Online gambling in Germany has run on the GlüStV 2021 rulebook since 1 July 2021, and since 1 January 2023 the Gemeinsame Glücksspielbehörde der Länder (Joint Gambling Authority of the Federal States, GGL) has issued the permissions and supervised the holders from Halle (Saale). What operators face is a regime built on central files, a cross-operator deposit cap and product limits no other European market applies at the same depth.
How the GGL Took Over Online Gambling Supervision in Germany
The sixteen Länder created the authority on 1 July 2021 under section 27a of the treaty, as a public law institution seated in Halle (Saale). It did not start with full powers. Through 2021 and 2022 the licensing files stayed with individual state authorities while the new body was staffed and built in stages, and competence transferred in full on 1 January 2023.
Since then it licenses and supervises cross-state online offers, publishes a whitelist of permitted sites and runs enforcement against everything outside that list. Land-based gambling stayed behind: arcades, casinos and betting shops remain with the individual Länder, so any German compliance map has two layers rather than one. One system moved the other way as well. Responsibility for the nationwide exclusion file was kept in Hesse instead of passing to the new authority, a decision the first amending treaty confirmed with effect from the same date.
GICNT-LS licensing requirements begin where a German supervisory file begins, with proof that the permission held matches the product served and the market served. In Germany that proof is unusually granular, because a permission is not a single document.
What a GGL Licence Covers and What Stays With the Länder
The licence requirements that the GGL applies to operators work in two stages. First comes a permission for the organiser, then approval of the individual games offered or, for sports betting, of the betting markets on the coupon. Terms run five years. Operators used to obtaining a gambling licence in Malta or the United Kingdom often underestimate the second stage, which is where German timelines actually stretch.
| Product | Permitting body | Position under the treaty |
|---|---|---|
| Online sports betting | GGL | Licensable nationwide, no cap on the number of holders, betting markets approved individually |
| Virtual slots | GGL | Licensable nationwide, each game approved separately, may not be presented as casino games |
| Online poker | GGL | Licensable nationwide, non-banked variants only, seating at virtual tables must be random |
| Online casino table games | Individual Länder | Restricted, several states reserve the product for a state operator or a capped number of holders |
| Live dealer studios | Not licensable | Outside the scope of the cross-state online framework |
| Arcades, casinos, betting shops | Individual Länder | Outside the GGL remit entirely |
Tax sits outside the treaty and outside the licensing file, but it shapes the commercial case more than most licence conditions do. Sports betting, virtual slots and online poker are taxed at 5.3% of stakes under the Rennwett- und Lotteriegesetz (Racing Betting and Lottery Act), not of gross gaming revenue. On a high-frequency, low-margin product that is a structural difference, not a line item.
The EUR 1,000 Deposit Cap and How LUGAS Enforces It
Section 6c sets a monthly ceiling of EUR 1,000 per player. The deposit limit that LUGAS applies across Germany is not a per-account figure: it aggregates every licensed brand the player uses, which removes the standard workaround of spreading spend across sites. LUGAS itself, the cross-state gambling supervision system, combines a limit file, an activity file and the safe server interface, and connection to all three is a condition of holding a permission.
The activity file does separate work. It prevents parallel play, so a player logged in with one licensee cannot open a session with another at the same time. Higher deposit ceilings exist but are conditional: up to EUR 10,000 a month against evidence of financial capacity, and the band between EUR 10,000 and EUR 30,000 is available to no more than 1% of a licensee’s active players.
The point most often missed in implementation is where the duty sits. The authority has restated that the file reports the position while the operator must refuse the transaction, so a deposit accepted above the ceiling is the licensee’s breach, not a system failure. Set against other responsible gambling tool mandates, the German cap is unusual precisely because it binds across the licensed market rather than brand by brand.
Checking Players Against OASIS Before Every Session
OASIS, the self-exclusion register that binds every licensed operator in Germany, is administered by the Regierungspräsidium Darmstadt on behalf of Hesse rather than by the GGL. An entry blocks participation across arcades, casinos, betting shops, higher-risk lotteries and the whole online offer, which makes it broader in reach than most comparable systems. The file held roughly 372,000 active exclusions in January 2026, against about 303,000 a year earlier, and around 97% of entries are self-imposed. Operators sent it more than 5.2 billion queries during 2025.
- Query the register against the player’s master data before play is enabled, and repeat the check on the schedule the licence sets.
- Treat anything other than a negative result as a bar on participation, including a failed or unavailable query.
- Register a 24-hour exclusion when the player uses the panic button during a session.
- Operate a third-party exclusion route, not only self-requested entries, and document the grounds staff or monitoring systems relied on.
- Keep the connection live: a licensee that cannot reach the file cannot lawfully open play.
- Do not tell players a minimum term can be shortened. Once set it runs to its end, and removal requires an application to the Darmstadt authority.
Among national self-exclusion registers, the German file is the one most likely to expose a weak onboarding flow, because the check has to succeed before the first stake rather than at first withdrawal.
Product Rules That Reshape Virtual Slots Under GlüStV 2021
The stake limit that applies to German virtual slots is the single most consequential product rule in the treaty, and it does not travel: a game certified for another market almost always needs a German build.
| Rule | Requirement |
|---|---|
| Maximum stake | EUR 1 per spin |
| Minimum spin duration | 5 seconds between spins |
| Autoplay | Prohibited |
| Jackpots | Prohibited where part of the stake funds a pooled prize |
| Parallel play | One licensee at a time, enforced through the activity file |
| Panic button | Immediate exclusion from play for 24 hours |
| Naming | Virtual slots may not be described as casino or casino games |
These constraints are why channelling dominates the German policy argument. The authority’s 2024 report counted 858 German-language sites run by 212 unlicensed organisers, with an estimated volume of EUR 500 to 600 million, which it put at roughly 3 to 4% of the entire permitted market and about 25% of the permitted online offer in the higher-risk verticals. Industry estimates run far above that: an H2 Gambling Capital analysis circulated in 2024 put German channelling near 36%, and the Handelsblatt Research Institute has placed more than half of online play outside the licensed market. The gap between those figures is itself part of the evaluation now under way, and no compliance position should rest on either number alone.
Section 5 Advertising Limits Reach Affiliates and Influencers
The advertising restrictions written into German gambling law are unusual less for their content than for the daypart they remove. Most of the working day is closed to the products that generate most of the revenue.
- No advertising for virtual slots, online poker or online casino games on television, radio or the internet between 06:00 and 21:00 under section 5(3).
- No sports betting advertising immediately before or during a live broadcast of the event on the channel carrying it, and none featuring active athletes or officials.
- No mixing of advertising with editorial content, which rules out native placements.
- No influencer promotion of virtual slots.
- Affiliate remuneration must be fixed rather than tied to deposits, stakes or revenue.
- No misleading claims about the chance or size of a win, and no framing of gambling as a way out of financial difficulty.
- Administrative fines reach EUR 500,000 per breach under section 28a, and the exposure extends to anyone advertising an unlicensed offer.
Read against gambling advertising codes in the United Kingdom, Italy, Spain and Ontario, the German position is strict but predictable. The practical risk for licensees sits in partner channels, where a compliant brand plan can still be undone by an affiliate page or a stream published inside the watershed.
How Does the GGL Act Against Unlicensed Operators
GGL enforcement against illegal gambling in Germany rests on three instruments: prohibition orders against organisers and those advertising for them, payment blocking directed at payment service providers and e-money institutions, and monitoring of unlicensed offers without prior recourse to the operator. The fourth instrument, network blocking, has been the weak one.
On 19 March 2025 the Bundesverwaltungsgericht (Federal Administrative Court) held in case 8 C 3.24 that section 9(1) sentence 3 no. 5 of the treaty provides no basis for blocking orders against providers that merely transmit content. The authority had already been working around that line since the first adverse rulings in 2022, leaning on prohibition orders and the payment chain. Its 2025 activity report, published on 3 July 2026, records 621 supervisory actions involving permitted operators, 148 applications for base permissions or amendments, 1,843 unlicensed sites unreachable from Germany through prohibition orders or blocking, and 178 sites cut off from mainstream payment providers.
Closing the blocking gap is the job of the Second Interstate Treaty amending the GlüStV 2021, which rebuilds the provision around the Digital Services Act concept of intermediary services so that access providers and domain registrars can be addressed directly. It was notified to the European Commission on 8 July 2025 and signed by the Länder in March 2026, and it enters into force the day after the last ratification instrument is deposited. That has not happened yet: Lower Saxony released its ratification bill for consultation on 7 July 2026, and other states are at comparable stages. Compliance planning should treat the expanded powers as imminent rather than current. German practice otherwise fits the pattern behind regulatory fines in iGaming, where supervision now reaches the payment and hosting chain instead of stopping at the operator.
The 2026 Evaluation and the Licence Cycle That Starts in 2027
Two timelines are about to overlap, and gambling licence renewals in Germany from 2027 are the reason the evaluation matters commercially rather than academically.
- Report due 31 December 2026. Section 32 requires a summary evaluation of the treaty, supported by commissioned studies on advertising, player protection and measurement of the unlicensed market.
- Five-year terms, seven-year renewals. Permissions granted under the treaty run five years; renewals are expected to carry seven-year terms and to be issued from 2027.
- Preparation is already a stated priority. The authority named the 2027 permission cycle as a focus in its 2025 report, alongside the evaluation itself.
- Limits are genuinely open. Deposit and stake ceilings are within the review’s scope, with channelling as the argument on one side and player protection outcomes on the other.
- A reformed treaty is not a 2027 event. Any substantive rewrite would follow the report and realistically take a further twelve to twenty-four months, with the treaty running to 2028 in the meantime.
- The amending treaty runs separately. The blocking reform does not wait for the evaluation and should be tracked as its own workstream.
The nearest comparison for operators weighing both markets is the Dutch regime, where KSA licensing and CRUKS pair a duty of care with different limits and a different enforcement toolkit, and where the same channelling argument has produced different answers.
Mapping German Obligations to GICNT-LS and GICNT-PP
German licensees usually clear the substantive bar in GICNT-PP comfortably, because the treaty already imposes controls that most certification schemes only recommend. Where files fall short is evidence: the control exists, the record of it operating does not. The mapping below is how an assessment reads a German operation.
| Certification requirement | Evidence expected from a German licensee |
|---|---|
| GICNT-LS, permission matched to product and market | GGL permission covering each approved game or betting market, whitelist entry, current licence conditions |
| GICNT-LS, corporate reliability | Shareholder and key personnel disclosures, notification of material changes in ownership or structure |
| GICNT-PP, deposit controls | Limit file connection, operator-side refusal logic, documentation supporting any raised ceiling |
| GICNT-PP, exclusion handling | Live OASIS connection, pre-session checks, panic button behaviour, third-party exclusion procedure |
| GICNT-PP, harm detection | Documented indicators, escalation records, player interaction logs, evidence relied on when limits were raised |
| GICNT-AM, marketing controls | Watershed compliance records, affiliate contracts on fixed remuneration, sign-off trail for creatives |
The harm detection row is the one worth rehearsing before an audit. The authority developed its own markers of harm for checks on raised deposit limits and first applied them in 2024, and courts have since upheld their use, so a German file is expected to show reasoning rather than a threshold. Player protection requirements under GICNT-PP are drafted to be jurisdiction neutral, which is why a German operation typically over-satisfies the control and under-satisfies the paperwork.
Common Questions About the German GGL Regime
Does a GGL permission cover live dealer casino games?
No. The cross-state permissions cover online sports betting, virtual slots and online poker. Online casino table games remain with the individual Länder, several of which reserve them for a state operator or a capped number of holders, and live dealer play sits outside the nationwide framework entirely.
Can a player deposit more than EUR 1,000 a month?
Yes, under conditions. The default ceiling under section 6c is EUR 1,000 across all licensees combined. A higher limit up to EUR 10,000 requires evidence of financial capacity, and the band between EUR 10,000 and EUR 30,000 is open to no more than 1% of a licensee’s active players.
Is an MGA or Curaçao licence enough to serve German players?
No. Offering to players in Germany requires a German permission. Sites without one are treated as unlicensed, face prohibition orders and payment blocking, and anyone advertising them is exposed to administrative fines of up to EUR 500,000 per breach.
When do the first permissions come up for renewal?
Permissions issued under the treaty run for five years, and renewals are expected to carry seven-year terms from 2027. Because the evaluation report is due by 31 December 2026, renewal files and any change in licence conditions will be prepared in the same window.
Do the advertising rules apply to affiliates?
Yes. The watershed, the ban on mixing advertising with editorial content and the prohibition on influencer promotion of virtual slots attach to the promotion itself, whoever publishes it. Affiliate remuneration must also be fixed rather than tied to deposits, stakes or revenue, which rules out standard revenue share for these products.