MGA report flags self exclusion gaps as mystery shopping exposes cross brand weaknesses

• The [Malta](/countries/malta) Gaming Authority has published a thematic review of self exclusion practices following a supervisory exercise in the first half of 2025.

• The review assessed 20 licensees and 58 active URLs using mystery shopping to test controls in real player journeys.
• The exercise was prompted by recurring complaints that self-excluded players could access other brands under the same licence.
• The MGA identified delays, improper conditions such as identity verification, and failures to apply mandatory cooling-off periods.
• Several operators also fell short on limit-setting prompts and Reality Check requirements, with remediation and enforcement steps initiated.

The Malta Gaming Authority has released a new report on [responsible gambling](/glossary/responsible-gambling) controls, detailing compliance shortcomings uncovered during a supervisory exercise carried out in the first half of 2025.

Titled Thematic Review on Self-Exclusion Practices in the Online Gaming Sector, the assessment covered 20 licensees and 58 active URLs. The Authority used mystery shopping to evaluate whether self exclusion measures and related [player protection](/glossary/player-protection) tools were being applied in practice, rather than existing only as documented policy.

The review was launched after repeated complaints indicated that players who had self-excluded could still access other brands operating under the same licence. To test this risk, investigators created accounts across three brands per licensee and examined whether exclusions were enforced across brands and whether similar identity details could bypass controls.

While the majority of licensees were found to be compliant, the MGA said a significant minority fell short of the required standards.

One of the central issues involved delays in activating self-exclusion. Two licensees did not close accounts within 24 hours of receiving an email request, while another required identity verification before putting the exclusion into effect. The MGA reiterated that self-exclusion must apply forthwith, and that no additional conditions, including KYC checks, may delay implementation. It added that it does not consider any timeframe beyond 24 hours to be compliant.

The Authority also identified a case where a licensee revoked a self-exclusion without applying the required [cooling-off period](/glossary/cooling-off-period). Under the relevant rules, at least 24 hours must pass before reducing or revoking a definite exclusion, and seven days must pass for an indefinite exclusion. The MGA emphasised that operators should implement automated delay mechanisms so that immediate reinstatement is prevented regardless of any direct communication between a player and an operator. It said systems must not allow commercial or customer retention pressures to override this control.

Cross-brand enforcement emerged as a structural concern. The MGA said three licensees allowed a self excluded player to register, deposit and play on another brand using similar personal details. The Authority expects operators to maintain systems capable of detecting identical or materially similar data fields, including name, date of birth, email, IP address, or payment methods. Where indicators of problem gambling are present, the exclusion must apply across all brands under the same licence. The report identified centralised exclusion databases and real time matching tools as effective safeguards.

Beyond self-exclusion, the review noted shortcomings in other responsible gambling measures. Four licensees did not prompt players to set responsible gambling limits at registration or before the first deposit. The MGA said operators must offer limit setting at the outset, keep the tools easily accessible, and ensure any limits set are enforced immediately.

Reality Check functionality also showed weaknesses. The MGA said six licensees required additional mandatory information in session pop ups. It reiterated that alerts must suspend play and display time spent, amounts wagered, and winnings and losses. Timers must continue across games, and any exclusion of auto-play from time calculations must be opt-in rather than the default setting.

The Authority said it has communicated its findings to the affected licensees, requiring rectification plans and escalating enforcement where appropriate.

This report is a reminder that responsible gambling compliance is measured in system behaviour, not in policy documents. Mystery shopping is particularly effective because it tests the exact journey a consumer experiences, including edge cases that often expose weak links between brands, wallets, and identity checks.

The most consequential finding is the cross-brand failure. A licence that covers multiple brands is meant to deliver consistent protection across the network, especially where harm indicators exist. If self-exclusion can be bypassed with materially similar details, the risk is not only regulatory sanction, but a deeper reputational issue for both the operator and the jurisdiction, because the promise of protection becomes unconvincing.

The practical direction of travel is clear: stronger matching, centralised exclusion logic, and automated cooling-off controls will become standard expectations rather than best practice. Operators who treat these tools as conversion friction will struggle, because the MGA is explicitly signalling that commercial incentives cannot sit above player protection, and enforcement will follow where remediation does not.