Responsible gambling requirements: what regulators make operators build

Regulated online gambling markets require operators to give players tools to control their play (deposit limits, time-outs, reality checks and self-exclusion), to connect to a national self-exclusion register where one exists, and to monitor accounts for signs of harm and act on them. Many now also cap stakes or game speed: Great Britain limits online slots to £5 a spin (£2 for 18 to 24-year-olds) since 2025, and Germany applies a 1 EUR default per spin.

The details differ sharply by country, which matters for any operator or supplier planning more than one market. This page compares the rules in force as of October 2026 and explains what they mean for product, payments and customer teams. Anti-money laundering duties, which often overlap with spending checks, are covered separately in our AML and KYC guide.

Which player protection tools must every licensed operator offer?

Across the main European regimes, a licensed online operator must offer at least deposit limits, a time-out or cooling-off option, self-exclusion and clear account history. Sweden writes these into chapter 14 of the Spellag (2018:1138), Germany into the GlüStV 2021, and Great Britain into the Gambling Commission’s Licence Conditions and Codes of Practice (LCCP) and Remote Technical Standards.

• Deposit limits: daily, weekly or monthly; reductions apply at once, increases only after a delay (in Sweden no earlier than 72 hours, under chapter 11, section 3 of the gambling ordinance).
• Time-outs and panic buttons: a short break from play. Germany’s panic button under section 6i(3) GlüStV triggers a 24-hour exclusion that ends automatically; Sweden requires a similar 24-hour button under chapter 14, section 11.
• Reality checks and session information: on-screen reminders of time played and net position. Sweden’s SIFS 2022:3 requires login time to be shown and limitable.
• Self-exclusion: operator-level and, where it exists, a national register checked before every session.
• Account history: deposits, withdrawals and net result available to the player.

How do national self-exclusion registers compare?

National registers let a player block themselves from every licensed operator in one step. Great Britain made GamStop mandatory for online licensees on 31 March 2020; Sweden runs Spelpaus, Denmark ROFUS, the Netherlands CRUKS (since 1 October 2021), Germany OASIS, Spain the RGIAJ, and Ontario launched BetGuard on 14 May 2026. None of them binds unlicensed offshore sites.

Germany’s OASIS and LUGAS systems work together: LUGAS holds the cross-operator 1,000 EUR monthly deposit limit file and an activity file that stops parallel play at two operators, and had 5.3 million registered players at the end of 2025. Australia’s equivalent for licensed wagering, BetStop, is run by the ACMA. Operators building for several markets usually integrate each register through a separate API and log every check for audit.

What stake limits and game design rules apply?

Stake caps and game speed rules are now common for online slots. In Great Britain, the £5 maximum stake per spin for players aged 25 and over took effect on 9 April 2025 and the £2 limit for 18 to 24-year-olds on 21 May 2025. Germany sets 1 EUR per spin by default, Sweden requires at least 3 seconds per game round, and Germany an average of 5 seconds.

These rules land on game studios and aggregators as much as on operators. A slot sold into Great Britain, Germany and Sweden typically needs three configurations, each certified by an accredited lab before release; our page on gambling testing laboratories explains who tests what.

What are affordability and financial vulnerability checks?

Affordability rules require operators to look at a customer’s financial position before or while they spend. In Great Britain, light-touch financial vulnerability checks have applied at £500 net deposits in a rolling 30 days since 30 August 2024, and at £150 since 28 February 2025, under LCCP condition 3.4.4. Fuller, frictionless financial risk assessments were piloted rather than made mandatory.

The Netherlands moved in the same direction from 1 October 2024. Under the Kansspelautoriteit’s responsible gaming policy rule, an operator must check whether further play is affordable once a player aged 18 to 24 deposits 300 EUR in a calendar month, or a player over 24 deposits 700 EUR; if the check fails, further deposits that month are blocked. Spain’s Royal Decree 176/2023, in force from March 2023, takes a behaviour-based approach instead: operators must flag “intensive” players by objective indicators, send monthly activity summaries and stop credit-card deposits for them.

Germany caps spend structurally rather than by assessment. The default cross-operator deposit limit is 1,000 EUR per calendar month, which operators may raise to 10,000 EUR with GGL approval, and above 10,000 up to 30,000 EUR only for at most 1% of their active players. Credit cards are excluded as a payment route in Great Britain (since 14 April 2020), in Sweden from 1 May 2026 under chapter 14, section 8 of the Spellag, and for licensed wagering in Australia since 11 June 2024. Payment design choices are covered on our payments page.

How must operators identify and act on markers of harm?

Monitoring duties require operators to watch every account for behavioural markers of harm and to intervene in proportion. In Great Britain, the customer interaction rules in LCCP social responsibility code 3.4.3 require automated monitoring of markers such as spend, time, rising deposits, failed deposits and cancelled withdrawals, with stronger action, including restricting marketing, where harm indicators persist.

Typical markers that regulators list or that appear in enforcement findings include:

• deposit frequency or size rising quickly against the player’s own history;
• repeated failed deposits or several payment methods tried in one session;
• reversed or cancelled withdrawals to keep playing;
• play at unusual hours or in very long sessions;
• chasing losses, such as raising stakes after a losing run;
• contact from the player or a third party expressing concern.

The Dutch regulator expects intervention within an hour of detecting possibly harmful play, with monitoring running around the clock. Operators that act late, or keep marketing to customers showing harm, feature repeatedly in published penalties; the enforcement section tracks the larger cases. Marketing restrictions for at-risk customers also reach affiliates, covered in our affiliate marketing compliance guide.

Who sets these rules: the EU or each country?

Gambling regulation, including problem gambling treatment and player protection, remains a national competence in the EU. The European Commission’s only horizontal text is Recommendation 2014/478/EU of 14 July 2014 on principles for protecting consumers of online gambling services, which is not binding, so each member state sets its own registers, limits and product rules.

That position was already clear in May 2013, when Health Commissioner Tonio Borg answered an MEP’s question by saying that guidelines for treating pathological gambling were for member states and health professionals, not the Commission. The Court of Justice confirmed the room states have in C-440/23 on 16 April 2026, holding that a member state may prohibit online casino games or make them subject to its own licence. The result for operators is a patchwork, summarised for each market in our European markets overview.

What must B2B suppliers build into their products?

Suppliers of games, platforms and player account management systems must ship the controls regulators require, because operators can only comply if the software supports it. In practice that means configurable stake caps per market and per age band, enforced minimum cycle times, autoplay switches, reality-check hooks, limit APIs and integrations with each national register.

1. Market profiles: one build with per-jurisdiction settings for stake caps, speed, autoplay and jackpots, locked by certification.
2. Age-banded limits: Great Britain’s £2 cap for 18 to 24-year-olds needs date of birth passed from the platform into the game session.
3. Register connectors: GamStop, Spelpaus, ROFUS, CRUKS, OASIS and LUGAS each have their own interface and uptime expectations.
4. Net-deposit tracking: rolling windows for British financial vulnerability checks and Dutch monthly thresholds.
5. Audit trail: logs of every limit change, register check and intervention, kept for regulator inspection.

Sweden has required a licence for gambling software suppliers since 1 July 2023, so a supplier there is directly responsible for these features, not just contractually bound. More on supplier licensing is in the B2B supply chain section, and terms such as LCCP, RTS and CRUKS are defined in the glossary.

Frequently asked questions

Is GamStop mandatory for UK-licensed online operators?

Yes. Since 31 March 2020 the Gambling Commission has required online operators licensed in Great Britain to participate in GamStop. Players can choose 6 months, 1 year or 5 years, and the exclusion cannot be shortened once set.

What is the online slots stake limit in Great Britain?

£5 per spin for players aged 25 and over from 9 April 2025, and £2 per spin for players aged 18 to 24 from 21 May 2025. The limits apply to online slots only, not to other casino games or betting.

Does Germany still have a 1 EUR maximum stake on online slots?

1 EUR per spin remains the default under section 22a GlüStV. Since 1 July 2026 the GGL allows a tiered exception up to 5 EUR, with 3 EUR only for players aged 21 and over and 5 EUR only after 90 days of unremarkable play, until 31 December 2027.

Do national self-exclusion registers apply to offshore casinos?

No. Registers such as GamStop, Spelpaus, ROFUS, CRUKS and OASIS bind only operators licensed in that country. An unlicensed site does not check them, which is one reason regulators treat such sites as a player protection risk.

What deposit amount triggers an affordability check in the Netherlands?

From 1 October 2024, operators must check affordability once a player aged 18 to 24 deposits 300 EUR in a calendar month, or once an older player deposits 700 EUR. If affordability is not shown, further deposits that month are blocked.

Are game suppliers responsible for responsible gambling features?

Increasingly, yes. Suppliers must build market-specific stake caps, cycle times and autoplay controls into certified games, and Sweden has licensed gambling software suppliers since 1 July 2023, making them directly accountable to Spelinspektionen.