered an infrastructure capable of checking cross-provider activity in real time. The public receives almost no equivalent performance data about the authority itself. We do not know how many Safe Server analyses were completed, how many datasets required correction or how many supervisory actions resulted from the information collected. Nor does the latest announcement disclose availability, incidents, audit results, operating costs or service targets for Dataport. Confidentiality can protect personal records and investigative methods, but it does not prevent publication of aggregate performance figures. The GGL should define the five million figure and publish what Safe Server analysis has achieved since 2023. Germany built LUGAS to produce evidence-led supervision, not simply an impressive database. Read the article here: https://lnkd.in/dPBsJSsZ #GermanGambling #GGL #LUGAS #PlayerProtection

I came back from SBC Summit Lisbon with a considerably worse view of what Lilith Wittmann has done with the Casino Secrets material. During the week I spoke to several people who actually appear in these files, and some of them are not owners, shareholders or directors of gambling companies at all. They work in AML, compliance or simply supported an operator through a licensing process. Their private information ended up with a regulator because they were doing their jobs, and somehow parts of that material then ended up publicly accessible. The nerve of Wittmann complaining in her recent post on LinkedIn that a German bailiff passed her own private address to Malta, while at the same time publishing the private addresses of thousands of other people with apparently far less concern for their privacy, is quite something. I have very little sympathy for Malta Gaming Authority or Curacao Gaming Authority either. They demanded passports, addresses and highly sensitive information from people and companies, and then failed to protect it properly. The CGA itself told us that the access lasted approximately nine months and involved around 123 GB of unique information. That is an extraordinary failure before we even get to the question of what Wittmann subsequently decided to publish. If your passport, home address or other private information is sitting in these files, I would seriously consider doing something about it. Our full Malta Media article explains the available routes, including the Berlin public prosecutor, Berlin's data-protection authority, Cloudflare, the registrar and hosting providers, and we are prepared to help affected people prepare the initial complaints. The damage may already have been done. That does not mean there should be no consequences. Full article: https://lnkd.in/dZk7Dari So now the evidence should go where it belongs: Staatsanwaltschaft Berlin, Berliner Beauftragte für Datenschutz und Informationsfreiheit and, where media-law jurisdiction applies, Medienanstalt Berlin-Brandenburg (mabb). Cloudflare and INWX GmbH should also take properly evidenced reports concerning exposed identity documents seriously.