Operating without a gaming licence in 2026: how it actually ends

Articles on this subject usually finish with “the risks are high”. That is not an answer. What follows is what actually happens, in what order, and with what consequences.

Payment processing goes first, before any enforcement action. The typical sequence starts not with a visit from the authorities but with a letter from a payment partner terminating the agreement. Then it emerges that the company and its owners are on a card scheme’s terminated merchant database, which closes off acquiring for five years, not only for this project but for any that follows.

Regulators have moved from blocking websites to blocking money. In May 2026 the German regulator confirmed it had issued blocking directives to more than forty payment service providers. In March 2026 the Dutch regulator issued a fine of €24,846,000, the largest in its history for unlicensed operation.

Liability attaches where you operate, not where you are registered. In many jurisdictions operating without a licence is a criminal offence rather than a regulatory breach, and the people who answer for it are named individuals: directors and beneficial owners.

Content providers leave before regulators arrive. Major studios and aggregators check an operator’s status at contract signature and at every renewal. A provider walking away stops the product faster than any enforcement order.

And the central misconception. Holding an offshore licence does not mean you are operating lawfully everywhere. Most of the problems in this area are built on that assumption, and the next section deals with it.

The most common error sounds like this: “we hold a Curacao licence, so we are legal.” That is wrong, and the error is expensive.

How regulation actually works. The right to take bets from a country’s residents is granted by that country’s regulator, not by the jurisdiction that issued your licence. Germany, the Netherlands, Italy, Spain, France, the United Kingdom, Austria and dozens of other countries operate their own licensing regimes. An operator holding an offshore licence and accepting players from those countries is unlicensed in the eyes of the local regulator, whatever the certificate says.

What an offshore licence does give you. A legal framework for activity in the issuing jurisdiction and operational access: the ability to contract with providers, connect payment processing and work with affiliate networks. That is valuable and it works. What it is not is a licence to take players from anywhere.

Where the boundary sits. Every licence comes with a list of restricted territories. Anjouan’s covers Australia, Austria, France, Germany, the Netherlands, Spain, the United Kingdom, the United States and the FATF blacklist. Accepting players from those markets breaches the terms of your own licence, which means grounds for revocation exist before any local regulator gets involved.

The practical consequence. Operating without a licence does not only mean having no licence at all. The same concept covers operating in a market your licence does not extend to. The second case is far more common than the first, and the consequences are identical.

This section is worth reading even if you skip the rest. It contains the consequence that outlives the business itself.

How the terminated merchant database works. Mastercard operates a database known as MATCH, the Alert to Control High-risk Merchants. Merchants whose agreements have been terminated by an acquiring bank on certain grounds are recorded on it. The acquirer is required to add the entry within five days of termination. Every acquirer checks the database when reviewing a new application.

The grounds that matter here. Among the reason codes are one for illegal transactions and one for breach of card scheme standards. The second is drafted broadly and covers any breach of card acceptance rules, so an acquirer minded to terminate has considerable latitude in choosing the ground.

Duration and the way out. The entry runs for five years. Early removal is possible in only two narrow cases: where the entry was made in error and this can be demonstrated, or where it was made under the data security standard code and compliance has been restored. In every other case there is no early removal procedure, and the entry serves its full term regardless of what you have fixed since.

Why it hits the owner and not just the company. The record contains details of the legal entity and of its owners. The whole point of the check is to stop a new company with the same beneficial owners slipping through. Closing the project and opening the next one with a clean slate does not work: the next acquiring application is declined exactly as this one was.

How people find out. Almost always when submitting an application to a new provider, which comes back declined with no explanation. By that point there is nothing to be done.

Separately on chargebacks. An unlicensed operator attracts an elevated share of disputes: a player refused a withdrawal goes to their own bank, and their odds there are reasonable. Card scheme monitoring programmes react when volume and ratio thresholds are exceeded, and termination by the acquirer after that is a matter of time. The monitoring programme does not terminate the agreement itself, the bank does, but the outcome is the same.

The landscape has shifted fundamentally, and older material does not describe it.

A change of approach: from websites to money. The main tool used to be domain blocking, which mirrors got round. Regulators are now going after payment infrastructure. In May 2026 the German regulator confirmed blocking directives issued to more than forty payment service providers. The Dutch regulator is expanding its teams through 2026 and working not with operators but with payment services, hosting providers, social platforms and solution suppliers.

Penalties have grown. In March 2026 the Dutch regulator fined Novatech €24,846,000, the largest penalty in its practice for unlicensed operation, and fined Fortaprime €1,795,000 at the same time. Both had previously received warnings and cease and desist orders, and had continued regardless.

Regulators have joined forces. In late 2025 seven national regulators, from Austria, France, Germany, the United Kingdom, Italy, Portugal and Spain, issued a joint statement on coordinated action against unlicensed operators. Each country used to work separately, which gave operators room to manoeuvre.

A new legal instrument. The German Federal Administrative Court ruled that blocking through access providers was unlawful: they merely transmit traffic and are not responsible for content. In response an amendment is being prepared that moves the drafting to the intermediary services concept from European digital services legislation, so as to capture the whole chain including mere conduit. The Dutch regulator is already using those provisions for expedited content removal.

Why regulators have become more aggressive. Licensed markets are under-collecting. In Germany the legal market’s share of online slots sits below 40%; in the Netherlands it has fallen below 50%. On some estimates unlicensed operators offer 9.2 times more products in Germany than the legal market does. For a government that is lost tax revenue, and the pressure will rise rather than ease.

Domain blocking is the most visible consequence and by some distance the least painful.

Domains. Listing on registers of prohibited resources, access restrictions at network operator level, removal from search results in particular jurisdictions. Mirrors get round it, but every mirror means search traffic lost again, advertising configured again and an audience retrained again. The economics of a project built on rotating domains do not work.

Payments. Directives to payment providers, prohibitions on processing transactions for named recipients, withdrawal of payment methods. This stops the business rather than inconveniencing it.

Advertising. Advertising platforms require certification to promote gaming products in specific countries, and the condition of certification is holding a local licence. Without one the advertising account is closed, and repeat breaches take linked accounts with them. A separate category is affiliate networks, which carry their own liability for promoting unlicensed offers and therefore check the advertiser’s status.

The chain of intermediaries. The direction of travel in 2026 is pressure not on the operator but on everyone servicing it: payment services, hosting, domain registrars, solution providers, social platforms, affiliate networks. An operator can hide behind a structure; an intermediary cannot, because it holds a licence and a reputation it will not risk. So in 2026 a project loses its suppliers more often than it receives an enforcement order.

Two separate questions get conflated here: liability in the country the business is actually run from, and liability in the countries where the players are.

Place of registration does not determine applicable law. This is the core principle, and it holds almost everywhere. If the platform is genuinely managed from a country’s territory, meaning decisions are taken, staff work and accounts are controlled from there, that country’s law applies regardless of where the licence was issued, where the servers sit or where the company is registered. An offshore wrapper changes the tax and corporate position; it does not remove the operating activity from local law.

There is a criminal dimension. In many jurisdictions organising gambling without the relevant licence is a criminal offence rather than a breach of sector rules. The elements, thresholds and sanctions vary from country to country, and they need checking against the place of actual management and the location of key staff, not against the country of incorporation.

Individuals answer, not only the company. In most constructions liability falls on directors, persons exercising actual control and beneficial owners. That matters, because a company can be wound up and a personal record cannot.

Administrative penalties in Europe are comparable to criminal ones in scale. In March 2026 the Dutch regulator fined Novatech €24,846,000, the largest sanction in its practice for unlicensed operation, and Fortaprime €1,795,000. Alongside financial penalties come orders to cease operations.

What makes the position worse. Continuing after a warning. This is recorded in the Dutch decisions as an aggravating factor: both companies fined had previously received cease and desist orders and had gone on accepting players. The first notice from a regulator is the point at which the situation is still manageable, and it needs an immediate response.

Liability extends along the chain. The direction in 2026 is attention paid not only to the operator but to those servicing it. Payment services, hosting, domain registrars, affiliate networks and solution providers hold their own licences and reputations, and they will not risk either for one client. In practice that means the project loses contractors before it receives an order.

The practical conclusion. Legal assessment needs three coordinates: where management physically sits, where the players are, and where key staff are located. There is no general answer, because each of those points has its own law.

The commercial perimeter closes before the legal one does, and for an operating business that is the more tangible problem.

Game providers. Major studios and aggregators check an operator’s status at contract signature and at every renewal. A contract with an unlicensed operator creates risk for the provider itself, which holds licences of its own. Refusal means the product range shrinks to what second-tier providers will supply, and players notice that directly.

Affiliate networks. Public programmes with high volumes require proof of status. Some networks carry liability for promoting unlicensed offers in their own jurisdiction and therefore vet advertisers in advance.

App stores. Platform rules require a licence in every country where a real-money gaming app is distributed, plus configured geographic restrictions. An app without those does not pass review, and one already published is removed.

Platforms and technical contractors. Since 2025 individual jurisdictions have introduced requirements for solution providers to hold licences of their own in order to work with operators. Which means that even choosing contractors now depends on your regulatory status.

The upshot. An unlicensed project fairly quickly finds itself in a perimeter of weaker suppliers, worse payment terms and less visible affiliate networks. This is not a prohibition but a gradual narrowing of options, and it shows up in revenue before it shows up in legal documents.

Funds in accounts. On termination the acquirer holds a reserve, usually for the chargeback period. Where the termination followed a breach, access to funds can be restricted for months. Meanwhile the operator still has to pay out winnings while being unable to use incoming receipts.

Obligations to players. An unlicensed operator has no dispute resolution mechanism recognised by any third party. Every conflict turns into a chargeback or a public review. Review portals and warning lists build a reputation faster than marketing can construct one, and it is harder to restore than to create.

Bank accounts. A company that has lost acquiring over a breach also faces questions about its operating bank account. Financial institutions ask about source of funds, and a history of termination for breach is a poor answer.

Sale of the business and investment. In structural due diligence ahead of a transaction, regulatory status is checked first. An absent licence either kills the deal or reduces the valuation to the value of the technology without the player base, because the buyer cannot lawfully serve that base. Institutional investors do not look at these projects at all.

Personal consequences for owners. The terminated merchant record attaches to beneficial owners. That affects the ability to launch a subsequent project in any sector requiring card acquiring, not just gaming.

Holding no licence at all is the rare case. Far more often the problem arises for operators who consider themselves licensed.

Accepting players from restricted countries. A licence operates with exclusions. A player from a restricted country who completes registration because geo-blocking was not configured is a breach of your own licence terms. Which means grounds for revocation arise with your own regulator.

Operating a product the licence does not cover. A licence is issued against a stated list of verticals. Adding a new direction without notifying the regulator puts it outside the perimeter.

A gap in status. Licences run for a year and require renewal in advance, usually no later than thirty days before expiry. Missing that means operating without live status, even if the renewal is eventually granted. Partners see the gap when they check.

A licence that cannot be verified. If a counterparty cannot confirm your certificate is valid through an official mechanism, for them it is the same as not having one. Individual jurisdictions introduced updated verification frameworks in 2026 for exactly this reason.

Advertising in restricted markets. Even with player acceptance configured correctly, promoting in a territory your licence does not cover is a separate breach, and in several countries the affiliate network carries liability for it too.

A structure that does not match the application. Where the actual ownership arrangement, payment flows or country of management diverge from what was stated in the application, the licence formally exists but protects you less than it appears to under scrutiny.

The position is recoverable, and fixing it is almost always cheaper than doing nothing. The order runs as follows.

First, stop accepting players from restricted countries. This is done immediately and costs neither time nor money. It is the category that most often triggers the chain of problems and the one most quickly removed. Configure geo-blocking and check that it works on payment method as well as on stated address.

Second, establish what has already happened. Check the status of your agreements with payment partners, whether any regulator notices have arrived, and the state of your domains on restriction registers. If an acquiring agreement has already been terminated, ask the acquirer whether a database entry was made and on what ground. You need to know that before submitting the next application, not after it is declined.

Third, obtain a licence for the model you actually have. Not the one in the business plan but the real one: real markets, real products, real ownership structure. A divergence between application and practice recreates the same problem.

Fourth, put the documents in order before submitting. Anti-money-laundering and customer due diligence policies, responsible gambling procedures, provider agreements, a description of payment flows. An application with internal inconsistencies goes round for another cycle and doubles the timeline.

Fifth, plan the payment route in advance. If a terminated merchant entry already exists, some routes are closed for five years and the structure has to be built around that. It is solvable, but the solution looks different from the one for a project with a clean history.

What not to do. Continue operating after a regulator warning: that is precisely what gets recorded as an aggravating factor. Open a new company with the same beneficial owners hoping for a clean slate: the check is designed to catch exactly that. Rotate domains instead of solving the problem: it defers the consequences and enlarges them.

Operating without a licence looks like a saving at launch and turns out to be a deferred payment with interest. A licence costs between €17,000 and €50,000 a year depending on jurisdiction. One European regulator’s fine in 2026 came to almost €25 million, and a terminated merchant entry closes off acquiring for five years and follows the owner into every subsequent project.

The sensible approach is straightforward: start with an inexpensive licence matched to the model you actually have, configure geographic restrictions from day one, and plan the move to a more recognised jurisdiction as you grow. That costs less than any of the scenarios described above.

All directions and their terms are set out in the licensing section. Individual breakdowns cover Anjouan, Curacao, Tobique, Nevis and Malta.

Finextwin is an international corporate services firm with offices in Hong Kong and Tbilisi. Over 6+ years we have registered companies in 30+ jurisdictions for more than 1,250 clients and we work with 65+ banking partners. We match the jurisdiction to the model you actually operate, handle the application and the choice of payment route, and work through situations where a project is already running without status. Licence decisions rest with the regulator and account decisions with the financial institution, and nobody can guarantee either: our job is to remove the reasons for refusal in advance. A manager responds within 30 minutes.