On 25 November 2025, the gambling regulators of seven European countries signed a joint statement on illegal online gambling. The signatories were Austria, France, Germany, Great Britain, Italy, Portugal, and Spain. The Madrid meeting at which the statement was finalised was hosted by Spain's DGOJ as part of the European Gambling Regulators Meeting.

Most operators logged the statement at the time and moved on. Six months later, the implications are starting to materialise. The Dutch KSA's EUR 24.8 million fine on Novatech in March 2026 is the most visible early consequence. There will be more.

This post walks through what the statement actually changed, why it matters, and what operators on both sides of the licence line should be thinking about now.

The headline

Until 2025, European gambling enforcement was conducted on a national basis. Each regulator dealt with illegal operators targeting its own market. Bilateral cooperation existed but was ad hoc. The November 2025 statement formalises three workstreams that move the model from bilateral to multilateral.

The three workstreams are explicit in the joint text:

First, systematic cross-border information-sharing about illegal operators. This is the operational core. Regulators commit to exchanging intelligence on unlicensed operators, their corporate structures, payment flows, and affiliate networks. A regulator in Spain that identifies an illegal operator now feeds that data to colleagues in Germany, Italy, and the UK. A pattern that takes one national regulator months to assemble can be assembled in weeks across seven.

Second, a coordinated pressure campaign on digital platforms and social networks to take down illegal gambling advertising. The statement calls on platforms to strengthen their mechanisms to prevent the dissemination of advertising content from unauthorised operators. The regulators acknowledge they cannot directly compel platform action, but the joint pressure is materially harder for platforms to brush off than seven separate national requests.

Third, exchange of best practices on investigation and sanctioning. This is the slower-moving workstream but probably the highest-impact long term. Regulators that have developed effective tools (Italy's website and payment blocking, Germany's payment service provider orders, Spain's affiliate enforcement) share what works. Regulators that have not yet developed those tools adopt them.

None of the three workstreams require new EU legislation. They are operational commitments under existing legal frameworks. They started taking effect immediately.

The data underneath the statement

The statement was published alongside the Yield Security report on Illegal Gambling in the EU, commissioned by the European Casino Association. The numbers in that report are the part that explains why regulators moved.

Three data points are worth knowing:

·       92 per cent of online gambling content viewed by EU citizens in 2024 promoted illegal operators

·       81 million of the 118 million Europeans who engaged with online gambling in 2024 played on unlicensed sites (68.6 per cent)

·       The targeting of Europeans by illegal gambling operators grew 26 per cent compared to 2023

The top-line implication: across the EU, the licensed market is the minority of the actual market. Most European players, by both engagement count and content exposure, are on illegal sites. The regulators' response is unsurprising once those numbers are visible.

The Yield Security report also documented the channels driving illegal traffic. Social media, video sharing platforms, and affiliate networks were the three biggest. That mapping shapes the second workstream of the joint statement directly.

Why the Uk signature is significant

Most commentary treats the joint statement as an EU initiative. It is not. Great Britain is one of the seven signatories, alongside Austria, France, Germany, Italy, Portugal, and Spain.

This matters operationally. UK Gambling Commission enforcement against illegal offshore operators serving UK players is significant for the global market because the UK is one of the largest English-language gambling markets. Pre-2025, that enforcement was largely a UK-only effort. Post-2025, UK enforcement actions can draw on intelligence from six other regulators.

The Gambling Commission's published 2025 guidance already states that it will independently verify effective blocking measures are in place against unlicensed brands. Cross-border information sharing makes that verification cheaper and gives it broader reach.

For operators that make the choice to serve UK players from offshore licences, the UK signature on this statement should give you pause to think.

How the joint statement connects to ProtectEU and AMLA

The joint statement sits inside a wider European policy initiative called ProtectEU, launched in 2025 to address cross-border threats. ProtectEU is broader than gambling, but illegal gambling features prominently in its planning.

Three elements of ProtectEU touch the gambling space:

First, expansion of Europol's remit to include cross-border digital fraud and adjacent illegal commerce, including unlicensed gambling.

Second, application of the Digital Services Act (DSA) to gambling-related content on platforms. The DSA already requires very large online platforms to assess and mitigate systemic risks. Bringing illegal gambling promotion explicitly within that scope creates a regulatory hook against platforms that fail to act.

Third, establishment of the new Anti-Money Laundering Authority (AMLA) to supervise financial activity across the EU. AMLA is principally a banking supervisor but has scope over gambling-related AML where it intersects with regulated financial entities. AMLA goes operational in stages through 2026 and 2027.

The joint statement is best understood as the gambling-regulator workstream that runs in parallel to these broader EU efforts. The cooperation it formalises feeds into ProtectEU's data-sharing infrastructure.

What is means for grey-market operators

The practical effect is straightforward. The window for operating grey across European markets without serious enforcement risk has closed materially.

Three specific changes worth tracking:

Affiliate exposure has gone up. Spain's DGOJ has been particularly active on affiliate enforcement, with EUR 5 million fines for foreign operators without licences and additional pressure on affiliates promoting them. Affiliate networks operating across multiple European markets now face the prospect of coordinated pressure rather than national pressure. An affiliate that previously triaged enforcement letters one country at a time now sees them arrive in clusters.

Payment processor relationships have become more fragile. Germany's GGL has formal authority to order payment blocking by PSPs against unlicensed operators. Italy uses similar mechanisms. With cross-border information-sharing, an unlicensed operator that has been blocked by a German PSP order can now expect that information to reach Italian, Spanish, and Portuguese regulators within weeks, prompting follow-on actions in those markets.

Cross-border seizure scenarios are becoming more credible. The statement does not directly enable asset seizures, but the information-sharing it formalises makes credible the kind of coordinated action that produces seizures. Operators with corporate structures spread across multiple European jurisdictions now have to consider that an enforcement action in one country can rapidly produce parallel actions in others.

The Dutch KSA's Novatech fine in March 2026 is not, technically, a fruit of the joint statement (KSA is not a signatory). But KSA's enforcement framing of crypto payments as deliberate circumvention is exactly the kind of doctrine that travels well between regulators sharing intelligence. Expect to see Novatech-style framings adopted by signatory regulators in the next 6 to 12 months.

What is means for licensed operators

The regulators' second workstream applies pressure to digital platforms and social networks to take down illegal gambling advertising. In practice, this means more aggressive content moderation by platforms. The challenge for licensed operators: platform moderation is rarely surgical. Coordinated regulator pressure that targets illegal gambling content tends to also catch licensed gambling content with similar visual signatures.

Licensed operators marketing on Meta, TikTok, Google, YouTube, and similar platforms should expect:

·       More rejections of legitimate advertising creative as platforms over-correct

·       More frequent account-level reviews triggered by gambling-content classifiers

·       More documentation requirements to verify licence status before advertising approval

This is not a reason to stop using these channels. It is a reason to ensure your advertising operations have current licence documentation accessible at the platform level, that your account verification is up to date, and that your creative is clearly identifiable as licensed activity. Operators who treat this as background noise will see costly disruptions to acquisition.

What is means for affiliate operations

Affiliates are the most exposed party in the new framework. The statement explicitly identifies affiliate networks as a vehicle for illegal gambling promotion. Spanish DGOJ is already enforcing against affiliates promoting unlicensed sites with fines reaching EUR 50 million for the most serious cases.

An affiliate operating across multiple European markets now needs to ensure that every brand it promotes holds a valid licence in every market the affiliate's traffic touches. Geo-restriction at the affiliate level is no longer optional. Affiliates that have historically operated across markets without rigorous licence verification per jurisdiction face the prospect of coordinated enforcement.

For affiliates, the right response is operational: maintain a licence verification log per brand per market, geo-block traffic where the brand is unlicensed, and document compliance procedures in a way that survives a regulator's review.

What signatory regulator are likely to do next

Three predictions, based on what each regulator has already publicly committed to.

The Spanish DGOJ will continue scaling its affiliate enforcement programme. The EUR 5 million fines on six foreign operators in 2025 sets a template. Expect more in 2026, with the affiliate networks themselves increasingly named.

Italy's ADM and AGCOM will continue to lead on website and payment blocking. Italy's enforcement architecture is the most mature in Europe. Expect cross-border coordination to extend Italian methods to other signatory countries.

Germany's GGL will continue using payment service provider orders. The GGL's powers are sweeping and the cross-border framework now lets German evidence support orders in other markets.

The UK Gambling Commission is the wild card. UK enforcement has historically been less aggressive than continental peers. With the joint statement and the contemporaneous 40 per cent Remote Gaming Duty, the Commission has both the political pressure and the data infrastructure to step up. Worth watching closely.

What ICOS does on this

For operators on our retainer, cross-border enforcement risk affecting licensed operators is now a standing item in the quarterly compliance review. We perform four checks: licence verification per market, affiliate geo-restriction audit, payment processor risk by jurisdiction, and platform advertising documentation review.

For operators not on retainer, the same review is available as a one-time framework refresh.

If you want to talk about your specific cross-border exposure, tell us your situation.

The era of fighting illegal gambling jurisdiction by jurisdiction is over. If you are a grey market operator looking to regularise your operations now is the time.